Perhaps you have another configuration file with an elasticsearch output that's configured differently? Keep in mind that Logstash loads all your .conf files in the directory. You can easily check this by commenting out the elasticsearch output above and see what happens.