I'm not too familiar with filebeat but it looks like you perhaps should set setup.template.enabled: false on your monitored VMs. Auto-creation of the template seems helpful when you've only got a few VMs but I don't think it works so well with 1400 nodes all competing to set the template up.
https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-template.html