# Filebeat CEF Module **URL:** https://discuss.elastic.co/t/filebeat-cef-module/206094 **Category:** Beats **Tags:** filebeat **Created:** [October 31, 2019, 7:49pm UTC](https://discuss.elastic.co/t/filebeat-cef-module/206094 "2019-10-31T19:49:19Z") **Posts on this page:** 1 **Showing post:** 3
### Author: ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr) #### Post date: [November 4, 2019, 9:59am UTC](https://discuss.elastic.co/t/filebeat-cef-module/206094/3 "2019-11-04T09:59:13Z")
The syslog input is failing to parse the syslog header. We're seeing this problem a lot because Filebeat's syslog input is too strict and only supports BSD-style RFC3164 messages. In your case it might be related to the date format that your CEF exporter is using. Do you have a config option to change it? As an alternative, you can modify the module to use the udp input instead of the syslog input, which does no parsing. See this message: > [@Filebeat syslog parse error](https://discuss.elastic.co/t/filebeat-syslog-parse-error/189643/9): > > I don't have an ASA Firewall to play with, but by looking at a manual I found online, it doesn't look like you can change the timestamp format. We have to update the syslog message parser to make it support more formats. In the mean time, I had some success by doing this change: diff --git a/x-pack/filebeat/module/cisco/asa/config/input.yml b/x-pack/filebeat/module/cisco/asa/config/input.yml index 32e87abc8..9d23b77f2 100644 --- a/x-pack/filebeat/module/cisco/asa/config/input.yml +++ b/x-pack/… The file you need to change is `module/cef/log/config/input.yml` under `/usr/share/filebeat/...`. --- _[View the full topic](https://discuss.elastic.co/t/filebeat-cef-module/206094)._