Hi,
What worked for me was to add the ssl options to the module file of the metricbeat. It seems that the /etc/metricbeat/metricbeat.yml is overriden by the options defined under /etc/metricbeat/modules.d/
So, try to make sure that the file:
/etc/metricbeat/modules.d/elasticsearch-xpack.yml
has the following content (as per your confs):
username: "xxxx"
password: "xxxx"
ssl.enabled: true
ssl.certificate_authorities: ["/etc/metricbeat/elastic-stack-ca.pem"]
Good luck!