Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch

When you run setup filebeat output needs to point to elasticsearch not logstash. Once setup is complete then you can point it back to log stash.

Here is the exact steps / process i would recommend If you want to run thus architecture.

Filebeat -> Logstash -> Elasticsearch

Follow the same steps just use filebeat instead of metricbeat. And use the filebeat quick start guide instead of the metricbeat quick start guide.