This had me stumped as well. Thankfully, darkdragn came up with a fix here. Basically, you need to specify the tenant in your (whatever)beat.yml file -
setup.kibana: headers: securitytenant: global