---
title: Cisco Aironet Integration for Elastic
description: The Cisco Aironet integration for Elastic enables you to collect and analyze logs from Cisco Wireless LAN Controllers (WLC). This allows you to centralize...
url: https://www.elastic.co/docs/reference/integrations/cisco_aironet
products:
  - Elastic integrations
applies_to:
  - Serverless Observability projects: Generally available
  - Serverless Security projects: Generally available
  - Elastic Stack: Generally available since 9.0
---

# Cisco Aironet Integration for Elastic
|                                                                                                 |                                 |
|-------------------------------------------------------------------------------------------------|---------------------------------|
| **Version**                                                                                     | 1.20.0 ([View all](#changelog)) |
| **Subscription level**[What's this?](https://www.elastic.co/subscriptions)                      | Basic                           |
| **Developed by**[What's this?](https://www.elastic.co/docs/reference/integrations/developed-by) | Community                       |
| **Ingestion method(s)**                                                                         | File, Network Protocol          |
| **Minimum Kibana version(s)**                                                                   | 9.0.08.11.0                     |

<note>
  This AI-assisted guide was validated by our engineers. You may need to adjust the steps to match your environment.
</note>


## Overview

The Cisco Aironet integration for Elastic enables you to collect and analyze logs from Cisco Wireless LAN Controllers (WLC). This allows you to centralize the monitoring of wireless network activities, providing deep visibility into the health and security of your wireless infrastructure. By ingesting system messages, you can track client events, hardware status, and security alerts within the Elastic Stack.

### Compatibility

This integration is compatible with the following third-party vendor versions:
- Cisco Aironet Wireless LAN Controllers (WLC) running AireOS firmware.
- Supported hardware including the Cisco 2504, 3504, 5508, 5520, and 8540 series controllers.

This integration is compatible with Elastic Stack version 8.11.0 or later.

### How it works

This integration collects logs from Cisco Aironet devices by receiving syslog data over the network or by reading directly from log files. You can deploy an Elastic Agent on a host and configure it as a syslog receiver using the `udp` or `tcp` input, or point it to a specific log file using the `logfile` input. Once configured, the agent forwards the system messages, authentication events, and network status updates to your Elastic deployment, where they are mapped to the Elastic Common Schema (ECS) for analysis.

## What data does this integration collect?

The Cisco Aironet integration collects log messages of the following types:
- System messages: These include process status, hardware alerts, and system-level events generated by the Wireless LAN Controller (WLC) software.
- Network events: These logs relate to wireless protocol transitions, interface status changes, and DHCP or Spanning Tree Protocol (STP) events.
- Security logs: These records cover authentication events for RADIUS and TACACS+, unauthorized access attempts, and configuration audit trails.

The integration provides the `log` data stream to capture these events. Depending on how you configure the input, it collects data in the following ways:
- UDP or TCP input: Collects Cisco Aironet logs sent over the network.
- Logfile input: Collects logs from a file when they're written to a local disk or a shared mount point.

All collected logs are mapped to the Elastic Common Schema (ECS), supporting standard Cisco system message formats received using Syslog (RFC 3164/5424) or read directly from local log files.

### Supported use cases

Integrating Cisco Aironet logs with Elastic provides visibility into your wireless network infrastructure. You can use this integration for the following:
- Security monitoring: You'll be able to track authentication successes and failures to identify potential unauthorized access attempts or credential issues.
- Network troubleshooting: You can monitor interface status changes and protocol transitions to diagnose connectivity problems or hardware alerts.
- Audit and compliance: You can maintain a searchable history of configuration changes and system events to meet regulatory requirements and internal audit needs.
- Operational visibility: You'll gain insights into the health of your WLC software and hardware components through system-level event tracking.


## What do I need to use this integration?

To use this integration, you need the following from your Cisco Wireless LAN Controller (WLC) environment:
- High-level administrative credentials (GUI) or Enable-level access (CLI) on the Cisco WLC.
- Network connectivity that permits traffic from the WLC IP addresses to the Elastic Agent host on the configured port (default is `9009`) using TCP or UDP.
- Software licenses on the WLC that support remote syslog forwarding.
- NTP configured on the Cisco WLC to ensure timestamps in logs are accurate and align with your Elastic Stack environment.

