Hi Tal,
Coming back to your original question. I thought you used logstash as an output for filebeat.
Why then, in the logging output you posted, one sees such lines as
xxxxxxxxx INFO Elasticsearch xxxxxxx
xxx INFO Connected to Elasticsearch xxxxxx
I have not tried Filebeat 6.0 but it seems that maybe in the filebeat.yml the elasticsearch output was left uncommented (as per default)?
When I start my Filebeat 5.6. x (connecting to Logstash) it clearly states its output as Logstash and proceeds.
You said you had run the connection with success, at least once.
What had you changed since? Maybe you put back an original filebeat.yml with the elastic output uncommented.
As I have not followed the evolution of your tests and as I do not use Filebeat 6.0, sorry in case suggestions are not pertinent to your problems.
Cheers
Lara