Filebeat is giving errors while parsing syslog messages from ASA. ERROR [syslog] syslog/input.go:132 can't parse event as syslog rfc3164 {"message": "<165>:Jul 10 07:10:12 IST: %ASA-config-5-111010: User 'XXXXX', running 'N/A' from IP 172.x.x.x, executed 'write memory'\n"} can someone help?

I don't have an ASA Firewall to play with, but by looking at a manual I found online, it doesn't look like you can change the timestamp format. We have to update the syslog message parser to make it support more formats. In the mean time, I had some success by doing this change: diff --git a/x-pac…

Discuss the Elastic Stack

Filebeat syslog parse error

Elastic Stack Beats

mancharagopan (Mancharagopan) July 12, 2019, 3:44pm 8

What format do you suggest?

Topic		Replies	Views
Sending syslog to FileBeat from Cisco Asa Beats filebeat	4	2961	July 17, 2019
Can't parse event as syslog rfc3164 Beats filebeat	2	4426	January 31, 2020
Syslog Input -> Cisco ASA not fully parsing Beats filebeat	1	627	September 27, 2019
Problems parsing Cisco ASA logs using filebeat Beats filebeat	9	3374	October 2, 2019
Filebeat Cannot Parse Syslog File from Aerohive Beats filebeat	3	716	September 18, 2019

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Filebeat syslog parse error

Related topics