# Logstash 2.0 Cisco Asa - data does not appear in kibana **URL:** \ **Category:** Logstash\ **Created:** [November 2, 2015, 11:41pm UTC](https://discuss.elastic.co/t/logstash-2-0-cisco-asa-data-does-not-appear-in-kibana/33581 "2015-11-02T23:41:58Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![jdambly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jdambly/32/44286_2.png) [@jdambly](https://discuss.elastic.co/u/jdambly)\ **Post date:** [November 2, 2015, 11:41pm UTC](https://discuss.elastic.co/t/logstash-2-0-cisco-asa-data-does-not-appear-in-kibana/33581/1 "2015-11-02T23:41:58Z")
I'm using the following logtash config, and I can see it working on stdout, but nothing is show up in kibana/elastic search, I created an index called logstash\* but there seems to be nothing in it ``` input { tcp { port => 5000 type => syslog } udp { port => 5000 type => syslog } } filter { grok { match => ["message", "%{CISCO_TAGGED_SYSLOG} %{GREEDYDATA:cisco_message}"] } # Extract fields from the each of the detailed message types # The patterns provided below are included in core of LogStash 1.4.2. grok { match => [ "cisco_message", "%{CISCOFW106001}", "cisco_message", "%{CISCOFW106006_106007_106010}", "cisco_message", "%{CISCOFW106014}", "cisco_message", "%{CISCOFW106015}", "cisco_message", "%{CISCOFW106021}", "cisco_message", "%{CISCOFW106023}", "cisco_message", "%{CISCOFW106100}", "cisco_message", "%{CISCOFW110002}", "cisco_message", "%{CISCOFW302010}", "cisco_message", "%{CISCOFW302013_302014_302015_302016}", "cisco_message", "%{CISCOFW302020_302021}", "cisco_message", "%{CISCOFW305011}", "cisco_message", "%{CISCOFW313001_313004_313008}", "cisco_message", "%{CISCOFW313005}", "cisco_message", "%{CISCOFW402117}", "cisco_message", "%{CISCOFW402119}", "cisco_message", "%{CISCOFW419001}", "cisco_message", "%{CISCOFW419002}", "cisco_message", "%{CISCOFW500004}", "cisco_message", "%{CISCOFW602303_602304}", "cisco_message", "%{CISCOFW710001_710002_710003_710005_710006}", "cisco_message", "%{CISCOFW713172}", "cisco_message", "%{CISCOFW733100}" ] } # Parse the syslog severity and facility syslog_pri { } geoip { add_tag => ["GeoIP"] database => "/opt/logstash/databases/GeoLiteCity.dat" source => "src_ip" } if [geoip][city_name] == "" { mutate { remove_field => "[geoip][city_name]" } } if [geoip][continent_code] == "" { mutate { remove_field => "[geoip][continent_code]" } } if [geoip][country_code2] == "" { mutate { remove_field => "[geoip][country_code2]" } } if [geoip][country_code3] == "" { mutate { remove_field => "[geoip][country_code3]" } } if [geoip][country_name] == "" { mutate { remove_field => "[geoip][country_name]" } } if [geoip][latitude] == "" { mutate { remove_field => "[geoip][latitude]" } } if [geoip][longitude] == "" { mutate { remove_field => "[geoip][longitude]" } } if [geoip][postal_code] == "" { mutate { remove_field => "[geoip][postal_code]" } } if [geoip][region_name] == "" { mutate { remove_field => "[geoip][region_name]" } } if [geoip][time_zone] == "" { mutate { remove_field => "[geoip][time_zone]" } } # Gets the source IP whois information from the GeoIPASNum.dat flat file database geoip { add_tag => ["Whois"] database => "/opt/logstash/databases/GeoIPASNum.dat" source => "src_ip" } # Parse the date date { match => ["timestamp", "MMM dd HH:mm:ss", "MMM d HH:mm:ss", "MMM dd yyyy HH:mm:ss", "MMM d yyyy HH:mm:ss" ] } } output { stdout { codec => rubydebug } elasticsearch { hosts => ["10.1.1.17:9200"] } } ``` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 3, 2015, 6:25am UTC](https://discuss.elastic.co/t/logstash-2-0-cisco-asa-data-does-not-appear-in-kibana/33581/2 "2015-11-03T06:25:46Z")
What does `_cat/indices` show? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 3, 2015, 9:25am UTC](https://discuss.elastic.co/t/logstash-2-0-cisco-asa-data-does-not-appear-in-kibana/33581/3 "2015-11-03T09:25:49Z")
Are you getting anything to stdout? What if you disable the elasticsearch output? Is there anything in the Logstash logs? ---
**Author:** ![renevdm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/renevdm/32/5730_2.png) [@renevdm](https://discuss.elastic.co/u/renevdm)\ **Post date:** [November 3, 2015, 10:10am UTC](https://discuss.elastic.co/t/logstash-2-0-cisco-asa-data-does-not-appear-in-kibana/33581/4 "2015-11-03T10:10:26Z")
I had the same when using that config. I've been changing it over and over again for a day and now it works. See my blog post: [http://ict.renevdmark.nl/2015/10/22/cisco-asa-alerts-and-kibana/](http://ict.renevdmark.nl/2015/10/22/cisco-asa-alerts-and-kibana/) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 3, 2015, 10:11am UTC](https://discuss.elastic.co/t/logstash-2-0-cisco-asa-data-does-not-appear-in-kibana/33581/5 "2015-11-03T10:11:36Z")
> [@renevdm](#): > > [http://ict.renevdmark.nl/2015/10/22/cisco-asa-alerts-and-kibana/](http://ict.renevdmark.nl/2015/10/22/cisco-asa-alerts-and-kibana/) Nice post 🙂 ---
**Author:** ![jdambly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jdambly/32/44286_2.png) [@jdambly](https://discuss.elastic.co/u/jdambly)\ **Post date:** [November 3, 2015, 10:09pm UTC](https://discuss.elastic.co/t/logstash-2-0-cisco-asa-data-does-not-appear-in-kibana/33581/6 "2015-11-03T22:09:37Z")
ya I removed the date section and it start working, so I think that seems to be the issue, still not sure why tho, will keep playing with it. ---
**Author:** ![navox19](https://avatars.discourse-cdn.com/v4/letter/n/49beb7/32.png) [@navox19](https://discuss.elastic.co/u/navox19)\ **Post date:** [April 15, 2016, 10:19pm UTC](https://discuss.elastic.co/t/logstash-2-0-cisco-asa-data-does-not-appear-in-kibana/33581/7 "2016-04-15T22:19:07Z")
plz how to add this config to filebeat config at the same time plzz help mee plzz ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:02am UTC](https://discuss.elastic.co/t/logstash-2-0-cisco-asa-data-does-not-appear-in-kibana/33581/8 "2017-07-06T05:02:00Z")