Cisco module in FIlbeat - General doubt

Elastic Stack Beats
,
#1

I have to enable multiple filesets in the Cisco Module of Filebeat.

Is that possible?

Can I set a document_type for each fileset such as ASA, IOS, NEXUS, etc while configuring the modules?

It is required for me to filter it when I push it from Logstash to Elasticsearch as I will create separate indices for each device type.

#2

Yes, u can enable as many or as few filesets add u want. What do u mean by document type? Are u looking for a field that u can use to differentiate the filesets? If so use event.dataset ex. cisco.asa.

#3

You are a life saver! Thanks.... :slight_smile: