# Cisco Filebeat Issues

**URL:** <https://discuss.elastic.co/t/cisco-filebeat-issues/277890>\
**Category:** Beats\
**Tags:** beats-module, filebeat\
**Created:** [July 6, 2021, 1:45am UTC](https://discuss.elastic.co/t/cisco-filebeat-issues/277890 "2021-07-06T01:45:32Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![codersoul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/codersoul/32/45353_2.png) [@codersoul](https://discuss.elastic.co/u/codersoul)\
**Post date:** [July 6, 2021, 1:45am UTC](https://discuss.elastic.co/t/cisco-filebeat-issues/277890/1 "2021-07-06T01:45:32Z")

</div>

Hi,

I'm working with Filebeat and Cisco Module in a Lab. I am ingesting data from Cisco AMP, everything work as expected , but I getting this error in Filebeat logs.

Jul 02 09:26:48 cstxsvngs01 filebeat[25410]: 2021-07-02T09:26:48.396-0500 ERROR [input.httpjson-cursor.retryablehttp] go-retryablehttp@v0.6.6/client.go:553 request failed%!(EXTRA string=error, \*url.Error=Get "": unsupported protocol scheme "", string=method, string=GET, string=url, \*url.URL=) {"input\_source": "[https://api.amp.cisco.com/v1/events](https://api.amp.cisco.com/v1/events)", "input\_url": "[https://api.amp.cisco.com/v1/events](https://api.amp.cisco.com/v1/events)"}

Jul 02 09:26:48 cstxsvngs01 filebeat[25410]: 2021-07-02T09:26:48.396-0500 ERROR [input.httpjson-cursor] v2/request.go:186 error processing response: failed to execute http client.Do: Get "": Get "": unsupported protocol scheme "" {"input\_source": "[https://api.amp.cisco.com/v1/events](https://api.amp.cisco.com/v1/events)", "input\_url": "[https://api.amp.cisco.com/v1/events](https://api.amp.cisco.com/v1/events)"}

Anyone have more information about this error ?

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [July 6, 2021, 3:29am UTC](https://discuss.elastic.co/t/cisco-filebeat-issues/277890/2 "2021-07-06T03:29:53Z")

</div>

Weird. What version of filebeat? That error arises when you only put the FQDN in the url field without the scheme, http:// or https://. Based on what I can see you have a good url. But to be safe, can you post your config?

---

<div class="post-metadata">

**Author:** ![codersoul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/codersoul/32/45353_2.png) [@codersoul](https://discuss.elastic.co/u/codersoul)\
**Post date:** [July 6, 2021, 6:03pm UTC](https://discuss.elastic.co/t/cisco-filebeat-issues/277890/3 "2021-07-06T18:03:26Z")

</div>

Hi, @legoguy1000 . Thanks for your reply.

I'm using the last stable versión:

`filebeat version 7.13.2 (amd64), libbeat 7.13.2 [686ba416a74193f2e69dcfa2eb142f4364a79307 built 2021-06-10 21:04:13 +0000 UTC]`

Cisco module configuration cisco.yml

```auto
- module: cisco
  asa:
    enabled: false
  ftd:
    enabled: false
  ios:
    enabled: false
  nexus:
    enabled: false
  meraki:
    enabled: false
  umbrella:
    enabled: false
  amp:
    enabled: true

    # Set which input to use between httpjson (default) or file.
    var.input: httpjson

    # The API URL
    var.url: https://api.amp.cisco.com/v1/events
    
    # The client ID used as a username for the API requests.
    var.client_id: "xxx"
    
    # The API key related to the client ID.
    var.api_key: "xxxx"
    
    # How far to look back the first time the module is started. Expects an amount of hours.
    var.first_interval: 26280h
    
    # Overriding the default request timeout, optional.
    var.request_timeout: 300s
    var.interval: 5m

```

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [July 6, 2021, 11:44pm UTC](https://discuss.elastic.co/t/cisco-filebeat-issues/277890/4 "2021-07-06T23:44:56Z")

</div>

Ya everything looks fine. This is definitely weird. Do any of the other modules that use the httpjson input work?

---

<div class="post-metadata">

**Author:** ![codersoul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/codersoul/32/45353_2.png) [@codersoul](https://discuss.elastic.co/u/codersoul)\
**Post date:** [July 7, 2021, 1:36am UTC](https://discuss.elastic.co/t/cisco-filebeat-issues/277890/5 "2021-07-07T01:36:18Z")

</div>

I'm not working with other module that use httpjson input =(. Thanks for your reply

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 4, 2021, 3:37am UTC](https://discuss.elastic.co/t/cisco-filebeat-issues/277890/6 "2021-08-04T03:37:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.