# Need help with configuring cisco module in filebeat

**URL:** <https://discuss.elastic.co/t/need-help-with-configuring-cisco-module-in-filebeat/189596>\
**Category:** Beats\
**Tags:** beats-module, filebeat\
**Created:** [July 9, 2019, 4:22pm UTC](https://discuss.elastic.co/t/need-help-with-configuring-cisco-module-in-filebeat/189596 "2019-07-09T16:22:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mancharagopan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mancharagopan/32/60266_2.png) [@mancharagopan](https://discuss.elastic.co/u/mancharagopan)\
**Post date:** [July 9, 2019, 4:22pm UTC](https://discuss.elastic.co/t/need-help-with-configuring-cisco-module-in-filebeat/189596/1 "2019-07-09T16:22:50Z")

</div>

I am planning to use cisco module in filebeat to ship syslog messages from cisco ASA Firewall to Elasticsearch through Logstash.

So far, I installed Filebeat on a windows 7 machine and enabled cisco module. I enabled security in elasticsearch.

Filebeat not receiving any syslog message.

Can somebody tell me what do next?

---

<div class="post-metadata">

**Author:** ![mancharagopan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mancharagopan/32/60266_2.png) [@mancharagopan](https://discuss.elastic.co/u/mancharagopan)\
**Post date:** [July 10, 2019, 1:09am UTC](https://discuss.elastic.co/t/need-help-with-configuring-cisco-module-in-filebeat/189596/2 "2019-07-10T01:09:25Z")

</div>

OK! I managed to get the logs shipped to elasticsearch through logstash. But the logs are not showing the Firewall details except the message. SIEM app not detecting any success or failed login events. What do i do? what fields i need to parse?

---

<div class="post-metadata">

**Author:** ![mancharagopan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mancharagopan/32/60266_2.png) [@mancharagopan](https://discuss.elastic.co/u/mancharagopan)\
**Post date:** [July 12, 2019, 6:15am UTC](https://discuss.elastic.co/t/need-help-with-configuring-cisco-module-in-filebeat/189596/3 "2019-07-12T06:15:46Z")

</div>

I believe this issue happening because filebeat failed to parse syslog message from the firewall.  
`syslog/input.go:132 can't parse event as syslog rfc3164 {"message": "<166>hostname-FW %ASA-6-113012: AAA user authentication Successful : local database : user = user1\n"}`

Can anyone help?

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [July 19, 2019, 7:52am UTC](https://discuss.elastic.co/t/need-help-with-configuring-cisco-module-in-filebeat/189596/4 "2019-07-19T07:52:32Z")

</div>

Hi @mancharagopan,

Logs parsing for iptables module is done in Elasticsearch ingest nodes, if you are using logstash you may need some extra setup so Elasticsearch knows what pipeline to apply. You can find more information about this here: [https://www.elastic.co/guide/en/logstash/7.2/filebeat-modules.html](https://www.elastic.co/guide/en/logstash/7.2/filebeat-modules.html)

Why do you need Logstash in this scenario? You can also consider sending the logs directly from Filebeat to Elasticsearch so the setup is easier.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 16, 2019, 7:52am UTC](https://discuss.elastic.co/t/need-help-with-configuring-cisco-module-in-filebeat/189596/5 "2019-08-16T07:52:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.