# Elastic common schema for Cisco ASA

**URL:** <https://discuss.elastic.co/t/elastic-common-schema-for-cisco-asa/305730>\
**Category:** Elasticsearch\
**Tags:** ecs-elastic-common-schema\
**Created:** [May 26, 2022, 3:41pm UTC](https://discuss.elastic.co/t/elastic-common-schema-for-cisco-asa/305730 "2022-05-26T15:41:36Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Elie\_Sbat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elie_sbat/32/69089_2.png) [@Elie\_Sbat](https://discuss.elastic.co/u/Elie_Sbat)\
**Post date:** [May 26, 2022, 3:41pm UTC](https://discuss.elastic.co/t/elastic-common-schema-for-cisco-asa/305730/1 "2022-05-26T15:41:36Z")

</div>

Hello Gents,

I am using ELK stack v8 and I am integrating Cisco ASA syslog directly to logstash and then Elasticsearch database. I have noticed from the data view that I miss some field type (i.e: geo\_point). how can i make Elasticsearch learn Cisco ASA ECS to be rich with fields from all type and this must happen without filebeat integration, due to design restriction in my environment.

Thus, the traffic is flowing CISCO ASA -\> Logstash -\> Elasticsearch.

note, parsing is done on logstash filter.

Any suggestion on how to let elastic learn the ASA schema ?

Thanks in advance,  
Elie

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [May 27, 2022, 8:31am UTC](https://discuss.elastic.co/t/elastic-common-schema-for-cisco-asa/305730/2 "2022-05-27T08:31:10Z")

</div>

You have to add geo\_ip plugin and do geo\_ip mapping. [Check link](https://discuss.elastic.co/t/geoip-data-not-creating-location-field-and-duplicating-data/303612)

---

<div class="post-metadata">

**Author:** ![Elie\_Sbat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elie_sbat/32/69089_2.png) [@Elie\_Sbat](https://discuss.elastic.co/u/Elie_Sbat)\
**Post date:** [May 31, 2022, 9:49am UTC](https://discuss.elastic.co/t/elastic-common-schema-for-cisco-asa/305730/3 "2022-05-31T09:49:42Z")

</div>

Hello,

I just linked the datastream to a predefined index template.

---

<div class="post-metadata">

**Author:** ![Elie\_Sbat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elie_sbat/32/69089_2.png) [@Elie\_Sbat](https://discuss.elastic.co/u/Elie_Sbat)\
**Post date:** [June 6, 2022, 6:47am UTC](https://discuss.elastic.co/t/elastic-common-schema-for-cisco-asa/305730/4 "2022-06-06T06:47:54Z")

</div>

Hello Rios,

Actually I tried to use your method but the user does have sufficient privilege to execute the command, I am using super user right. What privilege is needed ?

b

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 4, 2022, 6:48am UTC](https://discuss.elastic.co/t/elastic-common-schema-for-cisco-asa/305730/5 "2022-07-04T06:48:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.