I kind of fixed this by making sure I was properly defining "host.name" and "source.ip" as nested fields; after that I began seeing the SIEM full of hosts and the basic data. I'm also seeing a lot of conflicts in the index patterns since "source.ip" is now an IP rather than String, which is good.