# Problems parsing Cisco ASA logs using filebeat

**URL:** <https://discuss.elastic.co/t/problems-parsing-cisco-asa-logs-using-filebeat/195326>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 15, 2019, 10:08am UTC](https://discuss.elastic.co/t/problems-parsing-cisco-asa-logs-using-filebeat/195326 "2019-08-15T10:08:33Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![candlerb](https://avatars.discourse-cdn.com/v4/letter/c/c5a1d2/32.png) [@candlerb](https://discuss.elastic.co/u/candlerb)\
**Post date:** [August 29, 2019, 12:13pm UTC](https://discuss.elastic.co/t/problems-parsing-cisco-asa-logs-using-filebeat/195326/7 "2019-08-29T12:13:09Z")

</div>

Like I said I haven't built this myself. I suggest you look at:

- the raw packets coming into filebeat (tcpdump is good for this)
- the HTTP requests being written into elasticsearch (tcpdump is also helpful here, unless you've enabled SSL encryption). Check they invoke the pipeline.
- the documents after they are stored in elasticsearch
- the functioning of the ingest pipeline - see [https://www.elastic.co/guide/en/elasticsearch/reference/master/simulate-pipeline-api.html](https://www.elastic.co/guide/en/elasticsearch/reference/master/simulate-pipeline-api.html)

Then you can work out where the problem is.

---

_[View the full topic](https://discuss.elastic.co/t/problems-parsing-cisco-asa-logs-using-filebeat/195326)._