Ok @Dmitriy_Parkhonin, I really don't have a clue right now about how to proceed so let's go step by step. I have found a user with a similar problem who found a solution. Can you try this? Filebeat on Windows xp forcibly closed by the remote host
At the same time, check the permissions of the files, specially the registry files that filebeat uses. I don't think that you're having problems with it, but just to check.
Confirm us that you aren't using logstash in the middle, just to double check that we shouldn't look there for issues.