From 3ddfd1f063567b18e1e6b057e5c2959794788e11 Mon Sep 17 00:00:00 2001 From: Andrew Kroh Date: Thu, 10 Feb 2022 00:51:01 -0500 Subject: [PATCH] [Filebeat] Fix Cisco ASA/FTD configs that used var.input syslog (#30072) #26159 accidentally introduced a breaking change for existing users of Cisco ASA and FTD that specified `var.input: syslog`. `syslog` was effectively an alias for the UDP input and the alias support was removed. This change allows `var.input: syslog` to continue working as it did before. --- CHANGELOG.next.asciidoc | 7 +------ x-pack/filebeat/module/cisco/asa/config/input.yml | 4 ++++ x-pack/filebeat/module/cisco/ftd/config/input.yml | 4 ++++ 3 files changed, 9 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 6d1f1df87c5..2b983eb7e8e 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -49,17 +49,12 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...main[Check the HEAD dif - tcp/unix input: Stop accepting connections after socket is closed. {pull}29712[29712] - Fix using log_group_name_prefix in aws-cloudwatch input. {pull}29695[29695] - aws-s3: fix race condition in states used by s3-poller. {issue}30123[30123] {pull}30131[30131] +- cisco module: Fix change the broke ASA and FTD configs that used `var.input: syslog`. {pull}30072[30072] - Fix broken Kafka input {issue}29746[29746] {pull}30277[30277] -*Heartbeat* - - -*Filebeat* - *Heartbeat* - *Metricbeat* - Enhance metricbeat on openshift documentation {pull}30054[30054] diff --git a/x-pack/filebeat/module/cisco/asa/config/input.yml b/x-pack/filebeat/module/cisco/asa/config/input.yml index cb9df5bd6ec..b28c6bf9aab 100644 --- a/x-pack/filebeat/module/cisco/asa/config/input.yml +++ b/x-pack/filebeat/module/cisco/asa/config/input.yml @@ -7,6 +7,10 @@ paths: {{ end }} exclude_files: [".gz$"] +{{ else if eq .input "syslog" }} +type: udp +host: "{{.syslog_host}}:{{.syslog_port}}" + {{ else }} type: {{.input}} diff --git a/x-pack/filebeat/module/cisco/ftd/config/input.yml b/x-pack/filebeat/module/cisco/ftd/config/input.yml index cb9df5bd6ec..b28c6bf9aab 100644 --- a/x-pack/filebeat/module/cisco/ftd/config/input.yml +++ b/x-pack/filebeat/module/cisco/ftd/config/input.yml @@ -7,6 +7,10 @@ paths: {{ end }} exclude_files: [".gz$"] +{{ else if eq .input "syslog" }} +type: udp +host: "{{.syslog_host}}:{{.syslog_port}}" + {{ else }} type: {{.input}}