Delete the line "protocol => http".
I think that in 2015, when that blog post was written, the elasticsearch output supported the node protocol in addition to the http protocol. It now only supports the http protocol, so you do not need to tell it what protocol to use. See here, from 2016.