Logstash pipeline processing

That sounds a lot like inode re-use. Read this thread.