I think I found out why its happening. While changing the query(including adding fields). The new fields didn't reach elasticsearch. Restarting logstash didn't fix it either. I think logstash was stashing the old messages somehow and resends it to elasticsearch.
I had queue.type: persisted to help against message losses:
When I changed back to the default setting queue.type: memory Everything worked as expected. Elasticsearch got the new fields and all rows was indexed.