Hi warkolm,The problem has been solved by remove the line
action.auto_create_index: .monitoring*,.watches,.triggered_watches,.watcher-history*,.ml*,wazuh-alerts-3.x-*,wazuh-monitoring-3.x-*
in elasticsearch.yml,then filebeat could create and push docs to es normally.still doesn't found a clear clue why since I've been already added the wazuh-alerts-3.x-,wazuh-monitoring-3.x- in it.