Hello,
I didn’t see you make this configuration for your Collector
output.logstash:
hosts: ["graylog.example.org:5044"]
ssl.certificate_authorities: ["/path/to/certs/ca.pem"]
ssl.certificate: "/path/to/certs/client.crt"
ssl.key: "/path/to/certs/client.key"
EDIT: Your GL Sidecar is just a wrapper for ALL your collectors. GL sidecar uses a token to connect to Graylog server and received orders on howto configure your Collectors or enable which ones. All your data/logs should be encrypted on your Collector (filebeat, winlogbeat,etc…). That as you know, is done on the Web UI
Hope that helps