Alright, well. with winlogbeat... i get this:
2017-06-08T08:15:50-04:00 ERR Failed to publish events caused by: EOF
2017-06-08T08:15:50-04:00 INFO Error publishing events (retrying): EOF
2017-06-08T08:16:01-04:00 ERR Connecting error publishing events (retrying): Get http://***********:9200: dial tcp X.X.X.X:9200: connectex: No connection could be made because the target machine actively refused it.