# Config pipeline logstash with module cisco

**URL:** <https://discuss.elastic.co/t/config-pipeline-logstash-with-module-cisco/300044>\
**Category:** Logstash\
**Created:** [March 18, 2022, 1:28pm UTC](https://discuss.elastic.co/t/config-pipeline-logstash-with-module-cisco/300044 "2022-03-18T13:28:26Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![jojodd](https://avatars.discourse-cdn.com/v4/letter/j/a587f6/32.png) [@jojodd](https://discuss.elastic.co/u/jojodd)\
**Post date:** [March 18, 2022, 1:28pm UTC](https://discuss.elastic.co/t/config-pipeline-logstash-with-module-cisco/300044/1 "2022-03-18T13:28:27Z")

</div>

Hello,

I would like to know if it is possible to use at the same time cisco-asa and cisco-ios in a single pipeline?

Is there a method to create several indexes with one for cisco-ios and the other for cisco-asa?

---

<div class="post-metadata">

**Author:** ![Krunal](https://avatars.discourse-cdn.com/v4/letter/k/ce7236/32.png) [@Krunal](https://discuss.elastic.co/u/Krunal)\
**Post date:** [March 18, 2022, 1:56pm UTC](https://discuss.elastic.co/t/config-pipeline-logstash-with-module-cisco/300044/2 "2022-03-18T13:56:27Z")

</div>

Hello,  
you can run more than one pipeline in the same process.

> **[Multiple Pipelines | Logstash Reference \[8.1\] | Elastic](https://www.elastic.co/guide/en/logstash/current/multiple-pipelines.html)**

another concept is pipeline to pipeline communication  
Check it on documentation.

---

<div class="post-metadata">

**Author:** ![jojodd](https://avatars.discourse-cdn.com/v4/letter/j/a587f6/32.png) [@jojodd](https://discuss.elastic.co/u/jojodd)\
**Post date:** [March 18, 2022, 2:01pm UTC](https://discuss.elastic.co/t/config-pipeline-logstash-with-module-cisco/300044/3 "2022-03-18T14:01:32Z")

</div>

so I can make 2 pipelines for a module with the same port?

Thanks, I'll go and see if this can help me.

---

<div class="post-metadata">

**Author:** ![jojodd](https://avatars.discourse-cdn.com/v4/letter/j/a587f6/32.png) [@jojodd](https://discuss.elastic.co/u/jojodd)\
**Post date:** [March 18, 2022, 2:44pm UTC](https://discuss.elastic.co/t/config-pipeline-logstash-with-module-cisco/300044/4 "2022-03-18T14:44:13Z")

</div>

how to use a pipeline to receive logs from cisco-asa and cisco-ios?

I haven't found many examples on this subject.

I have a server that contains the filebeat and logstash service.

---

<div class="post-metadata">

**Author:** ![Krunal](https://avatars.discourse-cdn.com/v4/letter/k/ce7236/32.png) [@Krunal](https://discuss.elastic.co/u/Krunal)\
**Post date:** [March 22, 2022, 12:56pm UTC](https://discuss.elastic.co/t/config-pipeline-logstash-with-module-cisco/300044/5 "2022-03-22T12:56:07Z")

</div>

create log files of both and ingest through logstash.

> [@Ingesting CISCO ASA Logs](https://discuss.elastic.co/t/ingesting-cisco-asa-logs/143662):
>
> Anyone got any good updated links that explains how this can be done? How updated is this one? any takes?

> **[Sending Cisco Syslogs to Elasticsearch: A simple guide | www.neteye-blog.com](https://www.neteye-blog.com/2017/10/sending-cisco-syslogs-to-elasticsearch-a-simple-guide/)**
>
> Do you use Cisco's network infrastructure? Would you like to view its logs through the syslog protocol in an Elasticsearch database? Find out below about the filters and templates needed for the Logstash setup. As you probably already know, you need...

Check it

---

<div class="post-metadata">

**Author:** ![jojodd](https://avatars.discourse-cdn.com/v4/letter/j/a587f6/32.png) [@jojodd](https://discuss.elastic.co/u/jojodd)\
**Post date:** [March 22, 2022, 1:07pm UTC](https://discuss.elastic.co/t/config-pipeline-logstash-with-module-cisco/300044/6 "2022-03-22T13:07:53Z")

</div>

Sorry I forgot to say but yesterday I found the solution to my problem and it works.

the solution can be found here :

> [@Cisco module in FIlbeat - General doubt](https://discuss.elastic.co/t/cisco-module-in-filbeat-general-doubt/294212):
>
> I have to enable multiple filesets in the Cisco Module of Filebeat. Is that possible? Can I set a document\_type for each fileset such as ASA, IOS, NEXUS, etc while configuring the modules? It is required for me to filter it when I push it from Logstash to Elasticsearch as I will create separate indices for each device type.

> [@Cisco-module (Filebeat) to Logstash - Configuration issue- Need help!](https://discuss.elastic.co/t/cisco-module-filebeat-to-logstash-configuration-issue-need-help/299765):
>
> Hi All, I was able to send logs to Elasticsearch using Filebeat using the below configuration successfully. # ============================== Filebeat inputs =============================== filebeat.inputs: - type: log enabled: false paths: - /var/log/\*.log # ============================== Filebeat modules ============================== filebeat.config.modules: # Glob pattern for configuration loading path: ${path.config}/modules.d/\*.yml # Set to true to enable config reloadin…

---

<div class="post-metadata">

**Author:** ![jojodd](https://avatars.discourse-cdn.com/v4/letter/j/a587f6/32.png) [@jojodd](https://discuss.elastic.co/u/jojodd)\
**Post date:** [March 22, 2022, 1:08pm UTC](https://discuss.elastic.co/t/config-pipeline-logstash-with-module-cisco/300044/7 "2022-03-22T13:08:53Z")

</div>

@Krunal thank you for your help

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 19, 2022, 1:09pm UTC](https://discuss.elastic.co/t/config-pipeline-logstash-with-module-cisco/300044/8 "2022-04-19T13:09:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
