When you went to discover, what Data view do you use at the top left of the UI? It should say logs-*
As long as the data is already in the datastream, and you can query it, then this is either a permission issue for your user (unless you are superuser), or you have not choosen the correct data-view in discover as the screenshot above.
Seems like there are multiple discuss topics now? Let's keep it to one: Bug: No Misp event data send to Kibana when Threat intel module used