elastic · adriansr · Jul 23, 2020 · Jul 22, 2020
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -474,7 +474,6 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Add experimental dataset cisco/nexus for Cisco Nexus logs {pull}19713[19713]
 - Add experimental dataset citrix/virtualapps for Citrix Virtual Apps logs {pull}19713[19713]
 - Add experimental dataset cylance/protect for Cylance Protect logs {pull}19713[19713]
-- Add experimental dataset f5/firepass for F5 FirePass SSL VPN logs {pull}19713[19713]
 - Add experimental dataset fortinet/clientendpoint for Fortinet FortiClient Endpoint Protection logs {pull}19713[19713]
 - Add experimental dataset imperva/securesphere for Imperva Secure Sphere logs {pull}19713[19713]
 - Add experimental dataset infoblox/nios for Infoblox Network Identity Operating System logs {pull}19713[19713]

diff --git a/filebeat/docs/modules/f5.asciidoc b/filebeat/docs/modules/f5.asciidoc
@@ -67,51 +67,6 @@ will be found under `rsa.raw`. The default is false.
 
 :fileset_ex!:
 
-[float]
-==== `firepass` fileset settings
-
-experimental[]
-
-NOTE: This was converted from RSA NetWitness log parser XML "firepass" device revision 0.
-
-*`var.input`*::
-
-The input from which messages are read. One of `file`, `tcp` or `udp`.
-
-*`var.syslog_host`*::
-
-The address to listen to UDP or TCP based syslog traffic.
-Defaults to `localhost`.
-Set to `0.0.0.0` to bind to all available interfaces.
-
-*`var.syslog_port`*::
-
-The port to listen for syslog traffic. Defaults to `9509`
-
-NOTE: Ports below 1024 require Filebeat to run as root.
-
-*`var.tz_offset`*::
-
-By default, datetimes in the logs will be interpreted as relative to
-the timezone configured in the host where {beatname_uc} is running. If ingesting
-logs from a host on a different timezone, use this field to set the timezone
-offset so that datetimes are correctly parsed. Valid values are in the form
-±HH:mm, for example, `-07:00` for `UTC-7`.
-
-*`var.rsa_fields`*::
-
-Flag to control the addition of non-ECS fields to the event. Defaults to true,
-which causes both ECS and custom fields under `rsa` to be are added.
-
-*`var.keep_raw_fields`*::
-
-Flag to control the addition of the raw parser fields to the event. This fields
-will be found under `rsa.raw`. The default is false.
-
-:has-dashboards!:
-
-:fileset_ex!:
-
 :modulename!:
 
 

diff --git a/filebeat/tests/system/test_modules.py b/filebeat/tests/system/test_modules.py
@@ -227,7 +227,6 @@ def clean_keys(obj):
         "cef.log",
         "cisco.asa",
         "cisco.ios",
-        "f5.firepass",
         "fortinet.clientendpoint",
         "haproxy.log",
         "icinga.startup",

diff --git a/x-pack/filebeat/filebeat.reference.yml b/x-pack/filebeat/filebeat.reference.yml
@@ -600,25 +600,6 @@ filebeat.modules:
     # "+02:00" for GMT+02:00
     # var.tz_offset: local
 
-  firepass:
-    enabled: true
-
-    # Set which input to use between udp (default), tcp or file.
-    # var.input: udp
-    # var.syslog_host: localhost
-    # var.syslog_port: 9509
-
-    # Set paths for the log files when file input is used.
-    # var.paths:
-
-    # Toggle output of non-ECS fields (default true).
-    # var.rsa_fields: true
-
-    # Set custom timezone offset.
-    # "local" (default) for system timezone.
-    # "+02:00" for GMT+02:00
-    # var.tz_offset: local
-
 #------------------------------- Fortinet Module -------------------------------
 - module: fortinet
   firewall:

diff --git a/x-pack/filebeat/module/f5/_meta/config.yml b/x-pack/filebeat/module/f5/_meta/config.yml
@@ -17,22 +17,3 @@
     # "local" (default) for system timezone.
     # "+02:00" for GMT+02:00
     # var.tz_offset: local
-
-  firepass:
-    enabled: true
-
-    # Set which input to use between udp (default), tcp or file.
-    # var.input: udp
-    # var.syslog_host: localhost
-    # var.syslog_port: 9509
-
-    # Set paths for the log files when file input is used.
-    # var.paths:
-
-    # Toggle output of non-ECS fields (default true).
-    # var.rsa_fields: true
-
-    # Set custom timezone offset.
-    # "local" (default) for system timezone.
-    # "+02:00" for GMT+02:00
-    # var.tz_offset: local
diff --git a/x-pack/filebeat/module/f5/_meta/docs.asciidoc b/x-pack/filebeat/module/f5/_meta/docs.asciidoc
@@ -62,50 +62,5 @@ will be found under `rsa.raw`. The default is false.
 
 :fileset_ex!:
 
-[float]
-==== `firepass` fileset settings
-
-experimental[]
-
-NOTE: This was converted from RSA NetWitness log parser XML "firepass" device revision 0.
-
-*`var.input`*::
-
-The input from which messages are read. One of `file`, `tcp` or `udp`.
-
-*`var.syslog_host`*::
-
-The address to listen to UDP or TCP based syslog traffic.
-Defaults to `localhost`.
-Set to `0.0.0.0` to bind to all available interfaces.
-
-*`var.syslog_port`*::
-
-The port to listen for syslog traffic. Defaults to `9509`
-
-NOTE: Ports below 1024 require Filebeat to run as root.
-
-*`var.tz_offset`*::
-
-By default, datetimes in the logs will be interpreted as relative to
-the timezone configured in the host where {beatname_uc} is running. If ingesting
-logs from a host on a different timezone, use this field to set the timezone
-offset so that datetimes are correctly parsed. Valid values are in the form
-±HH:mm, for example, `-07:00` for `UTC-7`.
-
-*`var.rsa_fields`*::
-
-Flag to control the addition of non-ECS fields to the event. Defaults to true,
-which causes both ECS and custom fields under `rsa` to be are added.
-
-*`var.keep_raw_fields`*::
-
-Flag to control the addition of the raw parser fields to the event. This fields
-will be found under `rsa.raw`. The default is false.
-
-:has-dashboards!:
-
-:fileset_ex!:
-
 :modulename!:
 
diff --git a/x-pack/filebeat/module/f5/fields.go b/x-pack/filebeat/module/f5/fields.go