We are using the filebeat cisco asa module in filebeat to parse the data from cisco asa firewalls. One issues we noticed is the source IP and destination IP are actually showing as reversed when its parsed.
Filebeat Version 7.9.0 with cisco module enabled. Elasticsearch Version 7.9.0
Tried with Elasticsearch Version 7.10.1 also , its the same issue.
I tried a telnet to public IP 126.96.36.199 on port 22 from our internal server 10.192.xxxxx
Now if i lookup in discovery for destination.ip : 188.8.131.52 or destination.address : 184.108.40.206 . it returns nothing.
But it i check the same IP as source.ip : 220.127.116.11 or source.address : 18.104.22.168 it gives me the output.
Please check the attached screenshot