chicco27

This problem seems the same on all Beats, the host.ip field is not calculated correctly when you use a Log Forwarder. Major issue: https://github.com/elastic/beats/issues/13920

Yes the files are present on the subfolder but as @AndrewBuis said on EXE run they aren't loaded.