Hey,
When trying to run Filebeat 7.17.8 with the Cisco module enabled we found that new amp events were not being ingested.
The var.first_interval parameter was respected and initially populated the index with amp events but no new events would be ingested unless we manually disabled and re-enabled the module.
This appeared to be a silent failure - could not gain anything from the logs that indicated anything was wrong, although I didn't try debug log level.
Rolling back to 7.16.3 resolved the problem.
Hope this is useful to anyone experiencing a similar issue configuring the Cisco module.