turns out it's a bug in the windows version during the initial implementation. if you run the setup from a linux platform it creates all the pipelines and works a treat. as it only needs to do this once to set everything up, that's what we did, we now have windows clients reporting into elastic.
don't know if that helps, or whether you've already found an alternate way of doing what you were looking at, just thought i'd mention it