There seems to be a bug in FileBeat under Windows where Filebeat ignores the domain and assumes it can try contact Kafka with just a hostname. This fails when the filebeat is running in a different domain and the host is not reachable
output.kafka:
hosts: ["server1.ourdomain.com:9093"]
The error is:
2022-02-25T10:29:29.583+0100 INFO kafka/log.go:53 producer/broker/0 state change to [closing] because dial tcp: lookup server1: no such host
The workaround is to add the following to the hosts file:
<IP of server1> server1
After this it works. So the filebeat kafka filter seems to just remove ourdomain.com when it resolves the host.