To be fair, their documentation is terrible. Trying to set up filebeat feeding into logstash and figuring out custom GROK patterns requires forensic-level Google-fu to sift through vague blog posts and grab small nuggets from forums because the official docs basically say nothing of value.