You could do both .
(a) beats => logstash (beats input) => elasticsearch
(b) beats => elasticsearch
In my opinion,
If you need to parse fields from your data, I think (a) is more flexible. However, you will have extra software in your pipeline though.
For (b) , you need ingest pipeline which you will construct using json syntax. If the pipeline become complex, you will have hard time creating it.