Log formatting under lumberjack lost in filebeats

Filebeat uses YAML only for its configuration file. The data it sends to Logstash is JSON. The line it reads from your files is put into the message field of the event sent to Logstash.

Since your lines are JSON, you need to apply the JSON codec to the input. See Parse / ship JSON file with filebeat