Strange observation in ELK

See my answer at