# Filebeat decode\_cef messes up fields, when not all header fields are given

**URL:** <https://discuss.elastic.co/t/filebeat-decode-cef-messes-up-fields-when-not-all-header-fields-are-given/291664>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 13, 2021, 1:53pm UTC](https://discuss.elastic.co/t/filebeat-decode-cef-messes-up-fields-when-not-all-header-fields-are-given/291664 "2021-12-13T13:53:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![buzzdeee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/buzzdeee/32/12703_2.png) [@buzzdeee](https://discuss.elastic.co/u/buzzdeee)\
**Post date:** [December 13, 2021, 1:53pm UTC](https://discuss.elastic.co/t/filebeat-decode-cef-messes-up-fields-when-not-all-header-fields-are-given/291664/1 "2021-12-13T13:53:21Z")

</div>

Hi,

the CEF spec found here: [https://community.microfocus.com/cfs-file/\_\_key/communityserver-wikis-components-files/00-00-00-00-23/3731.CommonEventFormatV25.pdf](https://community.microfocus.com/cfs-file/__key/communityserver-wikis-components-files/00-00-00-00-23/3731.CommonEventFormatV25.pdf)

it says:  
CEF uses syslog as a transport mechanism. It uses the following format, comprised of a syslog  
prefix, a header and an extension, as shown below:

```auto
Jan 18 11:07:53 host CEF:Version|Device Vendor|Device Product|Device 
Version|Device Event Class ID|Name|Severity|[Extension]

```

The CEF:Version portion of the message is a mandatory header. The remainder of the message  
is formatted using fields delimited by a pipe ("|") character. All of these remaining fields should be  
present and are defined under “Header Field Definitions” on the next page.

so, everything between the version and extensions is not mandatory.

However, when I read the code (not a golang expert) and how I understand it, the decode\_cef preprocessor seems to expect them all to exist, and that's also what I see from the results I get.

I've a problem parsing CEF2 messages from sentinelone:

My filebeat is setup like this:

```auto
  - type: tcp
    enabled: true
    max_message_size: 10MiB
    host: "0.0.0.0:8001"
    ssl:
      enabled: true
      certificate: /etc/filebeat/cert.crt
      key: /etc/filebeat/key.key
    processors:
      - rename:
          fields:
            - {from: "message", to: "event.original"}
      - decode_cef:
          field: event.original

```

running filebeat in debug, I see the following as part of event.original:

`<14>2021-12-13 12:21:29,646 sentinel - CEF:2|SentinelOne|Mgmt|suser=foo@bar.com|rt=2021-12-13 12:21:22.039732|deviceAddress=1.2.3.4|deviceHostFqdn=somehost.sentinelone.net`

The parsed data that filebeat then looks like:

```auto
  "cef": {
    "device": {
      "vendor": "SentinelOne",
      "product": "Mgmt",
      "version": "suser=foo@bar.com",
      "event_class_id": "rt=2021-12-13 12:21:22.039732"
    },
    "name": "deviceAddress=1.2.3.4",
    "version": "2"
  }

```

I'm currently with filebeat 7.15.1.

Do I understand something wrong with the CEF SPEC, and actually S1 send bogus CEF messages? Maybe there's an option to get filebeat to be not so strictly expecting all fields?

Sebastian

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 10, 2022, 3:53pm UTC](https://discuss.elastic.co/t/filebeat-decode-cef-messes-up-fields-when-not-all-header-fields-are-given/291664/2 "2022-01-10T15:53:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.