The error message notes the connection being closed by Logstash. This can happen during TLS handshake or much later due to logstash timing out inactive connections. Try to ramp up the connectivity timeout in the beats input in Logstash. Also, have you checked the logstash-input-beats plugin version installed with your Logstash? Updating the plugin or moving to Logstash 5.4 might help here as well, as a few older versions of the plugin are prone to close perfectly valid connections.