I'm trying to send and parse data using the filebeat cisco module. We're getting the data to filebeat via syslog on an UDP port/ The data gets to elasticsearch, but the message field isn't parsed into the cisco module data (no cisco.* fields are present). This is the error message in the document's error.message field, with IPs redacted:
Provided Grok expressions do not match field value: [Built inbound TCP connection 9999999999 for ZONE-NAME:10.99.120.19/48903 (10.99.120.19/48903) to ZONE-NAME2:10.99.140.18/4005 (10.99.140.18/4005)]
And here's a typical unformatted syslog entry:
<166>Jul 19 2019 02:59:35: %ASA-6-302020: Built outbound ICMP connection for faddr 10.99.140.18/0 gaddr 10.99.140.18/55627 laddr 10.99.146.22/55627
Any idea why this might be happening or what we're doing wrong?