Single syslog input to multiple indices output

Conditionals work fine within an output block so it's not clear what the problem is. I found two weird things though:

else if [program] == "%ASA*" {

Is the program field literally "%ASA*"? Or are you trying to use * as a wildcard character?

index => "firewall-"

Do you really want to store the events in an index named, literally, "firewall-"?