When using an external load balancer, keep in mind that Filebeat->Logstash communication uses persistent connections. In case of an load balancer, the balancer will mostly take care of scheduling different filebeat instances to different logstash instances. That is, this mode is very similar to filebeat configured with multiple Logstash endpoints, but load balancing disabled. This is still a somewhat valid mode, assuming you have a large set of filebeat instances.
With a single service and load balancer you can point filebeat to the service and stop/restart Logstash services, while filebeat can continue running. Yet, load balancing will be far from optimal.
Filebeat provides it's own load balancing support. But this requires you to either know every IP in advance or have one service with distinct names, so to control the scaling in the load balancer via service-/hostnames. Or even a mix of both. Have N known service endpoints, configuring the max load-balancing done within filebeat and additional load balancer distributing TCP connections, such that you can add/remove/replace logstash instances on the fly. Agreed, this is not optimal in the k8s environment. In the future I hope to add some kind of output discovery (such that filebeat can dynamically add/remove Logstash endpoints if k8s environment adds/removes them). But as of now there is no single best practice.