Help With Validating This Filebeat Config

I am having the toughest time getting filebeat to send logs to my elastic stack. Am I missing something? I have heartbeat and metricbeat working. Filebeat is being fussy with me.

filebeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: false
filebeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true
filebeat.modules:
- module: system
  syslog:
    enabled: true
- module: elasticsearch
  server:
    enabled: true
  gc:
    enabled: true
  audit:
    enabled: true
  deprecation:
    enabled: true
- module: kibana
  log:
    enabled: true
  audit:
    enabled: true
processors:
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
setup.template.overwrite: true
# =================================== Kibana ===================================
setup.kibana:
  host: "${CONTAINER_KIBANA}:${PORT_KIBANA}"
  username: "${ELASTIC_KIBANA_SYSTEM_USER}"
  password: "${ELASTIC_KIBANA_SYSTEM_PASSWORD}"
  protocol: "https"
  ssl.enabled: true
  ssl.verification_mode: "certificate"
  ssl.certificate_authorities: 
    - '${CERTS_DIR}/ca/ca.crt'
  ssl.certificate: "${CERTS_DIR}/${CONTAINER_FILEBEAT}/${CONTAINER_FILEBEAT}.crt"
  ssl.key: "${CERTS_DIR}/${CONTAINER_FILEBEAT}/${CONTAINER_FILEBEAT}.key"
output.elasticsearch:
  hosts: ["${CONTAINER_ELASTIC_SEARCH}:${PORT_ELASTIC_SEARCH}"]
  username: "${ELASTIC_BEATS_SYSTEM_USER}"
  password: "${ELASTIC_BEATS_SYSTEM_PASSWORD}"
  protocol: "https"
  ssl.certificate: "${CERTS_DIR}/${CONTAINER_FILEBEAT}/${CONTAINER_FILEBEAT}.crt"
  ssl.key: "${CERTS_DIR}/${CONTAINER_FILEBEAT}/${CONTAINER_FILEBEAT}.key"
  ssl.certificate_authorities: 
    - "${CERTS_DIR}/ca/ca.crt"
  ssl.verification_mode: "certificate"
  ssl.enabled: true

filebeat:
    image: ${IMAGE_FILEBEAT:?IMAGE_FILEBEAT}:${FILEBEAT_VERSION:?FILEBEAT_VERSION}
    container_name: ${CONTAINER_FILEBEAT:?CONTAINER_FILEBEAT}
    user: root
    volumes:
      - "${PATH_ROOT}/conf/elk/filebeat.docker.yml:/usr/share/filebeat/filebeat.yml:ro"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - elastic-certs:${ELASTIC_CERTS_DIR}
      - "/var/lib/docker/containers:/var/lib/docker/containers:ro"
      # - "/var/lib/docker/containers:/usr/share/filebeat/logs:ro"
    depends_on: 
      - ${CONTAINER_ELASTIC_SEARCH}01
      - ${CONTAINER_KIBANA}
    environment:
      CONTAINER_ELASTIC_SEARCH: ${CONTAINER_ELASTIC_SEARCH}01
      PORT_ELASTIC_SEARCH: ${PORT_ELASTIC_SEARCH}
      CONTAINER_KIBANA: ${CONTAINER_KIBANA}
      PORT_KIBANA: ${PORT_KIBANA}
      CERTS_DIR: ${ELASTIC_CERTS_DIR}
      CONTAINER_FILEBEAT: ${CONTAINER_FILEBEAT}
      ELASTIC_BEATS_SYSTEM_USER: ${ELASTIC_USER}
      ELASTIC_BEATS_SYSTEM_PASSWORD: ${ELASTIC_PASSWORD}
      ELASTIC_KIBANA_SYSTEM_USER: ${ELASTIC_USER}
      ELASTIC_KIBANA_SYSTEM_PASSWORD: ${ELASTIC_PASSWORD}
    networks:
      dotmusic_net:
        ipv4_address: ${DOCKER_IP_FILEBEAT:?DOCKER_IP_FILEBEAT}

es02:
    image: ${IMAGE_ELASTIC_SEARCH:?IMAGE_ELASTIC_SEARCH}:${ELASTIC_VERSION:?ELASTIC_VERSION}
    container_name: ${CONTAINER_ELASTIC_SEARCH:?CONTAINER_ELASTIC_SEARCH}02
