Connect filebeat to elasticsearch

Hello @mcoa

Looking at the error in the log this look like a mapping error.

Mapping definition for [error] has unsupported parameters:

Looking at your configuration, you are providing a custom template with these options:

 template.name: filebeat
 template.path: filebeat.template.json

Unless you really need it I would remove the two options above and use the default templates that filebeat will manage for you.

Also, I see that you are parsing auth log did you take a look at the system module which will take care of parsing the auth log and creating dashboard for it?