I have this configuration
and I load the indice with logstash:logstash and as you see the data is ready , but when I log with admin:dev to kibana to charge or see the index
it doesn’t exist
is wrong my configuration ?
Do I see correctly that you instruct logstash to write indices named prueba-probicy-* and logstash user in ROR is only allowed to write on logstash-* named indices? If that is the case, Logstash should fail to write.
Keep an eye on the elasticsearch.log to see any “FORBIDDEN” log lines.
Once this is sorted, also make sure that when you log in as admin and look for those indices, you have the right index-pattern set up (configurable from the usual Kibana settings). Otherwise it defaults to any index named logstash-* and you won’t see your “prueba” indices at all.