# Filebeat Cisco Module and IOS fields not showing up as documented
**URL:** https://discuss.elastic.co/t/filebeat-cisco-module-and-ios-fields-not-showing-up-as-documented/298857
**Category:** Beats
**Tags:** beats-module, filebeat
**Created:** [March 4, 2022, 3:44pm UTC](https://discuss.elastic.co/t/filebeat-cisco-module-and-ios-fields-not-showing-up-as-documented/298857 "2022-03-04T15:44:08Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@ulysse31](https://discuss.elastic.co/u/ulysse31)
#### Post date: [March 4, 2022, 3:44pm UTC](https://discuss.elastic.co/t/filebeat-cisco-module-and-ios-fields-not-showing-up-as-documented/298857/1 "2022-03-04T15:44:09Z")
Hi all,
I just started the logging of the syslog data sent by my cisco IOS switches into elastic (with filebeat 7.17.0 and Elasticsearch 7.17.0).
I setup a filebeat with "usual config" like:
```auto
ios:
enabled: true
var.syslog_host: xx.xx.xx.xx
var.syslog_port: 9002
```
and ... I was surprised that no rsa.\* fields were created by filebeat from the logs sent.
In Fact, I have "basic" fields, but no rsa.\* at all, the only field in which I get the device ip is "log.source.address", but it contains the ip with the source port ... (xx.xx.xx.xx:yyyyy) which is ... not really convinient ...
I tried to add "vars.keep\_raw\_fields: true" inside the ios section ... but it didn't change the output ...
If someone as an idea on why the documented rsa.\* field do not appear, it would help me a lot ^^'
Thanks all,
Cheers,
--
---
### Author:  [@ulysse31](https://discuss.elastic.co/u/ulysse31)
#### Post date: [March 31, 2022, 10:26am UTC](https://discuss.elastic.co/t/filebeat-cisco-module-and-ios-fields-not-showing-up-as-documented/298857/2 "2022-03-31T10:26:36Z")
Hi all,
No one that has experienced filebeat cisco module ? ^^"
Thanks a lot,
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 28, 2022, 12:27pm UTC](https://discuss.elastic.co/t/filebeat-cisco-module-and-ios-fields-not-showing-up-as-documented/298857/3 "2022-04-28T12:27:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.