    labels:
      co.elastic.logs/enabled: "true"
      co.elastic.logs/module: "elasticsearch"
      co.elastic.logs/fileset.stdout: access
      co.elastic.logs/fileset.stderr: error
    environment:
      - node.name=${CONTAINER_ELASTIC_SEARCH}02
      - cluster.name=${ELASTIC_CLUSTER_NAME:?ELASTIC_CLUSTER_NAME}
      - discovery.seed_hosts=${CONTAINER_ELASTIC_SEARCH}01,${CONTAINER_ELASTIC_SEARCH}03
      - cluster.initial_master_nodes=${CONTAINER_ELASTIC_SEARCH}01,${CONTAINER_ELASTIC_SEARCH}02,${CONTAINER_ELASTIC_SEARCH}03
      - bootstrap.memory_lock=true
      - ELASTIC_PASSWORD=$ELASTIC_BOOTSTRAP_PASSWORD
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - "xpack.security.enabled=true"
      - xpack.license.self_generated.type=basic
      - xpack.security.http.ssl.enabled=true
      - xpack.security.http.ssl.key=${ELASTIC_CERTS_DIR}/${CONTAINER_ELASTIC_SEARCH}02/${CONTAINER_ELASTIC_SEARCH}02.key
      - xpack.security.http.ssl.certificate_authorities=${ELASTIC_CERTS_DIR}/ca/ca.crt
      - xpack.security.http.ssl.certificate=${ELASTIC_CERTS_DIR}/${CONTAINER_ELASTIC_SEARCH}02/${CONTAINER_ELASTIC_SEARCH}02.crt
      - xpack.security.transport.ssl.enabled=true
      - xpack.security.transport.ssl.verification_mode=certificate
      - xpack.security.transport.ssl.certificate_authorities=${ELASTIC_CERTS_DIR}/ca/ca.crt
      - xpack.security.transport.ssl.certificate=${ELASTIC_CERTS_DIR}/${CONTAINER_ELASTIC_SEARCH}02/${CONTAINER_ELASTIC_SEARCH}02.crt
      - xpack.security.transport.ssl.key=${ELASTIC_CERTS_DIR}/${CONTAINER_ELASTIC_SEARCH}02/${CONTAINER_ELASTIC_SEARCH}02.key
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - "${PATH_ROOT}/conf/elk/99-sysctl.conf:/etc/sysctl.d/99-sysctl.conf"
      - data02:/usr/share/elasticsearch/data
      - elastic-certs:${ELASTIC_CERTS_DIR}
    networks:
      dotmusic_net:
        ipv4_address: ${DOCKER_IP_ELASTIC_2:?DOCKER_IP_ELASTIC_2}

Can u post the logs from filebeat?? At first glance, the env car ur passing to filebeat ends with 01 but the name of ur es container is 02.

so for further context, I have a three node elastic cluster. I have kibana running as well. I showed es02's config for the context of the autodiscovery hints. es01 is my primary node. The filebeat logs don't appear to show any errors, that I can tell. I can see the filebeat index in Kibana and it does appear documents are being sent to it. However, when I go to discover or logs I don't see anything for my es02 container.

Attaching to filebeat
filebeat         | 2021-04-08T03:08:15.066Z     INFO    instance/beat.go:660    Home path: [/usr/share/filebeat] Config path: [/usr/share/filebeat] Data path: [/usr/share/filebeat/data] Logs path: [/usr/share/filebeat/logs]
filebeat         | 2021-04-08T03:08:15.070Z     INFO    instance/beat.go:668    Beat ID: 7d967ca0-addd-4138-ae73-f964417e4153
filebeat         | 2021-04-08T03:08:15.073Z     INFO    [add_cloud_metadata]    add_cloud_metadata/add_cloud_metadata.go:101    add_cloud_metadata: hosting provider type not detected.
