I have been busy yesterday to solve the problem. I found out some problems on the fleetserver aswell, sending clear text to the Elasticsearch channel (because of the localhost config setting in the filebeat config) and in between API key invalidated messages.
Finally after some struggle I found the problem.
In the end the problem was that I added Username and Password authentication in the elastic output configuration in fleet settings. By that time I was not fully awear about the API keys. In the filebeat log It was visible that both configurations active at the same time are giving problems ( API keys and Username and password authentication).
In the end the Filebeat config pointing to the local host is still the same.
Aswell for the elasticagent installed as fleetserver on the Elasticsearch host. The API key invalidated messages were solved after a restart of the elastic-agent client. And about the cleartext messages that was solved after removing the username and password authentication.
Thank you @zx8086, for you're help!
i will close this ticket.