what model cisco device is it and what version of code? I’m getting logs from a bunch of Cisco devices using both raw and syslog inputs.
So lets back up…
How many inputs do you have configured? If this is your first install and the cisco switch your first input, lets delete all the inputs and just create one. If you have other inputs, then you’ll need to check them to ensure the Cisco messages are not accidentally getting routed into one of them. After creating the single input for the cisco device and starting it, I would check the server.log file to see if there are any errors in there with regards to that input. You had some listed earlier. If there are none, then the input should be in a state ready to receive messages.
The first thing that Graylog does upon receiving the message via an input is write it to the journal. Afterwards, it processes the message and outputs it to Elasticsearch for indexing where you can search for it, etc.
So if you have confirmed that the message is being sent from the switch, it is making it to the Graylog Server (tshark) and the input is up, then, you should see the message in the journal (albeit VERY briefly) before it is picked up by the processing buffer and moved through the system to be processed. You can try tailing the journal log file, (these are .log files in the /var/lib/graylog-server/journal/ directory (or perhaps a subdirectory) to see if the message is actually being successfully received by the input. then there is something going on with the input or as @jan pointed out, something in the message from Cisco that is non standard and causing Graylog to fail to receive it. Although the RAW input should work
So, check the inputs, check the server.log, check the journal.
FWIW… try a different Cisco device too if you can.