Filebeat directly to Elastic ingest node

The simplest way would be to enable debug logging. You can also observe network traffic on port 9200.