# Filebeat Module won't process incomming syslogs **URL:** \ **Category:** Beats\ **Tags:** beats-module, filebeat\ **Created:** [August 18, 2020, 2:16pm UTC](https://discuss.elastic.co/t/filebeat-module-wont-process-incomming-syslogs/245442 "2020-08-18T14:16:29Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Moritz\_Kiesewetter](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moritz_kiesewetter/32/51243_2.png) [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\ **Post date:** [August 18, 2020, 2:16pm UTC](https://discuss.elastic.co/t/filebeat-module-wont-process-incomming-syslogs/245442/1 "2020-08-18T14:16:29Z")
Hi guys, so i i'm using filebeat modules (asa,cisco,fortinet and palo alto) to parse the syslogs of different firewalls. Everything is working fine, expect for the pan module: I enabled the module - and configured the module file in /etc/filebeat/modules.d/ After that i checked if the Port is open: > udp 0 0 X.X.X.X:9004 0.0.0.0:\* 22401/filebeat So that's also working fine - if i check the port via tcpdump - i can see the PaloAlto Firewall sending packets to this port: > 16:08:25.769682 IP X.X.X.X.51664 \> my.server.com.9004: UDP, length 462 > 16:08:25.826543 IP X.X.X.X.51664 \> my.server.com.9004: UDP, length 462 it does so every few miliseconds. So there is something coming in through this port! But i cannot see any data in my Kibana - the firewall sent logs until 31st of July just fine - but since then there's nothing. The Palo Alto is using the Default Syslog-Format - not LEEF I cannot see any errors in the filebeat logs. I checked the firewall rule enabling the PaloAlto to send towards the ELK-Stack - it manages about 5-10gbit in one hour. I also checked for an ingestpipeline for PaloAlto - it is there - i also redid the Setup of Filebeat. I just don't know what i can do anymore - anything else works just fine. I'm using version 7.8 in ES aswell as in Filebeat and Kibana - running on a CentOS 7 Cluster ---
**Author:** ![Moritz\_Kiesewetter](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moritz_kiesewetter/32/51243_2.png) [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\ **Post date:** [August 19, 2020, 6:47am UTC](https://discuss.elastic.co/t/filebeat-module-wont-process-incomming-syslogs/245442/2 "2020-08-19T06:47:47Z")
I've run Filebeat with > filebeat -e -d "\*" and checked the logs - i saw an Event stating > Cannot index event publisher.Event: "caused\_by":{"type":"date\_time\_parse\_exception","reason":"Text '2020-08-19T08:38:42.000+02:00' could not be parsed at index 4"} What can i do? ---
**Author:** ![Moritz\_Kiesewetter](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moritz_kiesewetter/32/51243_2.png) [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\ **Post date:** [August 19, 2020, 7:27am UTC](https://discuss.elastic.co/t/filebeat-module-wont-process-incomming-syslogs/245442/3 "2020-08-19T07:27:17Z")
I've now changed the Date-Format of the Field to `yyyy-MM-dd'T'HH:mm:ss.SSSZ`, even tho i feared it would trouble my ASA & Fortinet Module - i do not see any parsing errors in the filebeat log. Afterwards i restarted the services - but i still get this error message: > failed to parse field [event.created] of type [date] in document with id 'ykmhBXQBSiPY17LNhR8m'. Preview of field's value: '2020-08-19T09:31:38.000+02:00'","caused\_by":{"type":"illegal\_argument\_exception","reason":"failed to parse date field [2020-08-19T09:31:38.000+02:00] with format [yyyy/mm/dd HH:mm:ss]","caused\_by":{"type":"date\_time\_parse\_exception","reason":"Text '2020-08-19T09:31:38.000+02:00' could not be parsed at index 4"}}} Why is it still using the old format to parse this? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 16, 2020, 9:27am UTC](https://discuss.elastic.co/t/filebeat-module-wont-process-incomming-syslogs/245442/4 "2020-09-16T09:27:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.