I've modified logstash.conf so that it will parse the message from IIS logs and I am seeing results in the discover tab but unfortunately, it is not showing up in visualize. I am pretty sure this is because I have not modified fields.yml. Is there a way to get the variables parsed from grok to show in the visualize tab by editing fields.yml from Filebeat?
My fields.yml is unmodified from the elastic default from filebeat 7.2.0
My logstash.conf file is simple and only has a grok filter