Hmm, by chance are you running multiple agents on the same host?
I wouldn't expect:
osquery/osquerybeat, packetbeat, or apm-server to be running on this agent if it truly is only running the defined input (filebeat).
Could you try running the inspect command and make sure it didn't fall back to using a Fleet policy or something?