Doh! Thank you, need to clear the weekend cobwebs out. I got it now...
❯ k logs metricbeat-metricbeat-6tswd
2020-01-13T18:33:57.316Z INFO instance/beat.go:610 Home path: [/usr/share/metricbeat] Config path: [/usr/share/metricbeat] Data path: [/usr/share/metricbeat/data] Logs path: [/usr/share/metricbeat/logs]
2020-01-13T18:33:57.316Z DEBUG [beat] instance/beat.go:662 Beat metadata path: /usr/share/metricbeat/data/meta.json
2020-01-13T18:33:57.316Z INFO instance/beat.go:618 Beat ID: 82ff3a1b-a4cd-4e5a-85ef-245a57005b89
2020-01-13T18:33:57.317Z INFO [api] api/server.go:62 Starting stats endpoint
2020-01-13T18:33:57.317Z DEBUG [seccomp] seccomp/seccomp.go:117 Loading syscall filter {"seccomp_filter": {"no_new_privs":true,"flag":"tsync","policy":{"default_action":"errno","syscalls":[{"names":["accept","accept4","access","arch_prctl","bind","brk","chmod","clock_gettime","clone","close","connect","dup","dup2","epoll_create","epoll_create1","epoll_ctl","epoll_pwait","epoll_wait","exit","exit_group","fchdir","fchmod","fchown","fcntl","fdatasync","flock","fstat","fstatfs","fsync","ftruncate","futex","getcwd","getdents","getdents64","geteuid","getgid","getpeername","getpid","getppid","getrandom","getrlimit","getrusage","getsockname","getsockopt","gettid","gettimeofday","getuid","inotify_add_watch","inotify_init1","inotify_rm_watch","ioctl","kill","listen","lseek","lstat","madvise","mincore","mkdirat","mmap","mprotect","munmap","nanosleep","newfstatat","open","openat","pipe","pipe2","poll","ppoll","pread64","pselect6","pwrite64","read","readlink","readlinkat","recvfrom","recvmmsg","recvmsg","rename","renameat","rt_sigaction","rt_sigprocmask","rt_sigreturn","sched_getaffinity","sched_yield","sendfile","sendmmsg","sendmsg","sendto","set_robust_list","setitimer","setsockopt","shutdown","sigaltstack","socket","splice","stat","statfs","sysinfo","tgkill","time","tkill","uname","unlink","unlinkat","wait4","waitid","write","writev"],"action":"allow"}]}}}
2020-01-13T18:33:57.317Z INFO [api] api/server.go:64 Metrics endpoint listening on: 127.0.0.1:5066 (configured: localhost)
2020-01-13T18:33:57.318Z INFO [seccomp] seccomp/seccomp.go:124 Syscall filter successfully installed
2020-01-13T18:33:57.318Z INFO [beat] instance/beat.go:941 Beat info {"system_info": {"beat": {"path": {"config": "/usr/share/metricbeat", "data": "/usr/share/metricbeat/data", "home": "/usr/share/metricbeat", "logs": "/usr/share/metricbeat/logs"}, "type": "metricbeat", "uuid": "82ff3a1b-a4cd-4e5a-85ef-245a57005b89"}}}
2020-01-13T18:33:57.318Z INFO [beat] instance/beat.go:950 Build info {"system_info": {"build": {"commit": "6d0d0ae079e5cb1d4f224801ac6df926dfb1594c", "libbeat": "7.5.0", "time": "2019-11-26T00:09:41.000Z", "version": "7.5.0"}}}
2020-01-13T18:33:57.318Z INFO [beat] instance/beat.go:953 Go runtime info {"system_info": {"go": {"os":"linux","arch":"amd64","max_procs":2,"version":"go1.12.12"}}}
2020-01-13T18:33:57.319Z INFO [beat] instance/beat.go:957 Host info {"system_info": {"host": {"architecture":"x86_64","boot_time":"2019-10-23T07:10:56Z","containerized":false,"name":"metricbeat-metricbeat-6tswd","ip":["127.0.0.1/8","172.16.0.83/22"],"kernel_version":"4.15.0-1061-azure","mac":["ca:da:c8:92:2b:e2"],"os":{"family":"redhat","platform":"centos","name":"CentOS Linux","version":"7 (Core)","major":7,"minor":7,"patch":1908,"codename":"Core"},"timezone":"UTC","timezone_offset_sec":0}}}