filebeat         | 2021-04-08T03:08:15.089Z     INFO    [seccomp]       seccomp/seccomp.go:124  Syscall filter successfully installed
filebeat         | 2021-04-08T03:08:15.089Z     INFO    [beat]  instance/beat.go:996    Beat info       {"system_info": {"beat": {"path": {"config": "/usr/share/filebeat", "data": "/usr/share/filebeat/data", "home": "/usr/share/filebeat", "logs": "/usr/share/filebeat/logs"}, "type": "filebeat", "uuid": "7d967ca0-addd-4138-ae73-f964417e4153"}}}
filebeat         | 2021-04-08T03:08:15.089Z     INFO    [beat]  instance/beat.go:1005   Build info      {"system_info": {"build": {"commit": "08e20483a651ea5ad60115f68ff0e53e6360573a", "libbeat": "7.12.0", "time": "2021-03-18T06:16:51.000Z", "version": "7.12.0"}}}
filebeat         | 2021-04-08T03:08:15.089Z     INFO    [beat]  instance/beat.go:1008   Go runtime info {"system_info": {"go": {"os":"linux","arch":"amd64","max_procs":12,"version":"go1.15.8"}}}
filebeat         | 2021-04-08T03:08:15.090Z     INFO    [beat]  instance/beat.go:1012   Host info       {"system_info": {"host": {"architecture":"x86_64","boot_time":"2021-04-07T21:37:24Z","containerized":true,"name":"726d12a12558","ip":["127.0.0.1/8","172.25.0.13/24"],"kernel_version":"4.19.104-microsoft-standard","mac":["02:42:ac:19:00:0d"],"os":{"type":"linux","family":"redhat","platform":"centos","name":"CentOS Linux","version":"7 (Core)","major":7,"minor":9,"patch":2009,"codename":"Core"},"timezone":"UTC","timezone_offset_sec":0,"id":"44ccc339d95bd51386fcfc5d8f041927"}}}
filebeat         | 2021-04-08T03:08:15.090Z     INFO    [beat]  instance/beat.go:1041   Process info    {"system_info": {"process": {"capabilities": {"inheritable":["chown","dac_override","fowner","fsetid","kill","setgid","setuid","setpcap","net_bind_service","net_raw","sys_chroot","mknod","audit_write","setfcap"],"permitted":["chown","dac_override","fowner","fsetid","kill","setgid","setuid","setpcap","net_bind_service","net_raw","sys_chroot","mknod","audit_write","setfcap"],"effective":["chown","dac_override","fowner","fsetid","kill","setgid","setuid","setpcap","net_bind_service","net_raw","sys_chroot","mknod","audit_write","setfcap"],"bounding":["chown","dac_override","fowner","fsetid","kill","setgid","setuid","setpcap","net_bind_service","net_raw","sys_chroot","mknod","audit_write","setfcap"],"ambient":null}, "cwd": "/usr/share/filebeat", "exe": "/usr/share/filebeat/filebeat", "name": "filebeat", "pid": 8, "ppid": 1, "seccomp": {"mode":"filter","no_new_privs":true}, "start_time": "2021-04-08T03:08:14.600Z"}}}
filebeat         | 2021-04-08T03:08:15.090Z     INFO    instance/beat.go:304    Setup Beat: filebeat; Version: 7.12.0
filebeat         | 2021-04-08T03:08:15.091Z     INFO    [index-management]      idxmgmt/std.go:184      Set output.elasticsearch.index to 'filebeat-7.12.0' as ILM is enabled.
filebeat         | 2021-04-08T03:08:15.091Z     WARN    [cfgwarn]       tlscommon/config.go:101 DEPRECATED: Treating the CommonName field on X.509 certificates as a host name when no Subject Alternative Names are present is going to be removed. Please update your certificates if needed. Will be removed in version: 8.0.0
filebeat         | 2021-04-08T03:08:15.092Z     INFO    eslegclient/connection.go:99    elasticsearch url: https://es01:9200
filebeat         | 2021-04-08T03:08:15.093Z     INFO    [publisher]     pipeline/module.go:113  Beat name: 726d12a12558
filebeat         | 2021-04-08T03:08:15.098Z     INFO    beater/filebeat.go:117  Enabled modules/filesets: kibana (audit, log),  (), system (auth, syslog), elasticsearch (audit, deprecation, gc, server, slowlog)
filebeat         | 2021-04-08T03:08:15.101Z     INFO    [monitoring]    log/log.go:117  Starting metrics logging every 30s
filebeat         | 2021-04-08T03:08:15.101Z     INFO    instance/beat.go:468    filebeat start running.
