I maybe have the same Problem as you.
See this thread: Filebeat -> Logstash -> Graylog (all SSL secured)
I try to overcome the problem with logstash as an aggregator and forwarder, but I fail at the last mile. The logstash to Graylog part is pretty hard when you want to use TLS.
When you dont need TLS on the last Mile you can use the GELF output of Logstash. If you want to ship your logs in a secure way, then you need lumberjack output to Beats input, but i have struggles to get it working. Maybe we can team up?