filebeat export template > test.json
This command shows what template will be loaded when it is run not what IS currently loaded in the Elasticsearch cluster.
If you want to see what is currently loaded use this
curl http://localhost:9200/_template/filebeat-7.1.1
Or go to the Dev Tools and Run.
GET /_template/filebeat-7.1.1
Also confusing to me is that some of your screen shots show logstash are you using logstash as well? I would first get the simple Filebeat -> Elasticsearch directly.
The screen shot above shows the logstash output not filebeat setup that is a little more complex to setup.
Me if I were you I would start with a clean setup or you will need to remove the template, index patterns and existing filebeat indexes
Just to test it out...
I just built a brand new 7.1.1 single node Elasticsearch and Kibana on localhost and everything works fine the first time. I did not use Logstash.
I simply started Elasticsearch and Kibana without editing any settings.
Enabled ngnix module
./filebeat modules enable nginx
ran setup
./filebeat setup
Downloaded the nginx example logs file (see below for link).
edit the modules/nginx.yml and set the path to the nginx log file I just downloaded.
# Module: nginx
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.1/filebeat-module-nginx.html
- module: nginx
# Access logs
access:
enabled: true
# Set custom paths for the log files. If left empty,
# Filebeat will choose the paths depending on your OS.
var.paths: [ "/Users/sbrown/Downloads/nginx_logs.log" ]
Then started filebeat
./filebeat -e
The data loaded and the visualizations work fine with 1 exception there are no error logs so those are blank, this data set only contains access logs. The data is from May 2015.
Here is the data I loaded....