Decode CEF
editDecode CEF
editThis functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.
The decode_cef
processor decodes Common Event Format (CEF) messages. This
processor is available in Filebeat.
Below is an example configuration that decodes the message
field as CEF after
renaming it to event.original
. It is best to rename message
to
event.original
because the decoded CEF data contains its own message
field.
processors: - rename: fields: - {from: "message", to: "event.original"} - decode_cef: field: event.original
The decode_cef
processor has the following configuration settings.
Table 1. Decode CEF options
Name | Required | Default | Description |
---|---|---|---|
|
no |
message |
Source field containing the CEF message to be parsed. |
|
no |
cef |
|
Target field where the parsed CEF object will be written. |
|
no |
|
true |
Generate Elastic Common Schema (ECS) fields from the CEF data. Certain CEF header and extension values will be used to populate ECS fields. |
|
|
no |
false |
Ignore errors when the source field is missing. |
|
|
no |
false |
Ignore failures when the source field does not contain a CEF message. |
|
no |