"received event for unconfigured/disabled index='firewall' error in Cisco ASA app

[jturnerrdba]

I'm having trouble with this update. The last version worked great, but since I got the update, I've not been able to get it to work. I've made sure to download the new TA and I've recreated my data input for the syslog. I think that might be where my issue is though, I might not be doing that correct.

I'm setting source type to be syslong and I'm leaving index as default. I'm getting an error that states

"received event for unconfigured/disabled index='firewall' with source='source::udp::514' host='host::x.x.x.x'sourcetype='sourcetype::cisco_asa'

Any clue what I'm doing wrong?

[kenth]

Somewhere you have specified in to put stuff in the firewall index. Comment out the forcing of the index in props/transforms if you want stuff to go to main.

[jean_tomaz]

Hi, I have the problem too. "received event for unconfigured/disabled index='firewall' with source='source::udp::514' host='host::x.x.x.x'sourcetype='sourcetype::cisco_asa'