Thanks for the final recap. Glad you found a combination of settings that work for you.
One more question: why did you set compression_level: 3 in the end? Did you test multiple levels or more or less by my recommendation? Anyways, as filebeat+logstash run on same network infrastructure as other applications do, compression is a good idea. When testing with my logs I've seen a reduction in network bandwidth by a factor of 7.