Hmmm did you check Eleasticsearch to make sure there are events sent there by Filebeat? Maybe you can try running Filebeat in debug mode by using ./filebeat -e -d "*". This will be very noisy but it will show you the events that Filebeat generates.