I suspect those date manipulations. I wonder if one of the formats is not what you expect due to locale or langauge issues. Perhaps try examining exactly what the TO_CHAR calls are returning in logstash. Can you do things like
SELECT TO_CHAR(HOR_INI_REGISTRO,'TS') from DB2H.HCTBF1W
etc.? And I mean do that in a jdbc input, not in a DB CLI.