the credentials are still outside of the elasticsearch output block. The user and password are specific to elasticsearch, not the output {} block.
So instead of
output {
elasticsearch {
hosts => [ "localhost:9200" ]
}
stdout { codec => rubydebug }
user => logstash_internal
password => changeme
}
you need:
output {
elasticsearch {
hosts => [ "localhost:9200" ]
user => logstash_internal
password => changeme
}
stdout { codec => rubydebug }
}