filebeat         | 2021-04-08T03:08:15.104Z     INFO    memlog/store.go:119     Loading data file of '/usr/share/filebeat/data/registry/filebeat' succeeded. Active transaction id=0
filebeat         | 2021-04-08T03:08:15.104Z     INFO    memlog/store.go:124     Finished loading transaction log file for '/usr/share/filebeat/data/registry/filebeat'. Active transaction id=0
filebeat         | 2021-04-08T03:08:15.104Z     INFO    [registrar]     registrar/registrar.go:109      States Loaded from registrar: 0
filebeat         | 2021-04-08T03:08:15.104Z     INFO    [crawler]       beater/crawler.go:71    Loading Inputs: 10
filebeat         | 2021-04-08T03:08:15.104Z     WARN    [cfgwarn]       docker/input.go:49      DEPRECATED: 'docker' input deprecated. Use 'container' input instead. Will be removed in version: 8.0.0
filebeat         | 2021-04-08T03:08:15.105Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/*/*.log]
filebeat         | 2021-04-08T03:08:15.105Z     INFO    [crawler]       beater/crawler.go:141   Starting input (ID: 2482010575008624874)
filebeat         | 2021-04-08T03:08:15.105Z     INFO    log/input.go:157        Configured paths: [/var/log/auth.log* /var/log/secure*]
filebeat         | 2021-04-08T03:08:15.105Z     INFO    [crawler]       beater/crawler.go:141   Starting input (ID: 11991761552713575762)
filebeat         | 2021-04-08T03:08:15.106Z     INFO    log/input.go:157        Configured paths: [/var/log/messages* /var/log/syslog*]
filebeat         | 2021-04-08T03:08:15.106Z     INFO    [crawler]       beater/crawler.go:141   Starting input (ID: 7521169057727086769)
filebeat         | 2021-04-08T03:08:15.106Z     INFO    log/input.go:157        Configured paths: [/var/log/elasticsearch/*.log /var/log/elasticsearch/*_server.json]
filebeat         | 2021-04-08T03:08:15.106Z     INFO    [crawler]       beater/crawler.go:141   Starting input (ID: 10584868271925815388)
filebeat         | 2021-04-08T03:08:15.106Z     INFO    log/input.go:157        Configured paths: [/var/log/elasticsearch/*_index_search_slowlog.log /var/log/elasticsearch/*_index_indexing_slowlog.log /var/log/elasticsearch/*_index_search_slowlog.json /var/log/elasticsearch/*_index_indexing_slowlog.json]
filebeat         | 2021-04-08T03:08:15.107Z     INFO    [crawler]       beater/crawler.go:141   Starting input (ID: 6878571439949832352)
filebeat         | 2021-04-08T03:08:15.108Z     INFO    log/input.go:157        Configured paths: [/var/log/elasticsearch/*_access.log /var/log/elasticsearch/*_audit.log /var/log/elasticsearch/*_audit.json]
filebeat         | 2021-04-08T03:08:15.108Z     INFO    [crawler]       beater/crawler.go:141   Starting input (ID: 2322925157510133784)
filebeat         | 2021-04-08T03:08:15.109Z     INFO    log/input.go:157        Configured paths: [/var/log/elasticsearch/*_deprecation.log /var/log/elasticsearch/*_deprecation.json]
filebeat         | 2021-04-08T03:08:15.109Z     INFO    [crawler]       beater/crawler.go:141   Starting input (ID: 14614850079161566516)
filebeat         | 2021-04-08T03:08:15.109Z     INFO    log/harvester.go:302    Harvester started for file: /var/lib/docker/containers/06c4421b670d776330c7e18b767afb1f615f9498bbd1a49a46619e4d9d715ec4/06c4421b670d776330c7e18b767afb1f615f9498bbd1a49a46619e4d9d715ec4-json.log
filebeat         | 2021-04-08T03:08:15.109Z     INFO    log/harvester.go:302    Harvester started for file: /var/lib/docker/containers/723676c36414ac323759a60c14906c626b9c0e539e05f626ae9fc41c1d095606/723676c36414ac323759a60c14906c626b9c0e539e05f626ae9fc41c1d095606-json.log
filebeat         | 2021-04-08T03:08:15.109Z     INFO    log/input.go:157        Configured paths: [/var/log/elasticsearch/gc.log.[0-9]* /var/log/elasticsearch/gc.log]
filebeat         | 2021-04-08T03:08:15.109Z     INFO    [crawler]       beater/crawler.go:141   Starting input (ID: 11922003923008771421)
filebeat         | 2021-04-08T03:08:15.109Z     INFO    log/input.go:157        Configured paths: [/var/log/kibana/*_audit.json]
filebeat         | 2021-04-08T03:08:15.109Z     INFO    [crawler]       beater/crawler.go:141   Starting input (ID: 14651632209134346)
