Logstash - %{+YYYY} returns a year two years behind around year boundary – how is this possible?

Yes, always. But logstash just calls Joda to do the parsing. I don’t know if it is documented, but that looks like you could also try a Java (%{{yyyy}}) format to get a different parser.

If you were using a date filter to set the timestamp (and I hear that you say that are not) then there would be other possible issues around heuristics used to guess years from timestamps that do not include the year.