The default grok expression created by filebeat for the ingest node pipeline does not match the logs sent to ES. Not using any sort of custom mongo logs, everything is just default.
Tried writing my own Grok expression, and I got it working via the simulate pipeline API, but it still wouldn't work when using Filebeat.
ES v5.5 (AWS)
Running Mongo and Filebeat on an EC2 on AWS Linux