I am using ELK stack v8 and I am integrating Cisco ASA syslog directly to logstash and then Elasticsearch database. I have noticed from the data view that I miss some field type (i.e: geo_point). how can i make Elasticsearch learn Cisco ASA ECS to be rich with fields from all type and this must happen without filebeat integration, due to design restriction in my environment.
Thus, the traffic is flowing CISCO ASA -> Logstash -> Elasticsearch.
note, parsing is done on logstash filter.
Any suggestion on how to let elastic learn the ASA schema ?
Thanks in advance,