SIEM does not show data

You didn't show me your mapping above? You just showed me a screen shot of where you tried to modify your mapping to turn on fielddata which is still not really recommended.

I think you wanted to show me from line 23 and below which would be:

GET filebeat-*/_mapping

However, if you have a direct connection from filebeat you can follow the commands from here:

https://www.elastic.co/guide/en/beats/filebeat/current/command-line-options.html#setup-command

to setup your templates such as:

filebeat setup

Then you should see that your have indexes, ILM policies, etc... setup