I've been hit hard by this. Multiple machines have filebeat installed with the syslog module.
By some other cirumstances, the filebeat index was unavailable this causes filebeat to log to journalctl and thus indirectly to syslog again.
This causes a feedback loop with messages which grow exponentially.
Have others been hit by this, and what would be the correct/good way to stop this?
/update
Of course I can edit the default filebeat config, AND the systemd unit file, to log to /var/log/filebeat/* (or something like that), but I can't really believe that the issue I'm seeing is default behaviour, triggered by something as simple as a closed/read-only index. Am I doing something extra-ordinary?