# Where I install filebeat, if I want Cisco ASA log

**URL:** <https://discuss.elastic.co/t/where-i-install-filebeat-if-i-want-cisco-asa-log/201942>\
**Category:** Beats\
**Created:** [October 2, 2019, 11:12am UTC](https://discuss.elastic.co/t/where-i-install-filebeat-if-i-want-cisco-asa-log/201942 "2019-10-02T11:12:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![lokmanopt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lokmanopt/32/54640_2.png) [@lokmanopt](https://discuss.elastic.co/u/lokmanopt)\
**Post date:** [October 2, 2019, 11:12am UTC](https://discuss.elastic.co/t/where-i-install-filebeat-if-i-want-cisco-asa-log/201942/1 "2019-10-02T11:12:07Z")

</div>

Dear Experts,  
I can't understand where I can install filebeat if I want to Cisco ASA log or Cisco router log.

Please need help filebeat experts.

Regards  
Lokman Hakim

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [October 2, 2019, 12:40pm UTC](https://discuss.elastic.co/t/where-i-install-filebeat-if-i-want-cisco-asa-log/201942/2 "2019-10-02T12:40:09Z")

</div>

Here, Cisco logs are sent from the appliances using syslog protocol. In the routers of my somewhat dated experience, you can't install anything on them directly.

Their syslog is directed to some "listener", [filebeat doc](https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-input-syslog.html) says it can do it, but we use [logstash](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-syslog.html).

Our design is basically: syslog emitters --\> load balancer --\> logstash -\> elasticsearch

There is little HA in syslog, if you want more reliable logs, you need to make the syslog listener more reliable somehow. We use multiple logstash listeners behind a network loadbalancer and logstash persistant queues.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 30, 2019, 2:40pm UTC](https://discuss.elastic.co/t/where-i-install-filebeat-if-i-want-cisco-asa-log/201942/3 "2019-10-30T14:40:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.