Restarted both services.
on logstash:
@80003v-app004:/etc/logstash/conf.d# netstat -ln | grep 5043
tcp6 0 0 :::5043 :::* LISTEN
filebeat logfile
2016-11-07T10:20:29+01:00 INFO Starting prospector of type: log
2016-11-07T10:20:29+01:00 INFO Harvester started for file: /var/log/kern.log
2016-11-07T10:20:29+01:00 INFO Start sending events to output
2016-11-07T10:20:29+01:00 INFO Starting Registrar
2016-11-07T10:20:29+01:00 INFO Starting spooler: spool_size: 2048; idle_timeout: 5s
2016-11-07T10:20:29+01:00 INFO Harvester started for file: /var/log/vsftpd.log
2016-11-07T10:20:29+01:00 INFO Harvester started for file: /var/log/auth.log
2016-11-07T10:20:59+01:00 INFO Non-zero metrics in the last 30s: publish.events=43 registrar.writes=1 filebeat.harvester.running=3 libbeat.logstash.publish.read_bytes=18 libbeat.logstash.published_and_acked_events=32 libbeat.publisher.published_events=32 filebeat.harvester.started=3 filebeat.harvester.open_files=3 libbeat.logstash.publish.write_bytes=1882 registar.states.current=11 libbeat.logstash.call_count.PublishEvents=1 registrar.states.update=43
2016-11-07T10:20:59+01:00 ERR Failed to publish events caused by: EOF
2016-11-07T10:20:59+01:00 INFO Error publishing events (retrying): EOF
2016-11-07T10:21:29+01:00 INFO Non-zero metrics in the last 30s: registrar.states.update=22 libbeat.logstash.publish.read_bytes=24 libbeat.logstash.publish.read_errors=1 publish.events=22 libbeat.logstash.published_and_acked_events=22 libbeat.logstash.published_but_not_acked_events=11 libbeat.publisher.published_events=22 registrar.writes=4 libbeat.logstash.call_count.PublishEvents=5 libbeat.logstash.publish.write_bytes=2671
2016-11-07T10:21:59+01:00 INFO No non-zero metrics in the last 30s
2016-11-07T10:22:29+01:00 INFO No non-zero metrics in the last 30s
2016-11-07T10:22:59+01:00 INFO No non-zero metrics in the last 30s
2016-11-07T10:23:14+01:00 ERR Failed to publish events caused by: EOF
2016-11-07T10:23:14+01:00 INFO Error publishing events (retrying): EOF