So I figured out what was going on. Metricbeat by default will send it's logs to syslog even if you have it defined in the metricbeat.yml config file not to so the filebeat system module was still picking this up. I was able to override the default setting based on this post and this resolved the issue.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.