# Message "failed to find message" event.dataset "cisco.asa"

**URL:** <https://discuss.elastic.co/t/message-failed-to-find-message-event-dataset-cisco-asa/232690>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 14, 2020, 5:34pm UTC](https://discuss.elastic.co/t/message-failed-to-find-message-event-dataset-cisco-asa/232690 "2020-05-14T17:34:53Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![Adriann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adriann/32/77780_2.png) [@Adriann](https://discuss.elastic.co/u/Adriann)\
**Post date:** [May 18, 2020, 5:32pm UTC](https://discuss.elastic.co/t/message-failed-to-find-message-event-dataset-cisco-asa/232690/4 "2020-05-18T17:32:08Z")

</div>

After reading [this](https://discuss.elastic.co/t/problems-parsing-cisco-asa-logs-using-filebeat/195326/7) post I Issued "logging device-id hostname" command on the ASA devices.

Now I can see below messages in the "Logs" tab

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/7/a7ddfc3ab3591c02388d9256426a56a8afcc5acd.png)

I sarted to see Network events from Filebeat Cisco module in SIEM

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/0/d0382b545d195853e42112e79a1de3c4043e958e.png)

I also see that not all logs are passed correctly. Is this behavior a bug or I can help Filebeat by issuing some command on an ASA?

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/0/d0b563ee7e042de6bb240b6032170b700992b3fc.png)

I can see now some data in default dashboard

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/1/518fe0cc8e038444b39683140260d42126bef903.png)

Is it proper to have config like below or should i delete the paths for asa or ftd?

- module: cisco  
asa:  
enabled: true  
var.paths: ["/var/log/syslog/ASA1.log","/var/log/syslog/ASA2.log"]  
var.input: "file"

---

_[View the full topic](https://discuss.elastic.co/t/message-failed-to-find-message-event-dataset-cisco-asa/232690)._