I'm currently following this tutorial:
https://www.elastic.co/guide/en/logstash/master/advanced-pipeline.html
after 2 hours of searching I discovered that beats only sends files if they're changed, if I stop and restart it, it won't send what's already been sent, but this is a tutorial and it's confusing to me because these concepts have not been explained yet. It would have been nice if someone told me that I had to delete the contents of the data folder in filebeats.