# CEF processor

**URL:** https://discuss.elastic.co/t/cef-processor/386165
**Category:** Elasticsearch
**Tags:** ingest-pipeline
**Created:** [May 5, 2026, 9:58am UTC](https://discuss.elastic.co/t/cef-processor/386165 "2026-05-05T09:58:32Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Moe\_Hmaidan](https://avatars.discourse-cdn.com/v4/letter/m/8e8cbc/32.png) [@Moe\_Hmaidan](https://discuss.elastic.co/u/Moe_Hmaidan)
#### Post date: [May 5, 2026, 9:58am UTC](https://discuss.elastic.co/t/cef-processor/386165/1 "2026-05-05T09:58:32Z")

</div>

Does the newly introduced cef processor require license?

---

<div class="post-metadata">

### Author: ![Keith\_Massey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/keith_massey/32/83666_2.png) [@Keith\_Massey](https://discuss.elastic.co/u/Keith_Massey)
#### Post date: [May 5, 2026, 1:33pm UTC](https://discuss.elastic.co/t/cef-processor/386165/2 "2026-05-05T13:33:11Z")

</div>

It comes with the basic (free) license.

---

<div class="post-metadata">

### Author: ![Moe\_Hmaidan](https://avatars.discourse-cdn.com/v4/letter/m/8e8cbc/32.png) [@Moe\_Hmaidan](https://discuss.elastic.co/u/Moe_Hmaidan)
#### Post date: [May 5, 2026, 3:13pm UTC](https://discuss.elastic.co/t/cef-processor/386165/3 "2026-05-05T15:13:12Z")

</div>

I upgraded my staging node to 9.3.4 and can't find it in ingest pipelines or by using dev tools.

---

<div class="post-metadata">

### Author: ![Keith\_Massey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/keith_massey/32/83666_2.png) [@Keith\_Massey](https://discuss.elastic.co/u/Keith_Massey)
#### Post date: [May 5, 2026, 3:32pm UTC](https://discuss.elastic.co/t/cef-processor/386165/4 "2026-05-05T15:32:28Z")

</div>

It is likely that Kibana just hasn't been updated to know about it yet. The processor is present in the free tier in 9.3.4. If you are building your pipeline using the elasticsearch API, you ought to be able to add a CEF processor by giving it type "cef".

---

<div class="post-metadata">

### Author: ![Keith\_Massey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/keith_massey/32/83666_2.png) [@Keith\_Massey](https://discuss.elastic.co/u/Keith_Massey)
#### Post date: [May 5, 2026, 3:42pm UTC](https://discuss.elastic.co/t/cef-processor/386165/5 "2026-05-05T15:42:35Z")

</div>

A colleague pointed out to me that this functionality is coming to kibana soon: [[Ingest pipelines] Add CEF processor by SoniaSanzV · Pull Request #266352 · elastic/kibana · GitHub](https://github.com/elastic/kibana/pull/266352).
