# Filebeat Cisco Module Nexus dissect\_parsing\_error

**URL:** https://discuss.elastic.co/t/filebeat-cisco-module-nexus-dissect-parsing-error/265662
**Category:** Beats
**Tags:** beats-module, filebeat
**Created:** [February 26, 2021, 8:14pm UTC](https://discuss.elastic.co/t/filebeat-cisco-module-nexus-dissect-parsing-error/265662 "2021-02-26T20:14:39Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![vqjanderson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vqjanderson/32/84630_2.png) [@vqjanderson](https://discuss.elastic.co/u/vqjanderson)
#### Post date: [February 26, 2021, 8:14pm UTC](https://discuss.elastic.co/t/filebeat-cisco-module-nexus-dissect-parsing-error/265662/1 "2021-02-26T20:14:39Z")

</div>

Not sure why these logs are not being parsed correctly. Are the optimized access logging logs not supported by the module?

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/d/6d2703cf64a0f6ac50a784f38f8f81ef968dcfce.png)

---

<div class="post-metadata">

### Author: ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)
#### Post date: [March 1, 2021, 9:39am UTC](https://discuss.elastic.co/t/filebeat-cisco-module-nexus-dissect-parsing-error/265662/2 "2021-03-01T09:39:47Z")

</div>

Please share more details about the issue like configuration you're using, stack version, use case.

---

<div class="post-metadata">

### Author: ![vqjanderson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vqjanderson/32/84630_2.png) [@vqjanderson](https://discuss.elastic.co/u/vqjanderson)
#### Post date: [March 2, 2021, 3:13pm UTC](https://discuss.elastic.co/t/filebeat-cisco-module-nexus-dissect-parsing-error/265662/3 "2021-03-02T15:13:41Z")

</div>

Stack version is 7.11.0  
The filebeat cisco module is configure as follows, basically the default

```auto
nexus:
  enabled: true
  var.syslog_host: <ip address>
  var.syslog_port: <port>

```

The cisco nexus devices have the following configuration

```auto
logging level acllog 5
logging server <ip address> 5 port <port> use-vrf default facility syslog
logging origin-id hostname
logging ip access-list cache entries 8000
logging ip access-list cache interval 300
logging ip access-list cache threshold 0

```

I believe it is intended to parse these out into fields such as src\_ip, dst\_ip, src\_port, dst\_port, etc. I would like to be able to use this info in dashboards to breakdown by the traffic that is being blocked. Then I can search by IP and see if certain traffic is being blocked by these ACLs.

---

<div class="post-metadata">

### Author: ![vqjanderson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vqjanderson/32/84630_2.png) [@vqjanderson](https://discuss.elastic.co/u/vqjanderson)
#### Post date: [March 30, 2021, 4:31pm UTC](https://discuss.elastic.co/t/filebeat-cisco-module-nexus-dissect-parsing-error/265662/4 "2021-03-30T16:31:29Z")

</div>

I updated to version 7.12 and am seeing the same behavior.

---

<div class="post-metadata">

### Author: ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [April 8, 2021, 2:08am UTC](https://discuss.elastic.co/t/filebeat-cisco-module-nexus-dissect-parsing-error/265662/5 "2021-04-08T02:08:46Z")

</div>

It's possible that the format of the logs isn't matching the patterns currently in the module. Take a look here, [https://www.github.com/elastic/beats/tree/master/x-pack%2Ffilebeat%2Fmodule%2Fcisco%2Fnexus%2Fconfig](https://www.github.com/elastic/beats/tree/master/x-pack%2Ffilebeat%2Fmodule%2Fcisco%2Fnexus%2Fconfig)

---

<div class="post-metadata">

### Author: ![vqjanderson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vqjanderson/32/84630_2.png) [@vqjanderson](https://discuss.elastic.co/u/vqjanderson)
#### Post date: [April 8, 2021, 2:15pm UTC](https://discuss.elastic.co/t/filebeat-cisco-module-nexus-dissect-parsing-error/265662/6 "2021-04-08T14:15:26Z")

</div>

It looks like it should match on line 140 of the pipeline.js

```auto
var dup59 = match("MESSAGE#186:ACLLOG_FLOW_INTERVAL/12", "nwparser.p0", "\"%{protocol}\"(%{protocol_detail}),%{space->} Hit-count = %{dclass_counter1}");

```

Here is an example of an original event that should match but is flagging as dissect\_parsing\_error

```auto
<45>DeviceName: 2021 Apr 8 09:02:58 CDT: %ACLLOG-5-ACLLOG_FLOW_INTERVAL: Src IP: 1.1.1.1, Dst IP: 2.2.2.2, Src Port: 0, Dst Port: 0, Src Intf: Ethernet1/15, Protocol: "ICMP"(1), Hit-count = 4

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 6, 2021, 4:15pm UTC](https://discuss.elastic.co/t/filebeat-cisco-module-nexus-dissect-parsing-error/265662/7 "2021-05-06T16:15:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.