# CEF codec unable to set dynamic fields

**URL:** <https://discuss.elastic.co/t/cef-codec-unable-to-set-dynamic-fields/382182>\
**Category:** Logstash\
**Created:** [September 24, 2025, 3:34am UTC](https://discuss.elastic.co/t/cef-codec-unable-to-set-dynamic-fields/382182 "2025-09-24T03:34:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![wanglin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wanglin/32/145147_2.png) [@wanglin](https://discuss.elastic.co/u/wanglin)\
**Post date:** [September 24, 2025, 3:34am UTC](https://discuss.elastic.co/t/cef-codec-unable-to-set-dynamic-fields/382182/1 "2025-09-24T03:34:50Z")

</div>

I am using the Logstash CEF Output plugin and wish to add fields dyanmically. Below is my sample code:

```auto
output {
  udp {
    port => 514
    codec => cef {
      ...
      fields => ["cef_fields"]
    }
  }
}

```

I populated `cef_fields` with the list of fields that I want to be present in the CEF string but so far It does not obtain the values of the keys in `cef_fields`, but only displays the keys.

Issue is similar to [CEF codec does not resolve extended fields](https://discuss.elastic.co/t/cef-codec-does-not-resolve-extended-fields/148354) but this was posted in 2018 and was wondering there was any new updates to this.

Any help will be greatly appreciated. Thank you!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 24, 2025, 2:00pm UTC](https://discuss.elastic.co/t/cef-codec-unable-to-set-dynamic-fields/382182/2 "2025-09-24T14:00:51Z")

</div>

> [@wanglin](#):
>
> Issue is similar to [CEF codec does not resolve extended fields](https://discuss.elastic.co/t/cef-codec-does-not-resolve-extended-fields/148354) but this was posted in 2018 and was wondering there was any new updates to this.

No, nothing has changed. The fields option is an array that lists the fields that should be encoded in the CEF output. The codec does not sprintf it, so it cannot be a field reference.