Topbeat not talking to Logstash

What do you mean by "direct matches"? Exact matches? That would imply non_analyzed fields to me, which is what the provided Topbeat index template uses for all strings.