Ok, I just use only dissect plugin to filter my log data like this:
dissect {
mapping => {
'message' => '[%{time_stamp}] [%{correlation_id}] [%{log_level}] [%{source}] [%{uri_domain}] [%{someParameter1}] [%{someParameter2}] %{message}'
}
}
mutate {
add_field => { "[log_type]" => "services" }
}
And a core of the problem was time_stamp - when I dont use this date filtering, I see all data in Kibana.