elastic / elastic/docs-content

[Website]: CEF field mapping mismatch

Open
#5,533 2 comments 0 reactions 0 assignees View on GitHub
community source:web Team:Ingest
Dominant language
No language data
Stars
47
Forks
261
Avg merge
3d 12h
Merged PRs (30d)
116

Description

### Type of issue

Inaccurate

### What documentation page is affected

https://www.elastic.co/docs/reference/logstash/plugins/plugins-codecs-cef

### What happened?

When performing some parsing on CEF data, I found that some fields are not the same between the logstash codec plugin and the Elastic Integration.

For example for the field `deviceCustomString2`, the integration maps it to `cef.extensions.deviceCustomString2`, when the Logstash plugin maps it to `[cef][device_custom_string_2][value]` (which translate t to `cef.device_custom_string_2.value` in ES).

According to the last update of the logstash codec (2024-10-22). Its doc should be updated to match the integration mapping, which is more up to date.

Link to the Elastic integration repo: https://github.com/elastic/integrations/tree/main/packages/cef

### Additional info

_No response_

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.