So at first I had hostnames configured and after not seeing any network activity on the logstash servers I decided to switch for IP's. When I did I start seeing network activity via tcpdump and on logstash logs bad_certificate ( Reason being because the certs were generated with hostname as CN. (I confirmed this now again with openssl). So the bottom line that I came up with is that the filebeat agent establishes a session with IP's but not with hostnames. Please note that I used host files to bypass any DNS issues on filebeat servers and also tried nslookup which worked on filebeat agents.