Do I see correctly that you instruct logstash to write indices named
prueba-probicy-* and logstash user in ROR is only allowed to write on
logstash-* named indices? If that is the case, Logstash should fail to write.
Keep an eye on the
elasticsearch.log to see any “FORBIDDEN” log lines.
Once this is sorted, also make sure that when you log in as admin and look for those indices, you have the right
index-pattern set up (configurable from the usual Kibana settings). Otherwise it defaults to any index named
logstash-* and you won’t see your “prueba” indices at all.