filebeat         | 2021-04-08T03:08:15.109Z     INFO    log/harvester.go:302    Harvester started for file: /var/lib/docker/containers/72ecf3ae0802d69af5225c2e648fb110c8a5df16ad7533bf3ee45e3c4c8d2f91/72ecf3ae0802d69af5225c2e648fb110c8a5df16ad7533bf3ee45e3c4c8d2f91-json.log
filebeat         | 2021-04-08T03:08:15.110Z     INFO    log/input.go:157        Configured paths: [/var/log/kibana/kibana.stdout]
filebeat         | 2021-04-08T03:08:15.110Z     INFO    [crawler]       beater/crawler.go:141   Starting input (ID: 9913943773415849758)
filebeat         | 2021-04-08T03:08:15.110Z     INFO    log/harvester.go:302    Harvester started for file: /var/lib/docker/containers/7ab3e7c8ca7333649306bb7e29349c778e26d4e5032dbf714776ceeaf342d766/7ab3e7c8ca7333649306bb7e29349c778e26d4e5032dbf714776ceeaf342d766-json.log
filebeat         | 2021-04-08T03:08:15.110Z     INFO    log/harvester.go:302    Harvester started for file: /var/lib/docker/containers/353a91c46929e5590f50b40d37abc658579035d34ec5d64f296282a6d714fa2f/353a91c46929e5590f50b40d37abc658579035d34ec5d64f296282a6d714fa2f-json.log
filebeat         | 2021-04-08T03:08:15.110Z     INFO    log/harvester.go:302    Harvester started for file: /var/lib/docker/containers/710c24f7146fd91ab1b611e8b1aa7bdb598fd4980f86d23bfe807546615f2b9e/710c24f7146fd91ab1b611e8b1aa7bdb598fd4980f86d23bfe807546615f2b9e-json.log
filebeat         | 2021-04-08T03:08:15.110Z     INFO    [crawler]       beater/crawler.go:108   Loading and starting Inputs completed. Enabled inputs: 10
filebeat         | 2021-04-08T03:08:15.110Z     INFO    cfgfile/reload.go:164   Config reloader started
filebeat         | 2021-04-08T03:08:15.110Z     INFO    log/harvester.go:302    Harvester started for file: /var/lib/docker/containers/c21a40bd2e179b6e23669ed165964500ff476e95ad3c632f3b3089141754d96b/c21a40bd2e179b6e23669ed165964500ff476e95ad3c632f3b3089141754d96b-json.log
filebeat         | 2021-04-08T03:08:15.110Z     INFO    log/harvester.go:302    Harvester started for file: /var/lib/docker/containers/8a4e3b8bbeb4736f31e527d61da97f52cab9b5a04f6912059cd3ae8220c5db04/8a4e3b8bbeb4736f31e527d61da97f52cab9b5a04f6912059cd3ae8220c5db04-json.log
filebeat         | 2021-04-08T03:08:15.110Z     INFO    cfgfile/reload.go:224   Loading of config files completed.
filebeat         | 2021-04-08T03:08:15.110Z     INFO    log/harvester.go:302    Harvester started for file: /var/lib/docker/containers/c4e7e39e3f1feb5ec7f6249e5d6b9e1d48455e02f11529888fd01fdef6f24970/c4e7e39e3f1feb5ec7f6249e5d6b9e1d48455e02f11529888fd01fdef6f24970-json.log
filebeat         | 2021-04-08T03:08:15.111Z     INFO    log/harvester.go:302    Harvester started for file: /var/lib/docker/containers/ce2ac11b127257b10c90eced986efe3e5ed46d4e302d07451f9d21a349063eb2/ce2ac11b127257b10c90eced986efe3e5ed46d4e302d07451f9d21a349063eb2-json.log
filebeat         | 2021-04-08T03:08:15.111Z     INFO    log/harvester.go:302    Harvester started for file: /var/lib/docker/containers/db384c064d01e009bff75e42059959e07abd8169af10a936c26906cf598df890/db384c064d01e009bff75e42059959e07abd8169af10a936c26906cf598df890-json.log
filebeat         | 2021-04-08T03:08:15.125Z     INFO    [autodiscover]  autodiscover/autodiscover.go:113        Starting autodiscover manager
filebeat         | 2021-04-08T03:08:15.127Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/726d12a12558ee3df2bb1490dd55354784e23232ddaf9749a94f5cafaa804255/*-json.log]
filebeat         | 2021-04-08T03:08:15.127Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/726d12a12558ee3df2bb1490dd55354784e23232ddaf9749a94f5cafaa804255/*-json.log]