You also need the following Elastic Stack components:
- Elastic Stack version 8.11.0 or later.
- An Elastic Agent installed on a host reachable by the Cisco WLC and successfully enrolled in Fleet.
- An Elastic Agent policy that includes the Cisco Aironet integration.
- The target port (for example, `9009`) open on the host running the Elastic Agent and not currently bound by another service.


## How do I deploy this integration?


### Agent-based deployment

Elastic Agent must be installed. For more details, check the Elastic Agent [installation instructions](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html). You can install only one Elastic Agent per host.
Elastic Agent is required to stream data from the syslog or log file receiver and ship the data to Elastic, where the events will then be processed using the integration's ingest pipelines.

### Set up steps in Cisco Aironet

You can configure your Cisco Aironet Wireless LAN Controller (WLC) to send logs to the Elastic Agent host using either the web interface or the command line.

#### For AireOS (Traditional WLC) using Web GUI

Follow these steps to configure syslog using the Cisco WLC web administration interface:
1. Log in to the Cisco WLC web administration interface.
2. Navigate to **Management > Logs > Config**.
3. In the **Syslog Servers** section, locate the next available slot (up to 3 servers can be configured).
4. Enter the **Syslog Server IP Address**. This is the IP address of the host where the Elastic Agent is installed.
5. Click **Add**.
6. Configure the **Syslog Level** (Severity) from the drop-down menu. It's recommended to select `Informational` (Level 6) for production monitoring.
7. Configure the **Syslog Facility** from the drop-down menu. The default is `Syslog` (Facility level 5).
8. Click **Apply** in the top right corner to save the active configuration.
9. To ensure the settings persist after a reboot, click **Save Configuration** at the top of the page.


#### For AireOS (Traditional WLC) using CLI

Follow these steps to configure syslog using the command line interface:
1. Connect to the WLC using SSH or Console.
2. Enter the command to add the Elastic Agent as a syslog host (up to 3 servers can be configured):
   `config logging syslog host <Elastic_Agent_IP>` (replace with your actual value)
3. Set the desired severity level (only messages with severity equal to or less than this level will be sent):
   `config logging syslog level <severity_level>`
4. (Optional) Configure the syslog facility if required for filtering:
   `config logging syslog facility <facility_code>`
5. Save the configuration to ensure settings persist after a reboot:
   `save config`


#### Vendor resources

For more information on configuring syslog on Cisco devices, refer to the following documentation:
- [Configure Syslog Server on Wireless LAN Controllers - Cisco](https://www.cisco.com/c/en/us/support/docs/wireless/4100-series-wireless-lan-controllers/107252-WLC-Syslog-Server.html)


### Set up steps in Kibana

To set up the integration in Kibana, follow these steps:
1. In Kibana, navigate to **Management > Integrations**.
2. Search for **Cisco Aironet** and click **Add Cisco Aironet**.
3. Follow the prompts to add the integration to an Elastic Agent policy.
4. Configure the available input types based on your vendor setup.

Choose the setup instructions below that match your configuration. The input type should correspond to how you configured your Cisco Aironet to send logs in the vendor setup steps above.

#### TCP input configuration

Use this input if you configured your WLC to send logs over a TCP socket. You can configure the following settings:

| Setting                     | Description                                                                                                                                                                      |
|-----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Listen Address**          | The bind address to listen for TCP connections (for example, `0.0.0.0`).                                                                                                         |
| **Listen Port**             | The TCP port number to listen on (for example, `9009`).                                                                                                                          |
| **Preserve original event** | If checked, a raw copy of the original event is stored in the `event.original` field.                                                                                            |
| **Tags**                    | Custom tags to append to the events (for example, `cisco-aironet`, `forwarded`).                                                                                                 |
| **Timezone**                | IANA time zone or time offset (for example, `+0200`) to use when interpreting syslog timestamps without a time zone.                                                             |
| **SSL Configuration**       | Configure SSL options for encrypted communication.                                                                                                                               |
| **Custom TCP Options**      | Specify custom configuration options like `max_connections` or `framing`.                                                                                                        |
| **Processors**              | Add custom processors to enhance or reduce event fields. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. |


