Hi @fati
I provided my suggestion... But looks like you are still trying other options.
You are making this more complex than it needs to be. You are trying to run set up with all the individual commands that can often lead to issues as opposed to just running the basic command that I supplied so let's try this again.
-
go into elasticsearch and clean up / delete any filebeat indices
-
in your filebeat.yml configure the output to point to elasticsearch. Comment out the logstash output. The kibana setup looks good.
-
run this command no extra parameters just this command. This will set up everything
filebeat setup -e
If you're running 7. 12 there's actually a little bug and it'll throw some errors at the bottom of that command but it should be fine ignore them for now.
-
now go back into your filebeat.yml and comment out (or take out) the elasticsearch output and put in your logstash output.
-
use the logstash configuration file that I provided above and start logstash.
-
start filebeat with no extra paramaters
filebeat -e
Perhaps I didn't provide enough information there is an nginx pipeline that's automatically loaded and is used to parse the data on the elasticsearch side if you don't configure all this correctly like I showed above that will not be used and therefore your data will not be processed and therefore the dashboards will not work.
Please try my suggestions and then if they don't work we can take another look I have set this up many times exactly like this for nginx logs and I can load the dashboards and everything.