Error with Cisco module for filebeat

[Nazarenko (WJ)]

Hello everyone, i have problem with module cisco for filebeat. I get message from cisco devices, but in kibana i see this message:

error.message GoError: could not find delimiter: : in remaining: User 'user1' authentication for SSH2 Session from 192.168.222.12 (tty = 0) using crypto cipher 'aes256-ctr', hmac 'hmac-sha1' Succeeded, (offset: 51)

/etc/filebeat/modules.d/cisco.yml:

i hope to your help

[Andre_Letterer (André Letterer)]

Hi Иван,

Could you please add a bit more context around this error message?
If you want you can enable debug messaging:

filebeat -c <configname>.yml -e -d '*' >filebeat.debug 2>&1

https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-
cisco.html#_ios_fileset_settings

It's possibly happening in the script processor file here module/cisco/ios/config/pipeline.js

My assumption is that this is happening somewhere in dissect processor, but without more error error context or having the original message it will be difficult to test here or judge what is going wrong.
Please use code blocks for showing the complete error message.

André - Андрей