elastic / elastic/docs-content
[Website]: CEF field mapping mismatch
- Dominant language
- No language data
- Stars
- 47
- Forks
- 261
- Avg merge
- 3d 12h
- Merged PRs (30d)
- 116
Description
### Type of issue
Inaccurate
### What documentation page is affected
https://www.elastic.co/docs/reference/logstash/plugins/plugins-codecs-cef
### What happened?
When performing some parsing on CEF data, I found that some fields are not the same between the logstash codec plugin and the Elastic Integration.
For example for the field `deviceCustomString2`, the integration maps it to `cef.extensions.deviceCustomString2`, when the Logstash plugin maps it to `[cef][device_custom_string_2][value]` (which translate t to `cef.device_custom_string_2.value` in ES).
According to the last update of the logstash codec (2024-10-22). Its doc should be updated to match the integration mapping, which is more up to date.
Link to the Elastic integration repo: https://github.com/elastic/integrations/tree/main/packages/cef
### Additional info
_No response_
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.