# Filebeat module cef syslog parse errors

**URL:** <https://discuss.elastic.co/t/filebeat-module-cef-syslog-parse-errors/220148>\
**Category:** Beats\
**Tags:** beats-module, filebeat\
**Created:** [February 20, 2020, 9:48am UTC](https://discuss.elastic.co/t/filebeat-module-cef-syslog-parse-errors/220148 "2020-02-20T09:48:02Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![daniel\_a](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_a/32/48390_2.png) [@daniel\_a](https://discuss.elastic.co/u/daniel_a)\
**Post date:** [February 20, 2020, 4:38pm UTC](https://discuss.elastic.co/t/filebeat-module-cef-syslog-parse-errors/220148/3 "2020-02-20T16:38:11Z")

</div>

I've seen that before here: [Filebeat CEF Module](https://discuss.elastic.co/t/filebeat-cef-module/206094/3). You'd need to change your input from syslog to udp, the file you need to change is `module/cef/log/config/input.yml` under `/usr/share/filebeat/...` .

---

_[View the full topic](https://discuss.elastic.co/t/filebeat-module-cef-syslog-parse-errors/220148)._