Hmmm... One of them may be the culprit. Have you looked at the odd ones? Do they all contain logs from the same host? Hopefully they indicate which Logstash instance they came through. That would be a relatively easy way to tell. If each of the Logstash hosts are producing these, it will be harder to trace.