New

The executive guide to generative AI

Read more
About usPartnersSupport|Login
IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Decode Base64 fields Decode CSV fields »
Elastic Docs ›Fleet and Elastic Agent Guide [8.8] ›Define processors

Decode CEF

edit

Decode CEF

edit

The decode_cef processor decodes Common Event Format (CEF) messages.

This processor only works with log inputs.

Example

edit

In this example, the message field is decoded as CEF after it is renamed to event.original. It is best to rename message to event.original because the decoded CEF data contains its own message field.

  - rename:
      fields:
        - {from: "message", to: "event.original"}
  - decode_cef:
      field: event.original

Configuration settings

edit

Elastic Agent processors execute before ingest pipelines, which means that your processor configurations cannot refer to fields that are created by ingest pipelines or Logstash. For more limitations, refer to What are some limitations of using processors?

Name Required Default Description

field

No

message

Source field containing the CEF message to be parsed.

target_field

No

cef

Target field where the parsed CEF object will be written.

ecs

No

true

Whether to generate Elastic Common Schema (ECS) fields from the CEF data. Certain CEF header and extension values will be used to populate ECS fields.

timezone

No

UTC

IANA time zone name (for example, America/New_York) or fixed time offset (for example, +0200) to use when parsing times that do not contain a time zone. Specify Local to use the machine’s local time zone.

ignore_missing

No

false

Whether to ignore errors when the source field is missing.

ignore_failure

No

false

Whether to ignore failures when the source field does not contain a CEF message.

id

No

Identifier for this processor instance. Useful for debugging.
« Decode Base64 fields Decode CSV fields »

On this page

Was this helpful?
Feedback