Auditbeat vs testing ES output

Anyone?

'Service unavailable' wouldn't that possible imply some kind of permission issue on elastic side, and if how to get details logged somehow?

I'm puzzled by this, user attempted with has a role which got create_index,index,write on auditbeat-* same role which work for another user working for Windows auditbeats.