Why do you have two hosts fields in the output? Also remove the "document_type" parameter as it is depreciated, and try changing the index name to something simpler just now like:
index => "filebeat-%{+YYYY.MM.dd}"
Also I assume you have a paid subscription since you are using user and password? If so are you using https in the hosts output because x-pack now requires TLS by default.