I tried your configuration as follow for testing, i didn't get any error and i was able to view flow in SIEM without any issues:
input {
beats {
port => 5044
}
}
filter {
if [destination][ip] =~ /^255\.255/ {
mutate {
add_field => { "[destination][geo][city_name]" => "Casablanca" }
add_field => { "[destination][geo][continent_name]" => "Africa" }
add_field => { "[destination][geo][country_iso_code]" => "MO" }
add_field => { "[destination][geo][country_name]" => "MOROCCO" }
add_field => { "[destination][geo][region_iso_code]" => "AF-NO" }
add_field => { "[destination][geo][region_name]" => "North Africa" }
add_field => { "[destination][geo][name]" => "Casablanca Ain Diab Datacenter" }
add_field => { "[destination][geo][location][lat]" => "33.56756115608338"}
add_field => { "[destination][geo][location][lon]" => "-7.628037574169903"}
}
mutate {
convert => ["[destination][geo][location][lat]", "float"]
convert => ["[destination][geo][location][lon]", "float"]
}
}
}
output {
elasticsearch {
hosts => ["https://localhost:9200"]
user => "elastic"
password => "changeme"
cacert => "/dev/es/elasticsearch/config/certs_ssl/node01/node01.crt"
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
action => "index"
ssl => true
pipeline => "geoip-info"
}
}