Ok. I cannot reproduce that here. Because we´re using systemd with journald.
If you cannot stop logging to /var/log/syslog than it´s worth a try to set it explicit to log to a file. Than you´re definetly sure that it´s configured the right way. And it´s easier to read for others (your collegues). Who do not have the knowledge of the defaultbehavior of filebeat.