Filebeat Dashboard Setup is a Hassle!

Elastic Stack Beats
,
15

One thing perhaps

You need to run setup without the

--dashboard

Run

filebeat -e setup

When you add the --dashboard flag that's all it loads It does not load the index templates and mappings and ingest pipeline which are needed in order correctly load and parse the data.

This is why in the quick start it just says to run setup see here

Also I see Logstash may be involved are you passing the data through Logstash? If so you need a proper Logstash config that support the modules.

I have a sample here with some discussion

################################################
# beats->logstash->es default config.
################################################
input {
  beats {
    port => 5044
  }
}

output {
  if [@metadata][pipeline] {
    elasticsearch {
      hosts => "http://localhost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}"
      pipeline => "%{[@metadata][pipeline]}" 
      user => "elastic"
      password => "secret"
    }
  } else {
    elasticsearch {
      hosts => "http://localhost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}"
      user => "elastic"
      password => "secret"
    }
  }
}

Also I am bit confused of whether you're trying to use the filebeat module or the log stash module you should use one of the other not both.