2020-01-13T18:33:57.319Z INFO [beat] instance/beat.go:986 Process info {"system_info": {"process": {"capabilities": {"inheritable":["chown","dac_override","fowner","fsetid","kill","setgid","setuid","setpcap","net_bind_service","net_raw","sys_chroot","mknod","audit_write","setfcap"],"permitted":["chown","dac_override","fowner","fsetid","kill","setgid","setuid","setpcap","net_bind_service","net_raw","sys_chroot","mknod","audit_write","setfcap"],"effective":["chown","dac_override","fowner","fsetid","kill","setgid","setuid","setpcap","net_bind_service","net_raw","sys_chroot","mknod","audit_write","setfcap"],"bounding":["chown","dac_override","fowner","fsetid","kill","setgid","setuid","setpcap","net_bind_service","net_raw","sys_chroot","mknod","audit_write","setfcap"],"ambient":null}, "cwd": "/usr/share/metricbeat", "exe": "/usr/share/metricbeat/metricbeat", "name": "metricbeat", "pid": 1, "ppid": 0, "seccomp": {"mode":"filter","no_new_privs":true}, "start_time": "2020-01-13T18:33:56.380Z"}}}
2020-01-13T18:33:57.319Z INFO instance/beat.go:297 Setup Beat: metricbeat; Version: 7.5.0
2020-01-13T18:33:57.319Z DEBUG [beat] instance/beat.go:323 Initializing output plugins
2020-01-13T18:33:57.319Z INFO [index-management] idxmgmt/std.go:182 Set output.elasticsearch.index to 'metricbeat-7.5.0' as ILM is enabled.
2020-01-13T18:33:57.320Z INFO elasticsearch/client.go:171 Elasticsearch url: http://elasticsearch-master:9200
2020-01-13T18:33:57.320Z DEBUG [publisher] pipeline/consumer.go:137 start pipeline event consumer
2020-01-13T18:33:57.321Z INFO [publisher] pipeline/module.go:97 Beat name: metricbeat-metricbeat-6tswd
2020-01-13T18:33:57.329Z DEBUG [modules] beater/metricbeat.go:121 Available modules and metricsets: Register [ModuleFactory:[aws, azure, beat, docker, elasticsearch, kibana, logstash, mongodb, mssql, mysql, oracle, postgresql, system, uwsgi], MetricSetFactory:[aerospike/namespace, apache/status, appsearch/stats, aws/cloudwatch, aws/ec2, aws/rds, aws/s3_daily_storage, aws/s3_request, aws/sqs, azure/compute_vm, azure/compute_vm_scaleset, azure/monitor, beat/state, beat/stats, ceph/cluster_disk, ceph/cluster_health, ceph/cluster_status, ceph/monitor_health, ceph/osd_df, ceph/osd_tree, ceph/pool_disk, consul/agent, coredns/stats, couchbase/bucket, couchbase/cluster, couchbase/node, couchdb/server, docker/container, docker/cpu, docker/diskio, docker/event, docker/healthcheck, docker/image, docker/info, docker/memory, docker/network, dropwizard/collector, elasticsearch/ccr, elasticsearch/cluster_stats, elasticsearch/enrich, elasticsearch/index, elasticsearch/index_recovery, elasticsearch/index_summary, elasticsearch/ml_job, elasticsearch/node, elasticsearch/node_stats, elasticsearch/pending_tasks, elasticsearch/shard, envoyproxy/server, etcd/leader, etcd/metrics, etcd/self, etcd/store, golang/expvar, golang/heap, graphite/server, haproxy/info, haproxy/stat, http/json, http/server, jolokia/jmx, kafka/consumergroup, kafka/partition, kibana/stats, kibana/status, kubernetes/apiserver, kubernetes/container, kubernetes/controllermanager, kubernetes/event, kubernetes/node, kubernetes/pod, kubernetes/proxy, kubernetes/scheduler, kubernetes/state_container, kubernetes/state_cronjob, kubernetes