CEF message parsing

Elastic Stack Logstash
1

Hello,

I'm using TCP Input plugin with CEF codec to receive CEF messages. Problem is, that some messages are not parsed parsed correctly. Message isn't processed as whole, but it's split at blankspace character within message.

This is my input:

input {
        tcp {
        port => 5514
        codec => cef
        }
}

I configured delimiter for CEF codec, and it helped to fix the issue on one instance (version 7.15.1)

input {
        tcp {
        port => 5514
        codec => cef { delimiter => "\n" }
        }
}

But when i tried it on other instance (version logstash 7.16.2), logstash won't process any messages in that pipeline.

Do you know what could be issue here?

Thank you.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.