ES 7.15 FileBeats Sophos XG module not separating data into variables

Apologies, I did not see anywhere in your initial post where you indicated it all worked fine with a direct filebeat-> elasticsearch integration.

Yes, the docs are not always easy to navigate, The quick start guides are meant to help.

Possible...yes... You would need basically need 2 separate installations if filebeat because it keeps track of files have been read etc..

Not clear why you would want to do that generally when folks want to send them more than one destination that is exactly when they use logstash... filebeat -> logstash to more than one output