No logs appearing in Kibana

Elastic Stack Elasticsearch
21

I did try it literally first - Is there a way to set the default paths for the configs? Everything is in it's default location in /etc/. Tried changing things in startup.options then running system-install but that doesn't seem to make a difference either.

Anyway, here's a paste of the output from that command;

https://pastebin.com/XyYeUDQx

22

Anything in that file that looks out of the ordinary to you?

23

The output you provided looks about right:

2018-04-09T14:50:13.361+0100 INFO log/harvester.go:216 Harvester started for file: /TEST/sigmaworker.log

"harvester":{"open_files":1,"running":1,"started":1}}

However from the log snippet you provided earlier on it does not have any open files, which to me would indicate the running configuration is somehow different

{"harvester":{"open_files":0,"running":0}

I'd possibly suggest migrating the issue (closing, opening a new one) into the Filebeat forum since we appear to have isolated the issue to there. I'll have a further look but I've not used filebeat too heavily so don't have much experience to weigh on, others with more knowledge might be able to help