1st good! Looks like it is working...
2nd please ... please... please do no past images of text they are borderline unreadable... please paste the texxgt with 3 Back ticks ``` before an after the code... see I can not cut / paste. debug search the imagezx...
The _cat indices shows you have filebeat with 1.9M Documents...
sorry typo... please run this and paste a couple results... in text
GET filebeat-*/_search <<<< Note _
So You have data doe sure.
Go to Kibana Discover make sure you set the timepicker correctly ... you probably have a time zone issue... so we will set a wide rang past and future...
Kibana -> Discover -> Data View Filebeat
Please see this post it will show you how
ignore all the cloud meta data stuff...
you can fix that with commenting these out it is just trying to get metadata that is not there...
processors:
- add_host_metadata:
when.not.contains.tags: forwarded
# - add_cloud_metadata: ~
# - add_docker_metadata: ~
# - add_kubernetes_metadata: ~