# Filebeat Cisco Module Trouble
**URL:** https://discuss.elastic.co/t/filebeat-cisco-module-trouble/248028
**Category:** Beats
**Tags:** filebeat
**Created:** [September 9, 2020, 2:34pm UTC](https://discuss.elastic.co/t/filebeat-cisco-module-trouble/248028 "2020-09-09T14:34:06Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@aparkinson\_merrimac](https://discuss.elastic.co/u/aparkinson_merrimac)
#### Post date: [September 9, 2020, 2:34pm UTC](https://discuss.elastic.co/t/filebeat-cisco-module-trouble/248028/1 "2020-09-09T14:34:06Z")
I am struggling to get the filebeat cisco module to report correctly. The pipeline appears to be broken, but I am not proficient enough to discover the problem. What can I provide other than the below to assist in discovering the issue?
Log example -
Sep 9 06:22:25 ms3elastic filebeat[5140]: 2020-09-09T06:22:25.858Z#011WARN#011[elasticsearch]#011elasticsearch/client.go:407#011Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xbfce3b082d5807c5, ext:21167714728650, loc:(\*time.Location)(0x607c540)}, Meta:{"pipeline":"filebeat-7.9.1-cisco-asa-asa-ftd-pipeline","truncated":false}, Fields:{"agent":{"ephemeral\_id":"517ed516-69ba-4241-a172-f874cba40bea","hostname":"ms3elastic","id":"9b1a3f57-461f-48d6-be16-5db97d14830a","name":"ms3elastic","type":"filebeat","version":"7.9.1"},"ecs":{"version":"1.5.0"},"event":{"dataset":"cisco.asa","module":"cisco","timezone":"+00:00"},"fileset":{"name":"asa"},"input":{"type":"udp"},"log":{"source":{"address":"10.254.254.1:514"}},"message":"\u003c190\u003eSep 09 2020 01:22:24: %ASA-6-302015: Built inbound UDP connection 255031023 for Outside:10.254.1.11/56156 (10.254.1.11/56156)(LOCAL\Elastic\_Svc) to Inside:10.3.150.22/53 (10.3.150.22/53) (Elastic\_Svc)\n","service":{"type":"cisco"},"tags":["cisco-asa","forwarded"]}, Private:interface {}(nil), TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper\_parsing\_exception","reason":"failed to parse field [source.nat.port] of type [long] in document with id 'u\_2HcXQBYdSUCx4jmCgd'. Preview of field's value: '56156)(LOCAL\\Elastic\_Svc'","caused\_by":{"type":"illegal\_argument\_exception","reason":"For input string: "56156)(LOCAL\\Elastic\_Svc""}}
filebeat.yml
filebeat.inputs:
- type: log
enabled: false
paths:
- /var/log/_.log
filebeat.config.modules:
path: ${path.config}/modules.d/_.yml
setup.template.settings:
index.number\_of\_shards: 1
cloud.id: "merrimac-internal:XXXXXXXXXX"
cloud.auth: "elastic:XXXXXXXXX"
processors:
- add\_host\_metadata:
when.not.contains.tags: forwarded
- add\_cloud\_metadata: ~
- add\_docker\_metadata: ~
- add\_kubernetes\_metadata: ~
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 7, 2020, 4:34pm UTC](https://discuss.elastic.co/t/filebeat-cisco-module-trouble/248028/2 "2020-10-07T16:34:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.