ha, it's working i think. there is no any console output on "filebeat -c /etc/filebeat/filebeat.yml -e - v -d "*"" but i can see msg coming in on my kibana frontend now.
i have filebeat running on RHEL5 box, then logstash, ES and Kibana on ubuntu 16 box waiting for filebeat. seems like it's working.