Decode CEF
editDecode CEF
editThe decode_cef
processor decodes Common Event Format (CEF) messages.
This processor only works with log inputs.
Example
editIn this example, the message
field is decoded as CEF after it is renamed to
event.original
. It is best to rename message
to event.original
because the
decoded CEF data contains its own message
field.
- rename: fields: - {from: "message", to: "event.original"} - decode_cef: field: event.original
Configuration settings
editElastic Agent processors execute before ingest pipelines, which means that your processor configurations cannot refer to fields that are created by ingest pipelines or Logstash. For more limitations, refer to What are some limitations of using processors?
Name | Required | Default | Description |
---|---|---|---|
|
No |
|
Source field containing the CEF message to be parsed. |
|
No |
|
Target field where the parsed CEF object will be written. |
|
No |
|
Whether to generate Elastic Common Schema (ECS) fields from the CEF data. Certain CEF header and extension values will be used to populate ECS fields. |
|
No |
|
IANA time zone name (for example, |
|
No |
|
Whether to ignore errors when the source field is missing. |
|
No |
false |
Whether to ignore failures when the source field does not contain a CEF message. |
|
No |
Identifier for this processor instance. Useful for debugging. |