I am trying to ingest syslog data from a Cisco 3750 switch and I get an error from Filebeat.

Filebeat error:

• {"level":"error","timestamp":"2019-02-08T18:55:32.305Z","logger":"syslog","caller":"syslog/input.go:131","message":"can't parse event as syslog rfc3164","message":"<190>589265: Feb 8 18:55:31.306: %SEC-6-IPACCESSLOGP: list 177 denied udp 10.100.7.196(53640) -> 10.100.7.255(15600), 1 packet"}

PCAP of Syslog Traffic:

• cisco-3750-syslog.pcap.txt

Version:

• filebeat version 7.0.0 (arm), libbeat 7.0.0 [3dd1f50 built 2019-02-06 19:37:38 +0000 UTC]

Filebeat Config:

  filebeat.inputs:
    - type: syslog
      protocol.udp:
        host: ':9002'

Cisco 3750 Config:

• logging host 10.100.5.130 transport udp port 9002