Im using the cef module in filebeat to receive cef events from a ArcSight SmartConnector. The SmartConnector is configured for Port 5001 Protocol UDP and CEF Version 0.1. On the Filebeat side I receive on port 5001 and using the cef module. For come cef events comming over there is no issues, but…

Filebeat module cef syslog parse errors

daniel_a (daniel_aug) February 20, 2020, 4:38pm 3

I've seen that before here: Filebeat CEF Module. You'd need to change your input from syslog to udp, the file you need to change is module/cef/log/config/input.yml under /usr/share/filebeat/... .

Topic		Replies	Views
Filebeat CEF Checkpoint errors Beats beats-module , filebeat	6	1009	August 5, 2021
Filebeat CEF module can't parse event as syslog rfc3164 Beats filebeat	3	1733	April 30, 2020
Filebeat CEF Module Beats filebeat	9	2153	December 3, 2019
Filebeat Fortinet module - can't parse event as syslog rfc3164 Beats filebeat	2	715	April 12, 2022
Can't parse event as syslog rfc3164 Beats filebeat	5	347	March 4, 2024

Filebeat module cef syslog parse errors

Related topics