We have an existing functional Elastic instance running with Filebeat 8.9, running on Ubuntu 22.04. We're attempting to add Cisco logs using the Cisco filebeat module. However, we're not seeing any logs coming in. We have verified connectivity between the hosts. Our cisco.yml file is as follows: …

can you try filebeat test config Also your logs do not show the startup of filebeat where the UDP listener would get opened. First 100 lines or so. Also those logs show other modules / paths are you sure you are running what you are showing above "source_file":"/mnt/Bro/current/pe.log", Aslo yo…

Thank you stephenb. filebeat test config Shows: Config OK When I restart filebeat using filebeat -e I see the following: https://gist.github.com/packetuser/d27a7c57219aa54b712fef698ce74ce3 gistfile1.txt ~$ sudo filebeat -e {"log.level":"info","@timestamp":"2023-08-30T15:43:09.907…

So you have alot of modules enable I would disable the other to temporarily debug do you have more than one module opening UDP # Here lots of modules makes it hard to debug {"log.level":"info","@timestamp":"2023-08-30T15:43:10.738Z","log.logger":"modules","log.origin":{"file.name":"fileset/modules…

Ok thanks again. Yes I noticed the error as you pointed out: "Connection has been closed" I think I had issued ctrl-c and not known that action would shut down filebeat. I tried again and don't see that message. I disabled all but the Cisco module, and issued filebeat -e -d "*" I sent a log wh…

Yup Looks pretty normal Do you see the UDP port open? did you try to netcat a couple of messages? if it is reading them you should see them show up in the logs when you use the -d "*" when you are running netstat are you asking for udp? can you show the command?

Aha, I think I had been using netcat incorrectly. I tried this to see UDP: sudo netstat -nulp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name udp 0 0 127.0.0.53:53 0.0.0.0:* …

that I can not really help you with.... mine on mac say udp46 I suspect it is running on both unless you have some special network settings udp46 0 0 *.9002

Looks like someone else had the same issue: Filebeat Cisco Module: Listening on IPV6 only? So in the cisco.yml file, I specified the host IP instead of 0.0.0.0. That seems to have helped: netstat -nulp (Not all processes could be identified, non-owned process info will not be shown, you would hav…

it takes more than hello... there is a buffer size etc... nc -u 127.0.0.1 9002 hello lsakdjfaslkdfjh lsakdjfhasldkfjh ladksjfhasldkfjh aslkdfjhasdflkjh in logs {"log.level":"debug","@timestamp":"2023-08-30T10:44:21.342-0700","log.logger":"processors","log.origin":{"file.name":"processing/process…

Alas, still no. I was poking around in the GUI, and I see there's an error message related to the Cisco module: GoError: could not find delimiter: `` in remaining: ` `, (offset: 0)`Preformatted text` Someone else had this issue, so I'll poke around where he was directed: Error with Cisco module f…

Cisco filebeat module not listening on port as configured

Elastic Stack Elasticsearch

system (system) Closed October 3, 2023, 7:27pm 20

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Can't collect the logs of cisco router Elasticsearch	14	1427	October 5, 2022
Filebeat - Cisco Module doesn't accept logs from other sources that itsself Beats filebeat	1	682	June 12, 2020
Filebeat Syslog no listening port Logstash	16	1583	August 10, 2023
Cisco iOS integration - No data has been received from this module yet Beats filebeat	2	253	April 4, 2024
Cannot get Cisco Filebeat module to work Kibana	14	2460	December 29, 2021

Cisco filebeat module not listening on port as configured

Related topics