Filebeat + cisco module - listening on other than localhost

Elastic Stack Beats
,
1

Hello,
i have installed filebeat and enable cisco module
Cico module default configuration make filebeat listenning on localhost 127.0.0.1
I want it to listen on all interfaces 0.0.0.0.
Below is what is written in cisco.yml ,

 # The interface to listen to UDP based syslog traffic. Defaults to
 # localhost. Set to 0.0.0.0 to bind to all available interfaces.
 # var.syslog_host: localhost

so i just change like this and remove #

var.syslog_host: 0.0.0.0

Then i stop/start filebeat

then flebeat listen only on ipv6 not on ipv4
udp 0 0 127.0.0.1:9002 0.0.0.0:* 32409/filebeat
udp6 0 0 :::9001 :::* 32409/filebeat
udp6 0 0 :::9003 :::* 32409/filebeat

how can i make filebeat listen on ipv4 ?

2

Did you resolve this issue? I seem to be having the same problem.

3

Yes i have resolved. When listen on udp6 it also reply on udp IPV4. It is magic !
No seriously, i have read an article which explain that when listen on ipv6 but receiving an ipv4 , the server has a mechanisme that encapsulate the request in IPV6. And can reply in IPv4.
It is not only for filebeat but for many application.
So on my side it works fine

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.