# Parse error for cisco asa logs in filebeat module **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [July 18, 2019, 6:01pm UTC](https://discuss.elastic.co/t/parse-error-for-cisco-asa-logs-in-filebeat-module/191264 "2019-07-18T18:01:38Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![alexb145](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexb145/32/46158_2.png) [@alexb145](https://discuss.elastic.co/u/alexb145)\ **Post date:** [July 18, 2019, 6:01pm UTC](https://discuss.elastic.co/t/parse-error-for-cisco-asa-logs-in-filebeat-module/191264/1 "2019-07-18T18:01:38Z")
I'm trying to send and parse data using the filebeat cisco module. We're getting the data to filebeat via syslog on an UDP port/ The data gets to elasticsearch, but the message field isn't parsed into the cisco module data (no cisco.\* fields are present). This is the error message in the document's error.message field, with IPs redacted: `Provided Grok expressions do not match field value: [Built inbound TCP connection 9999999999 for ZONE-NAME:10.99.120.19/48903 (10.99.120.19/48903) to ZONE-NAME2:10.99.140.18/4005 (10.99.140.18/4005)]` And here's a typical unformatted syslog entry: `<166>Jul 19 2019 02:59:35: %ASA-6-302020: Built outbound ICMP connection for faddr 10.99.140.18/0 gaddr 10.99.140.18/55627 laddr 10.99.146.22/55627` Any idea why this might be happening or what we're doing wrong? ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [July 18, 2019, 8:02pm UTC](https://discuss.elastic.co/t/parse-error-for-cisco-asa-logs-in-filebeat-module/191264/2 "2019-07-18T20:02:27Z")
There's a problem with the syslog format used, it's not rfc3164 compliant. We need to find an alternative to this as many Cisco devices are failing because of that. The problem is with the date format used (syslog rfc3164 doesn't include a year). Is there a configuration setting in your device where you can select a different date format? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 15, 2019, 8:02pm UTC](https://discuss.elastic.co/t/parse-error-for-cisco-asa-logs-in-filebeat-module/191264/3 "2019-08-15T20:02:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.