This is based on a misunderstanding on my part. From the docs in Kibana I had assumed that the log stash module had to be enabled, which led me to assume the dashboards will be loaded. But it turns out that filebeat will happily ingest any logs defined in paths: and then you have to build your own dashboard from the filebeat-* index