The most likely explanation is that X-Pack security is rejecting updates from beats (that is one of the features of security - it rejects actions from unauthenticated sources)
The documentation walks through the process of integrating Beats with X-Pack security.