Filebeat CEF Module

[adrisr (Adrian Serrano)]

The syslog input is failing to parse the syslog header. We're seeing this problem a lot because Filebeat's syslog input is too strict and only supports BSD-style RFC3164 messages.

In your case it might be related to the date format that your CEF exporter is using. Do you have a config option to change it?

As an alternative, you can modify the module to use the udp input instead of the syslog input, which does no parsing. See this message:

Filebeat syslog parse error

I don't have an ASA Firewall to play with, but by looking at a manual I found online, it doesn't look like you can change the timestamp format. We have to update the syslog message parser to make it support more formats. In the mean time, I had some success by doing this change: diff --git a/x-pack/filebeat/module/cisco/asa/config/input.yml b/x-pack/filebeat/module/cisco/asa/config/input.yml index 32e87abc8..9d23b77f2 100644 --- a/x-pack/filebeat/module/cisco/asa/config/input.yml +++ b/x-pack/…

The file you need to change is module/cef/log/config/input.yml under /usr/share/filebeat/....