# Cef message split
**URL:** https://discuss.elastic.co/t/cef-message-split/295797
**Category:** Logstash
**Created:** [January 31, 2022, 2:49am UTC](https://discuss.elastic.co/t/cef-message-split/295797 "2022-01-31T02:49:09Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Rohit\_Mangotra](https://discuss.elastic.co/u/Rohit_Mangotra)
#### Post date: [January 31, 2022, 2:49am UTC](https://discuss.elastic.co/t/cef-message-split/295797/1 "2022-01-31T02:49:09Z")
Hi,
I am new to ELK and learning it now as part of my job. I am getting .cef logs from imperva waf that needs to be split in to fields so that it can be uploaded to the Elastic.
Please let me know how I can achieve this?
Is there any grok template that I can use?
Your help would be really appreciated.
Thanks
Rohit.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 31, 2022, 3:03am UTC](https://discuss.elastic.co/t/cef-message-split/295797/2 "2022-01-31T03:03:54Z")
How are you receiving the CEF logs?
CEF logs can be decoded using a [cef](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-cef.html) codec. There is an example of using it [here](https://discuss.elastic.co/t/filter-cef/181215/5).
---
### Author:  [@Rohit\_Mangotra](https://discuss.elastic.co/u/Rohit_Mangotra)
#### Post date: [January 31, 2022, 3:31am UTC](https://discuss.elastic.co/t/cef-message-split/295797/3 "2022-01-31T03:31:06Z")
> [@Badger](#):
>
> CEF logs
The logs are in cef format from imperva waf and we are downloading it manually. I need some help in changing this cef format to json so that it can be uploaded to Elastic.
---
### Author:  [@Rohit\_Mangotra](https://discuss.elastic.co/u/Rohit_Mangotra)
#### Post date: [January 31, 2022, 3:34am UTC](https://discuss.elastic.co/t/cef-message-split/295797/4 "2022-01-31T03:34:19Z")
Do this have to be in two different files or can be in one .conf file
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 31, 2022, 3:40am UTC](https://discuss.elastic.co/t/cef-message-split/295797/5 "2022-01-31T03:40:04Z")
That would be in two different files, so that you have multiple pipelines configured using [pipelines.yml](https://www.elastic.co/guide/en/logstash/current/multiple-pipelines.html).
---
### Author:  [@Rohit\_Mangotra](https://discuss.elastic.co/u/Rohit_Mangotra)
#### Post date: [January 31, 2022, 4:08am UTC](https://discuss.elastic.co/t/cef-message-split/295797/6 "2022-01-31T04:08:46Z")
I have configured the pipeline as mentioned in the document but I am getting the error message below:
sudo /usr/share/logstash/bin/logstash
Thread.exclusive is deprecated, use Thread::Mutex
WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
**ERROR: Failed to read pipelines yaml file. Location: /usr/share/logstash/config/pipelines.yml**
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 28, 2022, 4:08am UTC](https://discuss.elastic.co/t/cef-message-split/295797/7 "2022-02-28T04:08:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.