@warkolm I was able to isolate the problem! But I don't know why it is a problem!
If my ubuntu 20.04 is running in a container (in my case a proxmox hypervisor), then auditbeat will give the connection refused error as stated in my original question.
If my ubuntu 20.04 is running in a virtual machine (in my proxmox hypervisor), then auditbeat will work correctly.
Do you know why auditbeat works in a VM but not in a Container? Thank you!