If you are using the pure OSS version of Elasticsearch, the X-Pack HTTP endpoints are not registered.
The call you are seeing/making to
https://localhost:9200/_xpack
IMHO does not refer to an index called “_xpack”, but to an X-Pack HTTP/REST handler. Which is not available since you are not using any X-Pack features. This would be in line with the exception in the ES logs you are seeing:
org.elasticsearch.indices.InvalidIndexNameException: Invalid index name [_xpack], must not start with '_'.
Which version of filebeat are you using? Please check that you are using the OSS version of filebeat: