Hi, i have the same error :
localhost /usr/bin/filebeat[80858]: transport.go:125: SSL client failed to connect with: dial tcp 172.16.1.133:5044: getsockopt: connection refused"

both of machines running on the same cluster (local)
input {
beats {
port => 5044
ssl => true
sslcertificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
sslkey => "/etc/pki/tls/private/logstash-forwarder.key"
}
}
filter {
if [type] == "DooperaLog" {
grok {
match => { "message" => "%{COMBINEDAPACHELOG}" }
}
geoip {
source => "clientip"
}
}

}

output {
if [type] == "DooperaLog" {
elasticsearch {
hosts => ["localhost:9200"]
sniffing => true
managetemplate => false
index => "Doopera-%{+YYYY.MM.dd}"
documenttype => "%{[@metadata][type]}"
}
}

}

that's work with syslog configuration and i have filebeat*xxxxx output but when i change to matching with my what i need i don't see anything.

Any help please ?