# \[filebeat ASA Module\] outbound traffic log is parsed in reverse for the source and destination IP

**URL:** <https://discuss.elastic.co/t/filebeat-asa-module-outbound-traffic-log-is-parsed-in-reverse-for-the-source-and-destination-ip/339269>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 26, 2023, 7:53am UTC](https://discuss.elastic.co/t/filebeat-asa-module-outbound-traffic-log-is-parsed-in-reverse-for-the-source-and-destination-ip/339269 "2023-07-26T07:53:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Keunwoo\_Lee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/keunwoo_lee/32/123886_2.png) [@Keunwoo\_Lee](https://discuss.elastic.co/u/Keunwoo_Lee)\
**Post date:** [July 26, 2023, 7:53am UTC](https://discuss.elastic.co/t/filebeat-asa-module-outbound-traffic-log-is-parsed-in-reverse-for-the-source-and-destination-ip/339269/1 "2023-07-26T07:53:42Z")

</div>

Hi.

I am collecting logs using the cisco asa module, and the outbound traffic log is parsed in reverse for the source and destination IP.

eg) DNS query traffic

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/f/1f9716397d8dc8c8cf31a9b61cf9381a18d40a15.png)

elasticsearch 8.8.1  
kibana 8.8.1  
filebeat 8.8.2

/modules.d/cisco.yml

```auto
- module: cisco
  asa:
    enabled: true

    var.syslog_host: 0.0.0.0
    #var.internal_zones: ["Internal"]
    #var.external_zones: ["External"]
    #var.timezone_offset: UTC

```

Any help please?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [July 26, 2023, 12:54pm UTC](https://discuss.elastic.co/t/filebeat-asa-module-outbound-traffic-log-is-parsed-in-reverse-for-the-source-and-destination-ip/339269/2 "2023-07-26T12:54:04Z")

</div>

You need to open an issue in the [beats repository](https://github.com/elastic/beats) as this needs to be fixed in the module itself.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 23, 2023, 2:54pm UTC](https://discuss.elastic.co/t/filebeat-asa-module-outbound-traffic-log-is-parsed-in-reverse-for-the-source-and-destination-ip/339269/3 "2023-08-23T14:54:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.