Filebeat cisco module not parsing ASA logs

JayK · October 9, 2019, 3:45pm

Our ASA sends its logs to a server where they handled by rsyslog and placed in the necessary directories. FIlebeat, running on the same server, then sends them to Elasticsearch using the cisco module. It looks like everything is coming across correctly but Filebeat is not parsing the actual message part of the ASA log entry. So I will see all the fields that Filebeat adds and then at the end will be (IP and ports replaced with X's):

Oct 9 11:20:30 XX.XX.XX.X %ASA-6-305011: Built dynamic TCP translation from inside:XX.XX.XX.XX/XXXXX to outside:XXX.XXX.XX.XXX/XXXXX

I can't seem to figure out how to get it to work. Any help would be greatly appreciated.

system · November 6, 2019, 3:45pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Filebeat Cisco ASA Module failing to parse Beats filebeat	12	585	December 29, 2020
Need help with configuring cisco module in filebeat Beats beats-module , filebeat	4	2547	August 16, 2019
Syslog Input -> Cisco ASA not fully parsing Beats filebeat	1	592	September 27, 2019
Filebeat 7.2.0 - Cisco ASA module not parsing IPv6 correctly Beats	1	326	July 24, 2019
Filebeat Modules and Parsing, with Logstash - Cisco Related Beats beats-module , filebeat	6	1442	October 13, 2020

Filebeat cisco module not parsing ASA logs

Related topics