#### UDP input configuration

Use this input if you configured your WLC to send logs over a UDP socket. You can configure the following settings:

| Setting                     | Description                                                                                                                                                                      |
|-----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Listen Address**          | The bind address to listen for UDP connections (for example, `0.0.0.0`).                                                                                                         |
| **Listen Port**             | The UDP port number to listen on (for example, `9009`).                                                                                                                          |
| **Preserve original event** | If checked, a raw copy of the original event is stored in the `event.original` field.                                                                                            |
| **Tags**                    | Custom tags for event categorization (for example, `cisco-aironet`, `forwarded`).                                                                                                |
| **Timezone**                | IANA time zone or time offset used to interpret timestamps.                                                                                                                      |
| **Custom UDP Options**      | Specify custom configuration options for the UDP input such as `read_buffer` or `max_message_size`.                                                                              |
| **Processors**              | Add custom processors to enhance or reduce event fields. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. |


#### Log file input configuration

Use this input to collect logs directly from log files on the host where the Elastic Agent is running. You can configure the following settings:

| Setting                     | Description                                                                                                                                                                      |
|-----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Paths**                   | The list of file paths to monitor for log data (for example, `/var/log/cisco-aironet.log`).                                                                                      |
| **Preserve original event** | If checked, a raw copy of the original event is stored in the `event.original` field.                                                                                            |
| **Tags**                    | Custom tags for the file input (for example, `cisco-aironet`, `forwarded`).                                                                                                      |
| **Timezone**                | IANA time zone or time offset used to interpret timestamps.                                                                                                                      |
| **Processors**              | Add custom processors to enhance or reduce event fields. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. |

After configuring the inputs, click **Save and continue** to deploy the configuration to the Elastic Agent.

### Validation

To verify that the integration is working properly and data is flowing into Elasticsearch, follow these steps.
First, trigger data flow on the Cisco Aironet device by performing one of the following actions:
- Authentication event: Attempt to log into the WLC web interface or CLI with an incorrect password, then log in successfully to generate authentication logs.
- Configuration event: Enter configuration mode in the CLI (`config t`) and then exit (`exit`) to trigger a configuration audit event.
- Interface/AP event: Power cycle an Access Point or toggle a test interface status using the `shutdown` and `no shutdown` commands to trigger join or disassociation messages.

Next, check for data in Kibana:
1. Navigate to **Analytics > Discover**.
2. Select the `logs-*` data view.
3. Enter the KQL filter: `data_stream.dataset : "cisco_aironet.log"`
4. Verify that logs appear in the results. Expand a log entry and confirm these fields are populated:
   - `event.dataset` (should be `cisco_aironet.log`)
- `event.action` or `log.syslog.priority`
- `message` (the raw log payload)
5. Navigate to **Analytics > Dashboards** and search for "Cisco Aironet" to view pre-built visualizations.


## Troubleshooting

For help with Elastic ingest tools, check [Common problems](https://www.elastic.co/docs/troubleshoot/ingest/fleet/common-problems).

### Common configuration issues

The following are common issues you might encounter when configuring the Cisco Aironet integration:
- **Port mismatch**: Cisco WLCs are frequently hardcoded to send syslog over `UDP` port `514`. If the integration is left at the default `9009`, no data is received. Ensure the integration's listen port matches the port the WLC is actually using.
- **Firewall blocking**: Local host firewalls like `iptables` or `firewalld`, or network firewalls, may block `UDP` traffic on port `514` or `9009`. Verify connectivity using `tcpdump` or `nc -u -l 514` on the agent host.
- **WLC syslog level**: If no logs appear, check that the WLC syslog level is not set too high (for example, to `Critical` only). Set it to `Informational` to ensure enough data is generated for verification.
- **AP global configuration**: If WLC logs arrive but Access Point logs do not, ensure the AP remote syslog host IP is specifically set in the Wireless > Global Configuration section.
- **Ingestion parsing failures**: If logs are ingested but contain the `_grokparsefailure` tag, the syslog format from the WLC may be non-standard. Check the `event.original` field to see if the message matches the expected Cisco format.
- **Syslog format mismatches**: Cisco WLCs can sometimes include or exclude sequence numbers or timestamps. Ensure the WLC is configured to send standard system messages without excessive custom formatting.
- **High volume packet loss**: When using `UDP`, you might experience packet loss during traffic bursts. Ensure the `read_buffer` in `udp_options` is appropriately sized (the default is `100MiB`).
- **High CPU load**: Forwarding `Debugging` (level 7) logs in production can overwhelm the ingest pipeline and increase CPU load on both the source system and the Elastic Agent. Use `Informational` (level 6) or `Warnings` (level 4) instead.


