the log-output is pretty funny. it's a JSON event embedded into another JSON event.
If filebeat is writing to file, the content is JSON. First logstash instance reading from file written by filebeat (why is this instance even required?) needs json codec in order to parse the event.