I am trying to setup my ELK pipeline. I have filebeat monitoring on one VM and my logstash and elasticsearch instances running on another. When I make an update to the file which specified in filebeat.yml, I see that change reflected in logstash (logstash,conf also prints to stdout). In my filebeat.yml under the logstash section I specify the index name as "demo". When I try to search for that index in elasticsearch, I get an error response.
So, was the change not added to elasticsearch, or am I specifying the index name incorrectly? I think it's the latter because I was following a tutorial to set this up, and ES is checked to contain the right information by using a different index name, but I don't know how that index name was specified.