It is a bit confusing here since you are configuring zeek.yml, but I would think you need to have those inside of filebeat.yml.
Alternatively if you have set filebeat to communicate with elasticsearch through logstash then you may want to put that in the output.elasticsearch.index field of logstash/conf.d/{config-file-name}.conf
like this
output {
elasticsearch {
hosts => ["localhost:9200"]
manage_template => false
# index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
index => "zeek-%{+YYYY.MM.dd}"
}
}
The commented line is actually the one that created the filebeat-* pattern.
Remember restarting logstash if you set this in logstash or restart filebeat service if you set this inside filebeat.
You will also need to add the index pattern to logstash.
However above all, providing details about your setup will be more helpful to those who may want to provide a hand
You can also look at the logs to check if anything is being logged there.
Goodluck