Ah ok, if there's a reason you're using Filebeat I don't want to mess with that.
I see you have ssl set to false. Is there a reason for that? Could this be a SSL/TLS settings mismatch? I did also find a thread using Elastic Agent rather than Beats where there was a misconfiguration of the TLS settings.