- why does filebeat create a default 'filebeat' index whenever I run set up?
I don't understand your question. During the setup phase all indices and ingest pipelines must be installed.
- are the module directive correctly added in the configuration? For instance, for nginx I get logs scraped from the nginx container, but the in discovery I see a whole message like:
Did you check documents stored in indices? Do they contain proper fields?