/state_deployment, kubernetes/state_node, kubernetes/state_pod, kubernetes/state_replicaset, kubernetes/state_resourcequota, kubernetes/state_statefulset, kubernetes/system, kubernetes/volume, kvm/dommemstat, logstash/node, logstash/node_stats, memcached/stats, mongodb/collstats, mongodb/dbstats, mongodb/metrics, mongodb/replstatus, mongodb/status, mssql/performance, mssql/transaction_log, munin/node, mysql/galera_status, mysql/status, nats/connections, nats/routes, nats/stats, nats/subscriptions, nginx/stubstatus, oracle/performance, oracle/tablespace, php_fpm/pool, php_fpm/process, postgresql/activity, postgresql/bgwriter, postgresql/database, postgresql/statement, prometheus/collector, rabbitmq/connection, rabbitmq/exchange, rabbitmq/node, rabbitmq/queue, redis/info, redis/key, redis/keyspace, statsd/server, system/core, system/cpu, system/diskio, system/entropy, system/filesystem, system/fsstat, system/load, system/memory, system/network, system/process, system/process_summary, system/raid, system/socket, system/socket_summary, system/uptime, traefik/health, uwsgi/status, vsphere/datastore, vsphere/host, vsphere/virtualmachine, zookeeper/connection, zookeeper/mntr, zookeeper/server], LightModules:[cockroachdb/status, tomcat/threading, tomcat/memory, tomcat/requests, tomcat/cache, aws/elb, aws/ebs]]
2020-01-13T18:33:57.362Z INFO add_kubernetes_metadata/kubernetes.go:68 add_kubernetes_metadata: kubernetes env detected, with version: v1.14.6
2020-01-13T18:33:57.363Z INFO kubernetes/util.go:94 kubernetes: Using pod name metricbeat-metricbeat-6tswd and namespace elk to discover kubernetes node
2020-01-13T18:33:57.376Z INFO kubernetes/util.go:100 kubernetes: Using node aks-agentpool-11078474-2 discovered by in cluster pod node query
2020-01-13T18:33:57.376Z DEBUG [kubernetes] add_kubernetes_metadata/kubernetes.go:138 Initializing a new Kubernetes watcher using host: aks-agentpool-11078474-2
2020-01-13T18:33:57.477Z DEBUG [kubernetes] kubernetes/watcher.go:241 cache sync done
2020-01-13T18:33:57.478Z DEBUG [kubernetes] add_kubernetes_metadata/kubernetes.go:156 add_kubernetes_metadata: adding pod: lendio/lendio-offers-redis-master-0
2020-01-13T18:33:57.478Z DEBUG [filters] add_cloud_metadata/providers.go:126 add_cloud_metadata: starting to fetch metadata, timeout=3s
2020-01-13T18:33:57.478Z DEBUG [kubernetes] add_kubernetes_metadata/kubernetes.go:156 add_kubernetes_metadata: adding pod: monitoring/prom-mfcloud-prometheus-node-exporter-7s689
2020-01-13T18:33:57.478Z DEBUG [kubernetes] add_kubernetes_metadata/kubernetes.go:156 add_kubernetes_metadata: adding pod: linkerd/linkerd-grafana-5d57b66477-55xd7
2020-01-13T18:33:57.478Z DEBUG [kubernetes] add_kubernetes_metadata/kubernetes.go:156 add_kubernetes_metadata: adding pod: linkerd/linkerd-controller-79d9f789b6-p67b5
2020-01-13T18:33:57.478Z DEBUG [kubernetes] add_kubernetes_metadata/kubernetes.go:156 add_kubernetes_metadata: adding pod: cert-manager/cert-manager-756d9f56d6-dnfz4
2020-01-13T18:33:57.478Z DEBUG [kubernetes] add_kubernetes_metadata/kubernetes.go:156 add_kubernetes_metadata: adding pod: default/mf-tickets-form-5664c88f9d-r7xcx
2020-01-13T18:33:57.479Z DEBUG [kubernetes] add_kubernetes_metadata/kubernetes.go:156 add_kubernetes_metadata: adding pod: kube-system/dash-kubernetes-dashboard-5649c959cd-2g5pz