ssl => true
doesn't make much sense if you are accessing elasticsearch over http
hosts => ["http://HOSTNAME:9200"]
Are you sure ?
Whats the output when you hit the _authenticate API with that user, i.e.
curl -ulogstash_system:t0p.s3cr3t -X GET http://HOSTNAME:9200/_xpack/security/_authenticate