Can you use the file output and read in some log files and share the output? I wonder if the decoding worked as expected.
Please also share the filebeat log output.
Three things from the config:
- Indentation on
setup.kibanais wrong - Template config should be under
setupbut seems to be under output now? - You still have the default path (/var/log/*) in your config. Is that on purpose?
It seems you copied together the config but missed some important parts.