I cannot configure an index pattern. I type winlogbeat-* to ipattern field but nothing changing - status "Loading":
When I open elasticsearch:9200/winlogbeat*/_mapping/?pretty=true I see all log files
Do you happen have Shield in your stack, which could possibly restrict permissions to read from those indices?
No, I have no Shield now
I see you are using DNS to direct traffic to you're Elasticsearch cluster. Did you query the Elasticsearch API from the same machine which Kibana resides on? If not, can you verify they are pointed the the same cluster.