Bug in Cisco Module for Filebeat 7.17.8


When trying to run Filebeat 7.17.8 with the Cisco module enabled we found that new amp events were not being ingested.

The var.first_interval parameter was respected and initially populated the index with amp events but no new events would be ingested unless we manually disabled and re-enabled the module.

This appeared to be a silent failure - could not gain anything from the logs that indicated anything was wrong, although I didn't try debug log level.

Rolling back to 7.16.3 resolved the problem.

Hope this is useful to anyone experiencing a similar issue configuring the Cisco module.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.