## Performance and scaling

For more information on architectures that can be used for scaling this integration, check the [Ingest Architectures](https://www.elastic.co/docs/manage-data/ingest/ingest-reference-architectures) documentation.
To ensure optimal performance in high-volume environments, you should consider the following settings and configurations:
- Transport and collection considerations: While UDP is faster for syslog transmission, use TCP for environments where delivery guarantees are required. When you use UDP, ensure the `read_buffer` in `udp_options` is appropriately sized (default `100MiB`) to prevent packet loss during traffic bursts. For TCP, configure `max_connections` to handle concurrent streams from multiple controllers.
- Data volume management: Configure the Cisco WLC to forward only necessary events by adjusting the syslog level. It's recommended to use `Informational` (level 6) or `Warnings` (level 4). Avoid forwarding `Debugging` (level 7) logs in production as they can overwhelm the ingest pipeline and increase CPU load on both the source system and the Elastic Agent.
- Elastic Agent scaling: For high-throughput environments with thousands of Access Points, deploy multiple Elastic Agents behind a network load balancer to distribute traffic evenly. Place Agents close to the data source to minimize latency and potential packet loss over the network.


## Reference


### Inputs used

This integration uses the following inputs:
These inputs can be used with this integration:
<dropdown title="logfile">
  ## SetupFor more details about the logfile input settings, check the [Filebeat documentation](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-log).


  ### Collecting logs from logfileTo collect logs via logfile, select **Collect logs via the logfile input** and configure the following parameter:

  - Paths: List of glob-based paths to crawl and fetch log files from. Supports glob patterns like
    `/var/log/*.log` or `/var/log/*/*.log` for subfolder matching. Each file found starts a
    separate harvester.
</dropdown>

<dropdown title="tcp">
  ## SetupFor more details about the TCP input settings, check the [Filebeat documentation](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-tcp).


  ### Collecting logs from TCPTo collect logs via TCP, select **Collect logs via TCP** and configure the following parameters:
  **Required Settings:**
  - Host
  - Port
  **Common Optional Settings:**
  - Max Message Size - Maximum size of incoming messages
  - Max Connections - Maximum number of concurrent connections
  - Timeout - How long to wait for data before closing idle connections
  - Line Delimiter - Character(s) that separate log messages


  ## SSL/TLS ConfigurationTo enable encrypted connections, configure the following SSL settings:
  **SSL Settings:**
  - Enable SSL - Toggle to enable SSL/TLS encryption
  - Certificate - Path to the SSL certificate file (`.crt` or `.pem`)
  - Certificate Key - Path to the private key file (`.key`)
  - Certificate Authorities - Path to CA certificate file for client certificate validation (optional)
  - Client Authentication - Require client certificates (`none`, `optional`, or `required`)
  - Supported Protocols - TLS versions to support (e.g., `TLSv1.2`, `TLSv1.3`)
  **Example SSL Configuration:**
  ```yaml
  ssl.enabled: true
  ssl.certificate: "/path/to/server.crt"
  ssl.key: "/path/to/server.key"
  ssl.certificate_authorities: ["/path/to/ca.crt"]
  ssl.client_authentication: "optional"
  ```
</dropdown>

<dropdown title="udp">
  ## SetupFor more details about the UDP input settings, check the [Filebeat documentation](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-udp).


  ### Collecting logs from UDPTo collect logs via UDP, select **Collect logs via UDP** and configure the following parameters:
  **Required Settings:**
  - Host
  - Port
  **Common Optional Settings:**
  - Max Message Size - Maximum size of UDP packets to accept (default: 10KB, max: 64KB)
  - Read Buffer - UDP socket read buffer size for handling bursts of messages
  - Read Timeout - How long to wait for incoming packets before checking for shutdown
</dropdown>


### Data streams


#### log

The `log` data stream provides events from Cisco Aironet Wireless LAN Controllers (WLC) of the following types: system messages, association logs, and security events.

