elastic / elastic/integrations

[cef]: The cef integration does not properly create the index template, it has a wrong index pattern, and is not used when datastream name is not the default one

Open
#12,724 3 comments 1 reaction 0 assignees View on GitHub
Integration:cef needs:triage Stalled Team:Security-Deployment and Devices
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

Common Event Format (CEF) [cef]

### Dataset Name

problem exists for all datasets in integration

### Integration Version

2.20.0

### Agent Version

8.17.1

### Agent Output Type

elasticsearch

### Elasticsearch Version

8.17.1

### OS Version and Architecture

Not relevant

### Software/API Version

_No response_

### Error Message

When using the cef integration, and not using the default name cef.log for the datastream, the index template is not used. This leads to using the fallback logs template.

This results in all settings and mappings being wrong for the datastream created by the cef integration.

### Event Original

_No response_

### What did you do?

I set up the CEF Integration (with a logfile, but can be tcp or udp, doenst matter) and I **changed the datastream name** (this is important, since this leads to the cef index template not being used, which is the bug!)

![Image](https://github.com/user-attachments/assets/ed61e2cf-df76-48ca-9099-fc1983579560)

### What did you see?

Here we see that the new datastream is not set to use the cef template, but the default logs template as fallback:
![Image](https://github.com/user-attachments/assets/ceaccb2a-d3bd-4441-9c6e-b8565c1f4cfa)

The problem is that the cef template is not used:

![Image](https://github.com/user-attachments/assets/7698e29d-ca74-4fda-8735-8cd1bc339c90)

### What did you expect to see?

I expected to have the correct index template being linked to the data stream.

### Anything else?

Work around is to not use the cef integration but instead use a custom log file / tcp / udp integration with the cef processor.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.