Thanks, that looks OK to me. The upgrade might've been a red herring.
Looking at the error in your logs (pre- and post-upgrade):
Cannot write to a field alias [event.module]
I'm now wondering if there's an old Metricbeat template that's resulting in a mapping conflict, similar to the one described in Filebeat errors after update to version 7 - #11. Can you look through your Metricbeat templates (output of GET _template/metricbeat-*) to see if there's one that matches the index pattern metricbeat-*?