It seems the error is on the elasticsearch side with the ingest pipeline and not the beats side. Perhaps you could take one of the documents which is sent to elasticsearch and use the simulate API to see what exactly is happening? https://www.elastic.co/guide/en/elasticsearch/reference/master/simulate-pipeline-api.html Do you see any errors in the elasticsearch log?