After a long day I´ve found out, that logstash was not the right place for my configuration. My answer was here: Parse JSON data with filebeat - #3 by calmandniceperson
This configuration for filebeat.prospectors finally solved my problem.
@magnusbaeck nevertheless thank you for your answer!