Able to configure Filebeat and index in Kibana, but no data is appearing

Elastic Stack Beats
3

Filebeat modules can be confusing to configure, because there are several ways to do it. https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-modules.html

If you want to read from IIS using the modules, do not enable filebeat.inputs at all. There are several methods to use modules.

Method #1

This is what is closest to your current solution. Set var.paths in modules.d/iis.yml to your path, so the module know where the input files are located. Then enable the module using ./filebeat modules enable iis. Afterwards you can start Filebeat.

Method #2

I usually use this method during debugging and module development, because in this case no configuration file needs to be edited. You only pass the options via command line.

filebeat -modules=iis -M "iis.access.var.paths=[/path/to/your.log]"

Method #3

You can to enable the IIS module in filebeat.yml. The advantage is that you only need to edit one file which contains all the options. In simple use cases this is sufficient.

filebeat.modules:
- module: iis
  access:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths:
     - /path/to/your.log