New developpement :
if I add protocol, - "5044:5044/tcp" to logstash, remove the elk-network and configure filebeat to publish to [<swarm ip>:5044]... it eventually works!
This also sound like I cannot connect through tcp on a container on the same docker network.... or not the way I expected!
docker-compose.yml
...
logstash:
image: docker.elastic.co/logstash/logstash:6.4.2
ports:
- "12201:12201/udp"
- "5044:5044/tcp"
- "9600:9600"
...
logstash.conf
...
output.logstash:
hosts: ["<swarm ip>:5044"]
bulk_max_size: 4096
...