# Filebeat 7.4, decode\_cef getting error malformed value

**URL:** <https://discuss.elastic.co/t/filebeat-7-4-decode-cef-getting-error-malformed-value/202469>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 7, 2019, 3:11am UTC](https://discuss.elastic.co/t/filebeat-7-4-decode-cef-getting-error-malformed-value/202469 "2019-10-07T03:11:08Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![cling1988](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cling1988/32/84008_2.png) [@cling1988](https://discuss.elastic.co/u/cling1988)\
**Post date:** [October 7, 2019, 3:11am UTC](https://discuss.elastic.co/t/filebeat-7-4-decode-cef-getting-error-malformed-value/202469/1 "2019-10-07T03:11:08Z")

</div>

I using Filebeat 7.4 and using the decode\_cef processors.  
And I getting error "malformed value for eventAnnotationAuditTrail at pos 2165"  
After checking the raw source, the position 2165 is the "\n"

```auto
eventAnnotationModificationTime=1570414373145 eventAnnotationAuditTrail=1,1565146359654,root,Queued,,,,\n eventAnnotationVersion=1 

```

Here is my filebeat.yml configuration

```auto
filebeat.inputs:
- type: tcp
  line_delimiter: "\r\n"
  host: "0.0.0.0:9001"

processors:
- rename:
    fields:
      - {from: "message", to: "event.original"}
- decode_cef:
    field: event.original
    ecs: false

output.logstash:
  hosts: ["localhost:5155"]
  loadbalance: false
  index: filebeat

```

Any idea to fix this?

Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2019, 3:16am UTC](https://discuss.elastic.co/t/filebeat-7-4-decode-cef-getting-error-malformed-value/202469/2 "2019-11-04T03:16:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.