Same problem here Kent, our ASA logs successfully to an index called 'firewall' and the log looks like this:
Oct 18 10:53:40 xxx.xxx.xxx.xxx %ASA-5-106100: access-list outside_access_out permitted udp inside/outside-if(46624) -> outside/xxx.xxx.xxx.xxx(53) hit-cnt 1 first hit
and yet the app's reporting 0 events.
Also, having the application understand the old format would also be very nice, but more importantly, a slightly more detailed documentation is necessary. Nowhere it said one should have a separate index called 'firewall' and we had to find it out by searching issues on this site.
... View more