filebeat         | 2021-04-08T03:08:15.130Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat         | 2021-04-08T03:08:15.130Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat         | 2021-04-08T03:08:15.130Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat         | 2021-04-08T03:08:15.131Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat         | 2021-04-08T03:08:15.131Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat         | 2021-04-08T03:08:15.136Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat         | 2021-04-08T03:08:15.136Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat         | 2021-04-08T03:08:15.137Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat         | 2021-04-08T03:08:15.137Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat         | 2021-04-08T03:08:15.137Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat         | 2021-04-08T03:08:15.141Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat         | 2021-04-08T03:08:15.141Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat         | 2021-04-08T03:08:15.142Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat         | 2021-04-08T03:08:15.142Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat         | 2021-04-08T03:08:15.143Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/93fe317c4f3a7f83dcdb551f81523f77667137b0beb6871efdb788134f0dcfa2/*-json.log]
filebeat         | 2021-04-08T03:08:15.143Z     WARN    [cfgwarn]       tlscommon/config.go:101 DEPRECATED: Treating the CommonName field on X.509 certificates as a host name when no Subject Alternative Names are present is going to be removed. Please update your certificates if needed. Will be removed in version: 8.0.0
filebeat         | 2021-04-08T03:08:15.143Z     INFO    eslegclient/connection.go:99    elasticsearch url: https://es01:9200
filebeat         | 2021-04-08T03:08:15.220Z     INFO    [esclientleg]   eslegclient/connection.go:314   Attempting to connect to Elasticsearch version 7.12.0
filebeat         | 2021-04-08T03:08:15.266Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/f9ff15e719dc5f42ec4c6cfa5cb9b830f4fe8d27a60bc908ab9b5393dc6865b2/*-json.log]
filebeat         | 2021-04-08T03:08:15.267Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/f9ff15e719dc5f42ec4c6cfa5cb9b830f4fe8d27a60bc908ab9b5393dc6865b2/*-json.log]
filebeat         | 2021-04-08T03:08:15.267Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/f9ff15e719dc5f42ec4c6cfa5cb9b830f4fe8d27a60bc908ab9b5393dc6865b2/*-json.log]
filebeat         | 2021-04-08T03:08:15.270Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat         | 2021-04-08T03:08:15.271Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat         | 2021-04-08T03:08:15.271Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat         | 2021-04-08T03:08:15.272Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat         | 2021-04-08T03:08:15.272Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat         | 2021-04-08T03:08:15.275Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat         | 2021-04-08T03:08:15.275Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat         | 2021-04-08T03:08:15.275Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat         | 2021-04-08T03:08:15.276Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat         | 2021-04-08T03:08:15.276Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat         | 2021-04-08T03:08:15.280Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat         | 2021-04-08T03:08:15.280Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat         | 2021-04-08T03:08:15.280Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat         | 2021-04-08T03:08:15.281Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat         | 2021-04-08T03:08:15.281Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/d081ce15937e16b1fb4a6b61bd45f73962a35000faab224dc26e4b691939a53d/*-json.log]
filebeat         | 2021-04-08T03:08:15.281Z     WARN    [cfgwarn]       tlscommon/config.go:101 DEPRECATED: Treating the CommonName field on X.509 certificates as a host name when no Subject Alternative Names are present is going to be removed. Please update your certificates if needed. Will be removed in version: 8.0.0
filebeat         | 2021-04-08T03:08:15.281Z     INFO    eslegclient/connection.go:99    elasticsearch url: https://es01:9200
filebeat         | 2021-04-08T03:08:15.292Z     INFO    [esclientleg]   eslegclient/connection.go:314   Attempting to connect to Elasticsearch version 7.12.0
filebeat         | 2021-04-08T03:08:15.341Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/3bb9a470584c24f7e2965935d4da03aa6d9c8e95998143593bd1ea0a3816018c/*-json.log]
