I upgraded to filebeat 8.15.3 and observed that I was having errors generate in the output log. Closer inspection showed that the ingest pipeline was failing to parsing IPv6 addresses.

My example log had a callerIPAddress of 2603:1036:301:207e::5 which was being picked up by the topmost grok parser, resulting in failed to parse field [source.ip] of type [ip] in document ... "'2600' is not an IP string literal.\" errors.