Hello,
There is a few things I can see from this output.
2017-11-23T12:43:12Z CRIT Exiting: Could not start registrar: Error loading state: Error decoding states: json: cannot unmarshal object into Go value of type []file.State
I think there is either a problem with the content of the registrar or a permission issue and the error is hidden somehow. Can you add to this issue the output of the following command:
cat /var/lib/filebeat/registry
Also, I haven't tried it. But I believe AWS Elasticsearch always requires signing request?, but Filebeat currently doesn't support that.
There is a few related discussion here:
- https://github.com/elastic/beats/pull/5466#issuecomment-340450460
- How to connect beats to AWS elasticsearch with authentication
Thanks