filebeat         | 2021-04-08T03:08:15.341Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/3bb9a470584c24f7e2965935d4da03aa6d9c8e95998143593bd1ea0a3816018c/*-json.log]
filebeat         | 2021-04-08T03:08:15.343Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/3bb9a470584c24f7e2965935d4da03aa6d9c8e95998143593bd1ea0a3816018c/*-json.log]
filebeat         | 2021-04-08T03:08:15.343Z     INFO    log/input.go:157        Configured paths: [/var/lib/docker/containers/3bb9a470584c24f7e2965935d4da03aa6d9c8e95998143593bd1ea0a3816018c/*-json.log]
filebeat         | 2021-04-08T03:08:15.343Z     WARN    [cfgwarn]       tlscommon/config.go:101 DEPRECATED: Treating the CommonName field on X.509 certificates as a host name when no Subject Alternative Names are present is going to be removed. Please update your certificates if needed. Will be removed in version: 8.0.0
filebeat         | 2021-04-08T03:08:15.344Z     INFO    eslegclient/connection.go:99    elasticsearch url: https://es01:9200
filebeat         | 2021-04-08T03:08:15.355Z     INFO    [esclientleg]   eslegclient/connection.go:314   Attempting to connect to Elasticsearch version 7.12.0
filebeat         | 2021-04-08T03:08:16.110Z     INFO    [publisher_pipeline_output]     pipeline/output.go:143  Connecting to backoff(elasticsearch(https://es01:9200))
filebeat         | 2021-04-08T03:08:16.110Z     INFO    [publisher]     pipeline/retry.go:219   retryer: send unwait signal to consumer
filebeat         | 2021-04-08T03:08:16.110Z     INFO    [publisher]     pipeline/retry.go:223     done
filebeat         | 2021-04-08T03:08:16.120Z     INFO    [esclientleg]   eslegclient/connection.go:314   Attempting to connect to Elasticsearch version 7.12.0
filebeat         | 2021-04-08T03:08:16.142Z     INFO    [license]       licenser/es_callback.go:51      Elasticsearch license: Basic
filebeat         | 2021-04-08T03:08:16.145Z     INFO    [esclientleg]   eslegclient/connection.go:314   Attempting to connect to Elasticsearch version 7.12.0
filebeat         | 2021-04-08T03:08:16.289Z     INFO    [index-management]      idxmgmt/std.go:261      Auto ILM enable success.
filebeat         | 2021-04-08T03:08:16.292Z     INFO    [index-management.ilm]  ilm/std.go:139  do not generate ilm policy: exists=true, overwrite=false
filebeat         | 2021-04-08T03:08:16.292Z     INFO    [index-management]      idxmgmt/std.go:274      ILM policy successfully loaded.
filebeat         | 2021-04-08T03:08:16.292Z     INFO    [index-management]      idxmgmt/std.go:407      Set setup.template.name to '{filebeat-7.12.0 {now/d}-000001}' as ILM is enabled.
filebeat         | 2021-04-08T03:08:16.292Z     INFO    [index-management]      idxmgmt/std.go:412      Set setup.template.pattern to 'filebeat-7.12.0-*' as ILM is enabled.
filebeat         | 2021-04-08T03:08:16.292Z     INFO    [index-management]      idxmgmt/std.go:446      Set settings.index.lifecycle.rollover_alias in template to {filebeat-7.12.0 {now/d}-000001} as ILM is enabled.
filebeat         | 2021-04-08T03:08:16.292Z     INFO    [index-management]      idxmgmt/std.go:450      Set settings.index.lifecycle.name in template to {filebeat {"policy":{"phases":{"hot":{"actions":{"rollover":{"max_age":"30d","max_size":"50gb"}}}}}}} as ILM is enabled.
filebeat         | 2021-04-08T03:08:16.313Z     INFO    template/load.go:183    Existing template will be overwritten, as overwrite is enabled.
filebeat         | 2021-04-08T03:08:17.170Z     INFO    template/load.go:117    Try loading template filebeat-7.12.0 to Elasticsearch
filebeat         | 2021-04-08T03:08:17.494Z     INFO    template/load.go:109    template with name 'filebeat-7.12.0' loaded.
filebeat         | 2021-04-08T03:08:17.494Z     INFO    [index-management]      idxmgmt/std.go:298      Loaded index template.
filebeat         | 2021-04-08T03:08:17.506Z     INFO    [index-management]      idxmgmt/std.go:309      Write alias successfully generated.
filebeat         | 2021-04-08T03:08:17.507Z     INFO    [publisher_pipeline_output]     pipeline/output.go:151  Connection to backoff(elasticsearch(https://es01:9200)) established
filebeat         | 2021-04-08T03:08:45.104Z     INFO    [monitoring]    log/log.go:144  Non-zero