Hello @mtojek,
Thanks for answer me.
I runned the command filebeat -e -d run and this is the output:
[root@localhost modules.d]# filebeat -e -d run
2020-03-09T20:43:12.697+0100 INFO instance/beat.go:622 Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2020-03-09T20:43:12.698+0100 INFO instance/beat.go:630 Beat ID: 7378502a-3d94-4710-99da-ccfc35ae4bcd
2020-03-09T20:43:15.703+0100 INFO add_cloud_metadata/add_cloud_metadata.go:89 add_cloud_metadata: hosting provider type not detected.
2020-03-09T20:43:15.703+0100 INFO [seccomp] seccomp/seccomp.go:124 Syscall filter successfully installed
2020-03-09T20:43:15.703+0100 INFO [beat] instance/beat.go:958 Beat info {"system_info": {"beat": {"path": {"config": "/etc/filebeat", "data": "/var/lib/filebeat", "home": "/usr/share/filebeat", "logs": "/var/log/filebeat"}, "type": "filebeat", "uuid": "7378502a-3d94-4710-99da-ccfc35ae4bcd"}}}
2020-03-09T20:43:15.703+0100 INFO [beat] instance/beat.go:967 Build info {"system_info": {"build": {"commit": "c1c49432bdc53563e63e9d684ca3e9843626e448", "libbeat": "7.6.1", "time": "2020-02-28T23:12:26.000Z", "version": "7.6.1"}}}
2020-03-09T20:43:15.703+0100 INFO [beat] instance/beat.go:970 Go runtime info {"system_info": {"go": {"os":"linux","arch":"amd64","max_procs":2,"version":"go1.13.8"}}}
2020-03-09T20:43:15.704+0100 INFO [beat] instance/beat.go:974 Host info {"system_info": {"host": {"architecture":"x86_64","boot_time":"2020-03-09T20:19:21+01:00","containerized":false,"name":"localhost.localdomain","ip":["127.0.0.1/8","::1/128","192.168.0.29/24","fe80::1bd3:953f:8943:cdaf/64","192.168.122.1/24"],"kernel_version":"3.10.0-1062.12.1.el7.x86_64","mac":["08:00:27:fd:5b:47","52:54:00:19:dd:b5","52:54:00:19:dd:b5"],"os":{"family":"redhat","platform":"centos","name":"CentOS Linux","version":"7 (Core)","major":7,"minor":7,"patch":1908,"codename":"Core"},"timezone":"CET","timezone_offset_sec":3600,"id":"08d134ea87a146a0b7436492458816c1"}}}
2020-03-09T20:43:15.706+0100 INFO [beat] instance/beat.go:1003 Process info {"system_info": {"process": {"capabilities": {"inheritable":null,"permitted":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend"],"effective":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend"],"bounding":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend"],"ambient":null}, "cwd": "/etc/filebeat/modules.d", "exe": "/usr/share/filebeat/bin/filebeat", "name": "filebeat", "pid": 4610, "ppid": 3630, "seccomp": {"mode":"filter","no_new_privs":true}, "start_time": "2020-03-09T20:43:11.600+0100"}}}
2020-03-09T20:43:15.706+0100 INFO instance/beat.go:298 Setup Beat: filebeat; Version: 7.6.1
2020-03-09T20:43:15.706+0100 INFO [index-management] idxmgmt/std.go:182 Set output.elasticsearch.index to 'filebeat-7.6.1' as ILM is enabled.
2020-03-09T20:43:15.706+0100 INFO elasticsearch/client.go:174 Elasticsearch url: http://localhost:9200
2020-03-09T20:43:15.706+0100 INFO [publisher] pipeline/module.go:110 Beat name: localhost.localdomain
2020-03-09T20:43:15.708+0100 INFO [monitoring] log/log.go:118 Starting metrics logging every 30s
2020-03-09T20:43:15.708+0100 INFO instance/beat.go:439 filebeat start running.
2020-03-09T20:43:15.991+0100 INFO registrar/registrar.go:145 Loading registrar data from /var/lib/filebeat/registry/filebeat/data.json
2020-03-09T20:43:15.991+0100 INFO registrar/registrar.go:152 States Loaded from registrar: 3
2020-03-09T20:43:15.991+0100 INFO crawler/crawler.go:72 Loading Inputs: 1
2020-03-09T20:43:15.992+0100 INFO log/input.go:152 Configured paths: [/home/user/Descargas/paloalto.20200303 /home/user/Descargas/attack_download.log /home/user/Descargas/umbrella.20200303]
2020-03-09T20:43:15.992+0100 INFO input/input.go:114 Starting input of type: log; ID: 6160703129214275189
2020-03-09T20:43:15.993+0100 INFO log/harvester.go:297 Harvester started for file: /home/user/Descargas/umbrella.20200303
2020-03-09T20:43:15.995+0100 INFO log/input.go:152 Configured paths: [/home/user/Descargas/paloalto.20200303]
2020-03-09T20:43:15.995+0100 INFO crawler/crawler.go:106 Loading and starting Inputs completed. Enabled inputs: 1
2020-03-09T20:43:15.995+0100 INFO cfgfile/reload.go:171 Config reloader started
2020-03-09T20:43:16.005+0100 INFO log/input.go:152 Configured paths: [/home/user/Descargas/paloalto.20200303]
2020-03-09T20:43:16.007+0100 INFO elasticsearch/client.go:174 Elasticsearch url: http://localhost:9200
2020-03-09T20:43:16.051+0100 INFO elasticsearch/client.go:757 Attempting to connect to Elasticsearch version 7.6.0
2020-03-09T20:43:16.079+0100 INFO [license] licenser/es_callback.go:50 Elasticsearch license: Basic
2020-03-09T20:43:16.188+0100 INFO input/input.go:114 Starting input of type: log; ID: 14528820469630532633
2020-03-09T20:43:16.188+0100 INFO cfgfile/reload.go:226 Loading of config files completed.
2020-03-09T20:43:45.712+0100 INFO [monitoring] log/log.go:145 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":530,"time":{"ms":532}},"total":{"ticks":1220,"time":{"ms":1231},"value":1220},"user":{"ticks":690,"time":{"ms":699}}},"handles":{"limit":{"hard":4096,"soft":1024},"open":11},"info":{"ephemeral_id":"d3bd17e1-4687-47b2-adb9-3e37227a1f35","uptime":{"ms":33097}},"memstats":{"gc_next":1469469824,"memory_alloc":774951816,"memory_total":2411829032,"rss":1876811776},"runtime":{"goroutines":40}},"filebeat":{"events":{"added":6,"done":6},"harvester":{"files":{"df22dbab-e433-40b4-befd-3670a81bf52f":{"last_event_published_time":"","last_event_timestamp":"","name":"/home/user/Descargas/umbrella.20200303","size":364292477,"start_time":"2020-03-09T20:43:15.993Z"}},"open_files":1,"running":1,"started":1}},"libbeat":{"config":{"module":{"running":0},"reloads":1},"output":{"type":"elasticsearch"},"pipeline":{"clients":3,"events":{"active":0,"filtered":6,"total":6}}},"registrar":{"states":{"current":3,"update":6},"writes":{"success":6,"total":6}},"system":{"cpu":{"cores":2},"load":{"1":3.16,"15":2.74,"5":3.07,"norm":{"1":1.58,"15":1.37,"5":1.535}}}}}}