Filebeat + cisco module - listening on other than localhost

i have installed filebeat and enable cisco module
Cico module default configuration make filebeat listenning on localhost
I want it to listen on all interfaces
Below is what is written in cisco.yml ,

 # The interface to listen to UDP based syslog traffic. Defaults to
 # localhost. Set to to bind to all available interfaces.
 # var.syslog_host: localhost

so i just change like this and remove #


Then i stop/start filebeat

then flebeat listen only on ipv6 not on ipv4
udp 0 0* 32409/filebeat
udp6 0 0 :::9001 :::* 32409/filebeat
udp6 0 0 :::9003 :::* 32409/filebeat

how can i make filebeat listen on ipv4 ?

Did you resolve this issue? I seem to be having the same problem.

Yes i have resolved. When listen on udp6 it also reply on udp IPV4. It is magic !
No seriously, i have read an article which explain that when listen on ipv6 but receiving an ipv4 , the server has a mechanisme that encapsulate the request in IPV6. And can reply in IPv4.
It is not only for filebeat but for many application.
So on my side it works fine

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.