Filebeat - Cisco ASA Module rejected messages

[nicpalmer]

Elasticsearch is refusing to index certain documents that ASA's may generate.

elasticsearch___Could not index event to Elasticsearch. status: 400, action: ["index", {:_id=>nil, :_index=>"filebeat-7.3.2-2019.10.04", :_type=>"_doc", :routing=>nil, :pipeline=>"filebeat-7.3.2-cisco-asa-pipeline"}, #<LogStash::Event:0x5134782c>], response: {"index"=>{"_index"=>"filebeat-7.3.2-2019.10.04", "_type"=>"_doc", "_id"=>"aiksl20BYcEPgcTtSR2M", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [source.ip] of type [ip] in document with id 'aiksl20BYcEPgcTtSR2M'. Preview of field's value: 'ABRDH-BR01-JL01-V304-70.80.42.149'", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"'ABRDH-BR01-JL01-V304-70.80.42.149' is not an IP string literal."}}}}

The raw message is here:

<165>Oct 04 2019 15:27:55: %ASA-5-106100: access-list AL-DMZ-LB-IN denied tcp LB-DMZ/ABRDH-BR01-JL01-V304-70.80.42.149(27218) -> OUTSIDE/195.122.12.242(53) hit-cnt 1 first hit [0x16847359, 0x00000000]

The reason for this happening I believe is due to the parsing rule for 106100.

- dissect:
     if: "ctx._temp_.cisco.message_id == '106100'"
     field: "message"
     pattern: "access-list %{_temp_.cisco.list_id} %{event.outcome} %{network.transport} %{_temp_.cisco.source_interface}/%{source.ip}(%{source.port}) -> %{_temp_.cisco.destination_interface}/%{destination.ip}(%{destination.port}) %{}"

I wonder if we can add an option to capture the name field to the dissect message?

[HaZet1968]

Same here for field [source.nat.ip]. Filebeat Version 7.5.2

[2020-01-29T10:03:33,635][WARN ][logstash.outputs.elasticsearch][beats] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"filebeat-7.5.2-2020.01.29", :routing=>nil, :_type=>"_doc", :pipeline=>"filebeat-7.5.2-cisco-asa-asa-ftd-pipeline"}, #<LogStash::Event:0x479fcb69>], :response=>{"index"=>{"_index"=>"filebeat-7.5.2-2020.01.29", "_type"=>"_doc", "_id"=>"RreK8G8BWYzewJIFnCTn", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [source.nat.ip] of type [ip] in document with id 'RreK8G8BWYzewJIFnCTn'. Preview of field's value: 'SDC'", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"'SDC' is not an IP string literal."}}}}}

[HaZet1968]

Anything new here? Still waiting for a fix. Currently using Version 7.6.2