##### log fields

<dropdown title="Exported fields">
  | Field                            | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | Type             |
  |----------------------------------| |------------------|
  | @timestamp                       | Event timestamp.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | date             |
  | cisco.eapol.descriptor           | Cisco eapol descriptor                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | short            |
  | cisco.eapol.type                 | Cisco eapol type                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | short            |
  | cisco.eapol.version              | Cisco eapol version                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | short            |
  | cisco.interface.type             | Cisco interface type                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | keyword          |
  | cisco.ssid                       | Cisco SSID                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | keyword          |
  | cisco.wps.channel                | Cisco WPS channel                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | short            |
  | cisco.wps.hits                   | Cisco WPS hits                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | short            |
  | cisco.wps.preced                 | Cisco WPS precedence                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | short            |
  | cisco.wps.radio                  | The radio interface number within a slot                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | short            |
  | cisco.wps.slot                   | Cisco WPS slot                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | short            |
  | cisco.wps.track                  | Cisco WPS track                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | keyword          |
  | client.as.number                 | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.                                                                                                                                                                                                                                                                                                                                                                                                                                | long             |
  | client.as.organization.name      | Organization name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | keyword          |
  | client.as.organization.name.text | Multi-field of `client.as.organization.name`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | match_only_text  |
  | client.geo.city_name             | City name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | keyword          |
  | client.geo.continent_name        | Name of the continent.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | keyword          |
  | client.geo.country_iso_code      | Country ISO code.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | keyword          |
  | client.geo.country_name          | Country name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | keyword          |
  | client.geo.location              | Longitude and latitude.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | geo_point        |
  | client.geo.region_iso_code       | Region ISO code.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | keyword          |
  | client.geo.region_name           | Region name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | keyword          |
  | client.ip                        | IP address of the client (IPv4 or IPv6).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | ip               |
  | client.mac                       | MAC address of the client. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.                                                                                                                                                                                                                                                                                                   | keyword          |
  | data_stream.dataset              | Data stream dataset.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | constant_keyword |
  | data_stream.namespace            | Data stream namespace.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | constant_keyword |
  | data_stream.type                 | Data stream type.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | constant_keyword |
  | destination.mac                  | MAC address of the destination. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.                                                                                                                                                                                                                                                                                              | keyword          |
  | destination.port                 | Port of the destination.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | long             |
  | ecs.version                      | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.                                                                                                                                                                                                                                                                                         | keyword          |
  | event.dataset                    | Event dataset                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | constant_keyword |
  | event.module                     | Event module                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | constant_keyword |
  | event.severity                   | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long             |
  | input.type                       | Input type.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | keyword          |
  | log.file.path                    | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field.                                                                                                                                                                                                                                                                                                                                                                  | keyword          |
  | log.level                        | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`.                                                                                                                                                                                                                                               | keyword          |
  | log.offset                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | long             |
  | log.source.address               | Source address from which the log event was read / sent from.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | keyword          |
  | log.syslog.facility.code         | The Syslog numeric facility of the log event, if available. According to RFCs 5424 and 3164, this value should be an integer between 0 and 23.                                                                                                                                                                                                                                                                                                                                                                                                                        | long             |
  | log.syslog.priority              | Syslog numeric priority of the event, if available. According to RFCs 5424 and 3164, the priority is 8 * facility + severity. This number is therefore expected to contain a value between 0 and 191.                                                                                                                                                                                                                                                                                                                                                                 | long             |
  | log.syslog.severity.code         | The Syslog numeric severity of the log event, if available. If the event source publishing via Syslog provides a different numeric severity value (e.g. firewall, IDS), your source's numeric severity should go to `event.severity`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `event.severity`.                                                                                                                                                                                                      | long             |
  | message                          | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message.                                                                                                                                                                                                                                                           | match_only_text  |
  | observer.ingress.interface.id    | Interface ID as reported by an observer (typically SNMP interface ID).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | keyword          |
  | process.name                     | Process name. Sometimes called program name or similar.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | keyword          |
  | process.name.text                | Multi-field of `process.name`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | match_only_text  |
  | server.ip                        | IP address of the server (IPv4 or IPv6).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | ip               |
  | source.mac                       | MAC address of the source. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.                                                                                                                                                                                                                                                                                                   | keyword          |
  | tags                             | List of keywords used to tag each event.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | keyword          |
  | threat.indicator.description     | Describes the type of action conducted by the threat.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | keyword          |
  | threat.indicator.type            | Type of indicator as represented by Cyber Observable in STIX 2.0.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | keyword          |
  | user.name                        | Short name or login of the user.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | keyword          |
  | user.name.text                   | Multi-field of `user.name`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | match_only_text  |
</dropdown>


