It was a bit weird while debugging. How I fixed it was. Stopping all the connected metricbeats as a service (systemctl stop metricbeat). Removed all the indexes, and patterns and index template of metricbeat.
I downloaded the latest update of metricbeat to my osx machine locally and connected to the live location. I ran this afterwards:
./metricbeat setup -e
After that I got 2 index patterns of metricbeat-* and one of which had event.dataset as a text field and subfield of keyword. The second one was the correct one of the needed keyword. Why did there were 2 index patterns after setting it up, I have no clue but after removal of the wrong one, everything works again with no changes on the workers whatsoever.
Can't seem to reproduce it on a new stack, but will try later with a 7.4.2 version and then reupgrade again to see if I can reproduce it.