import cisco asa syslog message getting error "Your entry was not saved. The following error was reported: server abort."

[ashabc]

I am trying to import historical syslog message from cisco asa devices that are currently archived via a syslog server.

I have installed cisco security suite apps and the cisco firewall apps

Trying to import manually import data (tried a few syslog files, all fails) from data input --> files and directories --> and then manually setting the sourcetype to cisco_asa

Following error message pops up.

Your entry was not saved. The following error was reported: server abort.

If I try import data with preview, it seems to show up the correct data. But then I can not specify the source type to cisco_asa or cannot choose and index where the data to be going.

I have no idea what to do. should I be trying different sourcetype (such as syslog)?

[ashabc · Accepted solution]

Ok, I have setup the appropriate configs (sourcetype, index and the file location) into the inputs.conf file in the local directory of the firewall apps and seems working. Still don't know why it does not work via manual import. Anyway, it solved my problem.