##### log sample event

<dropdown title="Example">
  ```json
  {
      "@timestamp": "2024-08-20T11:25:50.157Z",
      "agent": {
          "ephemeral_id": "c47efe0f-c0e2-444b-b292-a9ec40271d4b",
          "id": "0335de7e-b2c1-4352-bf23-c023d21c1252",
          "name": "elastic-agent-54493",
          "type": "filebeat",
          "version": "8.15.3"
      },
      "cisco": {
          "interface": {
              "type": "wired"
          }
      },
      "client": {
          "ip": "fe80::aee2:d3ff:feba:56a4"
      },
      "data_stream": {
          "dataset": "cisco_aironet.log",
          "namespace": "59495",
          "type": "logs"
      },
      "ecs": {
          "version": "8.17.0"
      },
      "elastic_agent": {
          "id": "0335de7e-b2c1-4352-bf23-c023d21c1252",
          "snapshot": false,
          "version": "8.15.3"
      },
      "event": {
          "action": "ENTRY_DELETED",
          "agent_id_status": "verified",
          "dataset": "cisco_aironet.log",
          "ingested": "2024-11-04T21:04:12Z",
          "original": "<134>WLC001: *SISF BT Process: Aug 20 11:25:50.157: %SISF-6-ENTRY_DELETED: sisf_shim_utils.c:482 Entry deleted A=fe80::aee2:d3ff:feba:56a4 V=0 I=wired:1 P=0000 M=",
          "provider": "SISF",
          "severity": 6,
          "timezone": "+00:00"
      },
      "host": {
          "name": "WLC001"
      },
      "input": {
          "type": "udp"
      },
      "log": {
          "level": "informational",
          "source": {
              "address": "172.29.0.3:33867"
          },
          "syslog": {
              "facility": {
                  "code": 16
              },
              "priority": 134,
              "severity": {
                  "code": 6
              }
          }
      },
      "message": "Entry deleted A=fe80::aee2:d3ff:feba:56a4 V=0 I=wired:1 P=0000 M=",
      "process": {
          "name": "SISF BT Process"
      },
      "tags": [
          "preserve_original_event",
          "cisco-aironet",
          "forwarded"
      ]
  }
  ```
</dropdown>


### Vendor documentation links

You can find more information about Cisco Aironet system messages and error codes in the following vendor resources:
- [Cisco WLC System Message Guides](https://www.cisco.com/c/en/us/support/wireless/wireless-lan-controller-software/products-system-message-guides-list.html)
- [Configure Syslog Server on Wireless LAN Controllers - Cisco](https://www.cisco.com/c/en/us/support/docs/wireless/4100-series-wireless-lan-controllers/107252-WLC-Syslog-Server.html)


