# CEF plugin is not working as expected **URL:** \ **Category:** Logstash\ **Created:** [October 6, 2021, 12:25pm UTC](https://discuss.elastic.co/t/cef-plugin-is-not-working-as-expected/286024 "2021-10-06T12:25:05Z")\ **Posts on this page:** 1\ **Showing post:** 12
**Author:** ![Sunflower](https://avatars.discourse-cdn.com/v4/letter/s/a5b964/32.png) [@Sunflower](https://discuss.elastic.co/u/Sunflower)\ **Post date:** [October 7, 2021, 12:42pm UTC](https://discuss.elastic.co/t/cef-plugin-is-not-working-as-expected/286024/12 "2021-10-07T12:42:15Z")
I'm also trying to work with the second format they provided... seems to be challenging as well: > [@RFC-5424 log parsing](https://discuss.elastic.co/t/rfc-5424-log-parsing/286129): > > Hi, I have logs that I'm sending to Logstash from SentinelOne in an RFC-5424 format(this is the way they called it) that I wasn't sure how to handle. I began by dividing the fields using Grok and now my issue is how to handle the following part. The goal is to use the name after the space as the key and the data after the equal sign as a value (some logs may have more/fewer fields in the data). The output eventually is JSON. Do you have any suggestions? [activityType@53163 activityType="512… --- _[View the full topic](https://discuss.elastic.co/t/cef-plugin-is-not-working-as-expected/286024)._