Configured filebeat 7.9 against ES/Kibana 7.9 and the netflow + cisco modules successfully and without errors, including during template generation.
However lots of SIEM dashboard remain unpopulated, in particular the "hosts" tab. Reading tells me it depends on host.name being in the documents. My index template contains it, but no document have that field set, even when forcefully adding the host preprocessor. Other host.*'s are populated, such as host.hostname - but they are populated with the hostname of the filebeat ingestor, not its source (an actual firewall sending syslog and netflow).
Looking at filebeat docs 6.8 vs 7.9 however:
7.9 does not show host.name as an exported field, whereas 6.8 does. I tried 6.8, but it does not contain the cisco module.
Docs were followed to the letter and even the getting started documentation for 7.9 seems to imply it should work out of the box with the provided example dashboards.
Edit: just noticed the placeholder in filebeat.yml to not attach host_preproc when tags contain "forwaded". Clearly its there for a reason. Commenting it out resulted in host.* entries but populated with the details of the filebeat server, not ip or hostname details of the log entry.
Is this functionality not expected to work without elastic agents on the machines? In this case, it's an ASA so I can't.