# Problems parsing Cisco ASA logs using filebeat

**URL:** <https://discuss.elastic.co/t/problems-parsing-cisco-asa-logs-using-filebeat/195326>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 15, 2019, 10:08am UTC](https://discuss.elastic.co/t/problems-parsing-cisco-asa-logs-using-filebeat/195326 "2019-08-15T10:08:33Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![candlerb](https://avatars.discourse-cdn.com/v4/letter/c/c5a1d2/32.png) [@candlerb](https://discuss.elastic.co/u/candlerb)\
**Post date:** [August 15, 2019, 11:23am UTC](https://discuss.elastic.co/t/problems-parsing-cisco-asa-logs-using-filebeat/195326/3 "2019-08-15T11:23:25Z")

</div>

I think I solved it.

The ASA "module" in filebeat writes this [ingest pipeline](https://github.com/elastic/beats/blob/master/x-pack/filebeat/module/cisco/asa/ingest/pipeline.yml) to Elasticsearch. That uses the [grok processor](https://www.elastic.co/guide/en/elasticsearch/reference/master/grok-processor.html) along with the [date processor](https://www.elastic.co/guide/en/elasticsearch/reference/master/date-processor.html) to handle a range of date formats, together with the [dissect processor](https://www.elastic.co/guide/en/elasticsearch/reference/master/dissect-processor.html) to match various log lines and parse fields out of them.

All this means that messages are only parsed if and when they are written into Elasticsearch.

---

_[View the full topic](https://discuss.elastic.co/t/problems-parsing-cisco-asa-logs-using-filebeat/195326)._