[Docs] [Filebeat] [Kibana module] Add what configuration is needed for it to work

[a03nikki]

Describe the enhancement:

It would be nice if the documentation for Filebeat's kibana module included which log formats are supported and possibly how to configure it so the module worked.

Describe a specific use case for the enhancement or feature:

The Kibana module (Filebeat v7.13) does not indicate what the log format needs to be in order to work properly. By comparison, the Elasticsearch module (Filebeat v7.13) indicates use the json log format for new Elasticsearch versions.

For Kibana, it only says the default text for var.paths of

var.paths
An array of glob-based paths that specify where to look for the log files. All patterns supported by Go Glob are also supported here. For example, you can use wildcards to fetch all files from a predefined level of subdirectories: /path/to/log/*/*.log. This fetches all .log files from the subfolders of /path/to/log. It does not fetch log files from the /path/to/log folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system.

The Logging settings in Kibana page (v7.13) indicates a number of log formats are possible now.

• logging.appenders.{NAME}.type: console or file
• logging.appenders.{NAME}.laytout.type: pattern default, pattern custom, or json

When I was trying to quickly set this up for myself, I tried both the default pattern and json to a log file and both produced filebeat-7.13.3-* documents with the error object populated. I tried to check the source for the module, but didn't find the answer quickly there either. As it was just my lab environment, I skipped this set-up and moved onto other tasks instead of spending time to figure it out.

Related: #24136

[elasticmachine]

Pinging @elastic/agent (Team:Agent)

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!