Well, solved mostly. I followed Enis' suggestion for the Logstash part, and that worked. For Filebeat, I had to upgrade to version 6.2 on one host, generate filebeat.template.json on that host and get it over to my Elastic host, remove the filebeat index, and add the index with the filebeat.template.json. I'm still struggling to get Filebeat working on my Windows hosts, but will ask about that in the Filebeat list.