decode_cef is unable to parse special characters in response field.
- Dominant language
- Go
- Stars
- 12.7k
- Forks
- 5k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 364
Description
**Description:**
In the sample event shown below, the `InfobloxDHCPOptions` field includes special characters that `decode_cef` cannot parse, resulting in the field being dropped.
**Sample event:**
> <134>1 2021-03-03T11:57:45Z - dataconnector - DHCP-LEASE-UPDATE - CEF:0|Infoblox|Data Connector|2.1.3|DHCP-LEASE-UPDATE|DHCP Lease Update|1|src=216.160.83.56 InfobloxClientID=01:00:0c:29:71:d8:95 InfobloxHostID=dhcp/host/94617 InfobloxFingerprintPr=false InfobloxRangeEnd= InfobloxRangeStart= smac=00:0c:29:71:d8:95 InfobloxIPSpaceName= InfobloxIPSpace=ipam/ip_space/a05fd0fd-b186-11ea-b69a-aa22288caa04 InfobloxSubnet= InfobloxFingerprint=osdfsd39429302sdfsdf2349 shost=wx-test-2. InfobloxLeaseUUID= InfobloxLifetime=3600 InfobloxLeaseOp=Update app=DHCP cat="DHCP Lease Update" InfobloxDUID= InfobloxDHCPOptions=code_12='ubuntu';code_53='003';code_55='001002006014017032034y003!()*w371374021';code_57='377377';code_61='001000014)t8e' InfobloxHost= dst=
**Error Message:**

**Expectation:**
The field should not be dropped and should instead be correctly parsed in the response returned by `decode_cef`
Contributor guide
Assessment
This issue has not been assessed yet.