vagrant box update
vagrant up

# open a browser
# http://127.0.0.1:5601
# username = elastic
# password = changeme
# under "Index name or pattern", type "filebeat-*"
# under "Time-field name", select "@timestamp"
# click "Create"
# on the next page, click the (green/blue) star, setting the default index

# click "Discover", in the top menu
# click drop-down in left-side menu, select "filebeat-*"
# you may have to wait a few minutes for the results to flow in

# filebeat
/var/log/filebeat/filebeat

# metricbeat
/var/log/metricbeat/metricbeat

# heartbeat
/var/log/heartbeat/heartbeat

# logstash
/var/log/logstash/logstash-plain.log
/var/log/logstash/logstash.stdout
/var/log/logstash/logstash.log

# elasticsearch
/var/log/elasticsearch/elasticsearch.log
/var/log/elasticsearch/elasticsearch.log.*
/var/log/elasticsearch/elasticsearch_deprecation.log
/var/log/elasticsearch/elasticsearch_index_search_slowlog.log
/var/log/elasticsearch/elasticsearch_index_indexing_slowlog.log.log

# kibana
/var/log/kibana.log
/var/log/kibana/kibana.stderr
/var/log/kibana/kibana.stdout

# filebeat
/etc/filebeat
/usr/share/filebeat

# metricbeat
/etc/metricbeat
/usr/share/metricbeat

# heartbeat
/etc/heartbeat
/usr/share/heartbeat

# logstash
/etc/logstash
/usr/share/logstash

# elasticsearch
/etc/elasticsearch/
/usr/share/elasticsearch/

# kibana
/etc/kibana
/usr/share/kibana
/opt/kibana