CEF codec unable to set dynamic fields

Elastic Stack Logstash
1

I am using the Logstash CEF Output plugin and wish to add fields dyanmically. Below is my sample code:

output {
  udp {
    port => 514
    codec => cef {
      ...
      fields => ["cef_fields"]
    }
  }
}

I populated cef_fields with the list of fields that I want to be present in the CEF string but so far It does not obtain the values of the keys in cef_fields, but only displays the keys.

Issue is similar to CEF codec does not resolve extended fields but this was posted in 2018 and was wondering there was any new updates to this.

Any help will be greatly appreciated. Thank you!

2

No, nothing has changed. The fields option is an array that lists the fields that should be encoded in the CEF output. The codec does not sprintf it, so it cannot be a field reference.