Analysis logs for security events

To get started I would output directly to Elasticsearch without the use of Logstash. And then only add Logstash into the loop if it is required. For your original use case I don't think Logstash or the translate filter are required.

What version of Winlogbeat have you installed? What operating system are you using?

Once you have data from Winlogbeat version 5 ingested into Elasticsearch, refresh your Kibana mappings for the winlogbeat-* index pattern to ensure that all of the fields are present. Then try exploring your data with the Discover tab.

Please review the reference documentation for the fields exported by Winlogbeat v5. You'll notice that the status_code you are trying to use with logstash does not exist. The event ID is contained in event_id.