# Cef message split

**URL:** https://discuss.elastic.co/t/cef-message-split/295797
**Category:** Logstash
**Created:** [January 31, 2022, 2:49am UTC](https://discuss.elastic.co/t/cef-message-split/295797 "2022-01-31T02:49:09Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 31, 2022, 3:03am UTC](https://discuss.elastic.co/t/cef-message-split/295797/2 "2022-01-31T03:03:54Z")

</div>

How are you receiving the CEF logs?

CEF logs can be decoded using a [cef](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-cef.html) codec. There is an example of using it [here](https://discuss.elastic.co/t/filter-cef/181215/5).

---

_[View the full topic](https://discuss.elastic.co/t/cef-message-split/295797)._