## Changelog

<dropdown title="Changelog">
  | Version    | Details                                                                                                                                                                                                                                      | Minimum Kibana version |
  |------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------|
  | **1.20.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/17274))Update documentation for the integration.                                                                                                           | 9.0.08.11.0            |
  | **1.19.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/17271))Support logs with dual sequence numbers and timezone abbreviations.                                                                                 | 9.0.08.11.0            |
  | **1.18.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/15798))Preserve event.original on pipeline error.                                                                                                          | 9.0.08.11.0            |
  | **1.17.1** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/15528))Generate processor tags and normalize error handler.                                                                                                | 9.0.08.11.0            |
  | **1.17.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/15517))Parse 'CLIENT_ORCH_LOG-6-CLIENT_ADDED_TO_RUN_STATE' log messages with more fields                                                                   | 9.0.08.11.0            |
  | **1.16.1** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/14753))Changed owners.                                                                                                                                     | 9.0.08.11.0            |
  | **1.16.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/13042))Support stack version 9.0.                                                                                                                          | 9.0.08.11.0            |
  | **1.15.2** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/12975))Properly parse 'CLIENT_ORCH_LOG-6-CLIENT_ADDED_TO_RUN_STATE' log messages                                                                               | 8.11.0                 |
  | **1.15.1** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/12753))Updated SSL description to be uniform and to include links to documentation.                                                                            | 8.11.0                 |
  | **1.15.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/12569))ECS version updated to 8.17.0.                                                                                                                      | 8.11.0                 |
  | **1.14.2** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/11105))Fix the event.severity ECS field mapping.                                                                                                               | 8.11.0                 |
  | **1.14.1** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/11103))Fix the destination.port ECS field mapping.                                                                                                             | 8.11.0                 |
  | **1.14.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/10897))Allow @custom pipeline access to event.original without setting preserve_original_event.                                                            | 8.11.0                 |
  | **1.13.3** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/10445))Handle multiple whitespace characters between month and monthday                                                                                        | 8.0.0                  |
  | **1.13.2** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/10166))Make LOG-3-Q_IND parsing optional.                                                                                                                      | 8.0.0                  |
  | **1.13.1** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/9545))Fix CLIENT_ORCH_LOG messages.                                                                                                                            | 8.0.0                  |
  | **1.13.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/9235))Update package spec to 3.0.3.                                                                                                                        | 8.0.0                  |
  | **1.12.2** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/8943))Changed owners                                                                                                                                       | 8.0.0                  |
  | **1.12.1** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/8635))Fix exclude_files pattern.                                                                                                                               | 8.0.0                  |
  | **1.12.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/8433))ECS version updated to 8.11.0.                                                                                                                       | 8.0.0                  |
  | **1.11.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/8269))Improve 'event.original' check to avoid errors if set.                                                                                               | 8.0.0                  |
  | **1.10.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/8035))Set 'community' owner type.                                                                                                                          | 8.0.0                  |
  | **1.9.0**  | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/8025))Update the package format_version to 3.0.0.                                                                                                          | 8.0.0                  |
  | **1.8.0**  | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/7966))Correct invalid ECS field usages at root-level.                                                                                                          | 8.0.0                  |
  | **1.7.0**  | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/7905))ECS version updated to 8.10.0.                                                                                                                       | 8.0.0                  |
  | **1.6.0**  | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/7789))Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. | 8.0.0                  |
  | **1.5.0**  | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/7107))Update package to ECS 8.9.0.                                                                                                                         | 8.0.0                  |
  | **1.4.0**  | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/6600))Ensure event.kind is correctly set for pipeline errors.                                                                                              | 8.0.0                  |
  | **1.3.0**  | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/6325))Update package to ECS 8.8.0.                                                                                                                         | 8.0.0                  |
  | **1.2.0**  | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/6151))Update package-spec version to 2.7.0.                                                                                                                | 8.0.0                  |
  | **1.1.0**  | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/5765))Update package to ECS 8.7.0.                                                                                                                         | 8.0.0                  |
  | **1.0.0**  | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/5677))Release Cisco Aironet as GA.                                                                                                                         | 8.0.0                  |
  | **0.3.1**  | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/5123))Added categories and/or subcategories.                                                                                                               | 8.0.0                  |
  | **0.3.0**  | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/4576))Update package to ECS 8.6.0.                                                                                                                         | 8.0.0                  |
  | **0.2.0**  | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/4863))Add `udp_options` to the UDP input.                                                                                                                  | 8.0.0                  |
  | **0.1.0**  | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/4285))Update package to ECS 8.5.0.                                                                                                                         | 8.0.0                  |
  | **0.0.2**  | **Enhancement** ([View pull request](https://github.com/elastic/integrations/issues/4227))Use ECS geo.location definition.                                                                                                                   | 8.0.0                  |
  | **0.0.1**  | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/4050))Initial draft of the package for Cisco WLC                                                                                                           | 8.0.0                  |
</dropdown>