I don't know your previous configuration information, but you can refer to these configurations to test your environment. I'm working properly. Filebeat monitor nginx 1 record, send ２ records data to elasticsearch, one json format good, the other bad