Hello @mcoa
Looking at the error in the log this look like a mapping error.
Mapping definition for [error] has unsupported parameters:
Looking at your configuration, you are providing a custom template with these options:
template.name: filebeat
template.path: filebeat.template.json
Unless you really need it I would remove the two options above and use the default templates that filebeat will manage for you.
Also, I see that you are parsing auth log did you take a look at the system module which will take care of parsing the auth log and creating dashboard for it?