Well there's your problem. See this thread and the PRs linked to the PR it links to. logstash uses a hash to remember every key it has ever seen.
TL/DR: mitigated in the next releases (7.17 and 8.x).
2 Likes