I have configured the Cisco module to listen on 0.0.0.0 UDP/514.
If I use echo and netcat to send a message from localhost, I can see it come in (on loopback) with tcpdump, and filebeat parses the message successfully.
If I use the same command on a remote server, I can see it come in (on eth0) with tcpdump but filebeat does not parse the message.
Netstat shows there is a listener on UDP 514 (i.e. syslog), but only udp6. Could this be why the messages are not being parsed by filebeat when coming in on eth0?
netstat -lu output:
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
udp 0 0 127.0.0.53:domain 0.0.0.0:*
udp 0 0 0.0.0.0:snmp 0.0.0.0:*
udp 0 0 0.0.0.0:hostmon 0.0.0.0:*
udp6 0 0 [::]:syslog [::]:*
udp6 0 0 [::]:hostmon [::]:*