# Cisco ASA module ingest pipeline parsing failure 7.13

**URL:** <https://discuss.elastic.co/t/cisco-asa-module-ingest-pipeline-parsing-failure-7-13/275294>\
**Category:** Beats\
**Tags:** beats-module, filebeat\
**Created:** [June 8, 2021, 11:49am UTC](https://discuss.elastic.co/t/cisco-asa-module-ingest-pipeline-parsing-failure-7-13/275294 "2021-06-08T11:49:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mbst83r](https://avatars.discourse-cdn.com/v4/letter/m/919ad9/32.png) [@mbst83r](https://discuss.elastic.co/u/mbst83r)\
**Post date:** [June 8, 2021, 11:49am UTC](https://discuss.elastic.co/t/cisco-asa-module-ingest-pipeline-parsing-failure-7-13/275294/1 "2021-06-08T11:49:43Z")

</div>

Hello,

the ingest pipeline is not parsing the IPSEC messages from the Cisco ASA (602303/602304) correctly. I am using filebeat 7.13.1 and the problem is in the filebeat-7.13.1-cisco-asa-asa-ftd-pipeline.

```auto
2021-06-08T13:04:34.218+0200 WARN [elasticsearch] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc027f18f6b1d8fb2, ext:5791826777703, loc:(*time.Location)(0x557298082dc0)}, Meta:{"pipeline":"filebeat-7.13.1-cisco-asa-asa-ftd-pipeline","truncated":false}, Fields:{"agent":{"ephemeral_id":"ff7b578b-76ea-457d-af87-bc4607504f7a","hostname":"xxx","id":"5004e7e5-76fb-4115-993c-fd25bda126c3","name":"xxx","type":"filebeat","version":"7.13.1"},"ecs":{"version":"1.9.0"},"event":{"dataset":"cisco.asa","module":"cisco","timezone":"+02:00"},"fileset":{"name":"asa"},"input":{"type":"udp"},"log":{"source":{"address":"xxx"}},"message":"\u003c166\u003egsn-v003 %ASA-6-602303: IPSEC: An outbound LAN-to-LAN SA (SPI= 0x2D0773E5) between xxx and xxx (user= xxx) has been created.\n","service":{"type":"cisco"},"tags":["cisco-asa","forwarded"]}, Private:interface {}(nil), TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"object mapping for [network.inner] tried to parse field [inner] as object, but found a concrete value"}

```

i changed all valuable data with xxx, but from the error msg it should be clear, what the problem is.

If i change the field name network.inner, it works as expected.

Best regards!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2021, 1:50pm UTC](https://discuss.elastic.co/t/cisco-asa-module-ingest-pipeline-parsing-failure-7-13/275294/2 "2021-07-06T13:50:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.