ruflin,
Thanks for working on this with me.
As things would have it, when I looked in Kibana this morning, the logs sent by filebeat 6.3.1 servers are now being received. Huh? OK, great. But whether it's due to something I did (doubtful), or just not being patient (probable), I don't know.
However, that you found something wonky in the log file is something I'd like to pursue, if you don't mind. I put the LS configs (I've split them out into input, output, and filters) here: https://pastebin.com/JijR5Sjt .
Admittedly, despite my efforts, I've never been good at configuring the stack. As to filebeat, I believe I generated filebeat.template.json on one of the filebeat servers, then applied it by running this (quotes added for clarity): "curl -XPUT -H 'Content-Type: application/json' http://10.0.101.101:9200/_template/filebeat-6.2.4 -d@filebeat.template.json". That's probably completely wrong, but seems to work, in part anyway. However, I've never been able to get geoip to work, despite considerable hacking, for instance.
Anyway, I would appreciate it if you could take a look, and avise.
Oh, and there is no proxy between FB and LS.
Diggy