# Arcsight Logs do not Ouput to Kibana

**URL:** <https://discuss.elastic.co/t/arcsight-logs-do-not-ouput-to-kibana/92327>\
**Category:** Logstash\
**Created:** [July 7, 2017, 7:56pm UTC](https://discuss.elastic.co/t/arcsight-logs-do-not-ouput-to-kibana/92327 "2017-07-07T19:56:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![vaz1108](https://avatars.discourse-cdn.com/v4/letter/v/b5e925/32.png) [@vaz1108](https://discuss.elastic.co/u/vaz1108)\
**Post date:** [July 7, 2017, 7:56pm UTC](https://discuss.elastic.co/t/arcsight-logs-do-not-ouput-to-kibana/92327/1 "2017-07-07T19:56:12Z")

</div>

Hi Experts,

I need some help. I have configure a conf file for logstash to listen on port 8443 to received ArcSight logs on cef format. I can see the connection from the Archsight connector to the the elk server via tcpdump. However, I can't see the logs been received by logstash.  
Logstash cof file:

input {  
tcp {  
# The delimiter config used is for TCP interpretation  
codec =\> cef { delimiter =\> "\r\n"}  
port =\> 8443  
type =\> syslog  
}  
}

filter {

# To map the attacker Geo IP if plausible

geoip {  
source =\> "sourceAddress"  
target =\> "source"  
}

# To map the target Geo IP if plausible

geoip {  
source =\> "destinationAddress"  
target =\> "destination"  
}

# To map the log producing device Geo IP if plausible

geoip {  
source =\> "deviceAddress"  
target =\> "device"  
}

}

output {

elasticsearch {  
template\_name =\> "cef"  
template =\> "/etc/logstash/cef\_template.json"  
template\_overwrite =\> false  
index =\> "cef-%{+YYYY.MM.dd}"  
#password =\> "changeme"  
#user =\> "elastic"  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 11, 2017, 3:09pm UTC](https://discuss.elastic.co/t/arcsight-logs-do-not-ouput-to-kibana/92327/2 "2017-07-11T15:09:56Z")

</div>

Have you tried simplifying the setup by using a `stdout { codec => rubydebug }` output instead of the elasticsearch output? Have you looked in the Logstash logs for clues?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 8, 2017, 3:10pm UTC](https://discuss.elastic.co/t/arcsight-logs-do-not-ouput-to-kibana/92327/3 "2017-08-08T15:10:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.