# Does Common Event Format (CEF) not allow a custom ingestion pipeline?

**URL:** <https://discuss.elastic.co/t/does-common-event-format-cef-not-allow-a-custom-ingestion-pipeline/377009>\
**Category:** SIEM\
**Created:** [April 10, 2025, 3:58pm UTC](https://discuss.elastic.co/t/does-common-event-format-cef-not-allow-a-custom-ingestion-pipeline/377009 "2025-04-10T15:58:42Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cristina\_Marletta\_Li](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cristina_marletta_li/32/137793_2.png) [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\
**Post date:** [April 10, 2025, 3:58pm UTC](https://discuss.elastic.co/t/does-common-event-format-cef-not-allow-a-custom-ingestion-pipeline/377009/1 "2025-04-10T15:58:42Z")

</div>

Hi,  
CEF integration does not allow to add a custom ingestion policy? Is this correct?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 10, 2025, 4:12pm UTC](https://discuss.elastic.co/t/does-common-event-format-cef-not-allow-a-custom-ingestion-pipeline/377009/2 "2025-04-10T16:12:17Z")

</div>

That's not correct, there is a custom ingest pipeline that you can use, but the CEF decoding is done on the agent side, not on the Ingest Pipeline side.

---

<div class="post-metadata">

**Author:** ![Cristina\_Marletta\_Li](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cristina_marletta_li/32/137793_2.png) [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\
**Post date:** [April 11, 2025, 9:01am UTC](https://discuss.elastic.co/t/does-common-event-format-cef-not-allow-a-custom-ingestion-pipeline/377009/3 "2025-04-11T09:01:02Z")

</div>

Hi Leandro,  
I have 2 integration policies of type CEF. The first one allows to insert custom ingestion policy, the second one does not. Here is the screenshot:

 ![immagine](https://us1.discourse-cdn.com/elastic/original/3X/3/0/30cf7c8f5f3cc2d294704dd7882ec31b8a58ffdb.png)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 11, 2025, 12:47pm UTC](https://discuss.elastic.co/t/does-common-event-format-cef-not-allow-a-custom-ingestion-pipeline/377009/4 "2025-04-11T12:47:56Z")

</div>

Are the integrations on the same version in the policies?

Please share the other integration configuration as well.

---

<div class="post-metadata">

**Author:** ![Cristina\_Marletta\_Li](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cristina_marletta_li/32/137793_2.png) [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\
**Post date:** [April 11, 2025, 4:18pm UTC](https://discuss.elastic.co/t/does-common-event-format-cef-not-allow-a-custom-ingestion-pipeline/377009/5 "2025-04-11T16:18:24Z")

</div>

Hi Leandro,  
both the same version.  
Here the screenshots:

 ![immagine](https://us1.discourse-cdn.com/elastic/original/3X/4/0/407c2f9a1e3df0a1ff421b83a9fd0f5fdeb08f32.png)  
 ![immagine](https://us1.discourse-cdn.com/elastic/original/3X/6/2/621c65512438d20aaa11fea1443c3507a184657f.png)  
 ![immagine](https://us1.discourse-cdn.com/elastic/original/3X/0/a/0ae8170bda4d1606111f70acada3e0c0446381a4.png)  
 ![immagine](https://us1.discourse-cdn.com/elastic/original/3X/9/d/9d48018ac5afb12c91b80e42c968d05d6a16ae90.png)  
 ![immagine](https://us1.discourse-cdn.com/elastic/original/3X/0/5/05d126ae37401e77280599815ee99e1952f4ab0c.png)  
 ![immagine](https://us1.discourse-cdn.com/elastic/original/3X/0/a/0aa1ffabfdeafebba79d50b1e241b7894e3bb027.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 9, 2025, 4:19pm UTC](https://discuss.elastic.co/t/does-common-event-format-cef-not-allow-a-custom-ingestion-pipeline/377009/6 "2025-05-09T16:19:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.