# Filebeat

**URL:** <https://discuss.elastic.co/t/filebeat/252146>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 15, 2020, 7:45am UTC](https://discuss.elastic.co/t/filebeat/252146 "2020-10-15T07:45:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![111387](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111387/32/75408_2.png) [@111387](https://discuss.elastic.co/u/111387)\
**Post date:** [October 15, 2020, 7:45am UTC](https://discuss.elastic.co/t/filebeat/252146/1 "2020-10-15T07:45:21Z")

</div>

receiving CEF format log using filebeat cef module and send to logstash

While viewing the parsed results, I could see that there was an error tag.

```
"error": {
  "message": [
    "malformed value for filePath at pos 168",
    "malformed value for attachment at pos 526",
    "malformed value for Incident_SnapshotURL at pos 807"
  ]}

```

All other items have been parsed normally, and the common point of the filePath, attachment, and Incident\_SnapshotURL where the error occurred is that there is "(" ")", and it is judged that an error has occurred.

origin message is  
`CEF:0|Symantec|DLP|15.5||주요키워드 탐지||Severity=4:정보 action=없음 Match_Count=4 Incident_ID=2726415 status=??? 신규 ??? appname=XXX.exe filePath=C:\\Users\\005034\\Desktop\\XX\\XXXXXX(1008)\\QAXX(1014)\\2020_10월 fname=2020년 10월_XX_XX XX_XX(XXXX)_ver2.xlsx msg=해당 없음 proto=XXXX XX XX XX XXX shost=X2X19X50X0-01 suser=해당 없음 suid=해당 없음 duser=해당 없음 dhost=해당 없음 attachment=C:\\Users\\005034\\Desktop\\XX\\XXXXXX(1008)\\QAXX(1014)\\2020_10월 _XX_XX XX_XX(XXXX)_ver2.xlsx Scan_Date=해당 없음 Incident_SnapshotURL=https://XXXX/ProtectManager/XXXXXXXXXXXX.do?value(variable_1)=incident.id&value(operator_1)=incident.id_in&value(operand_1)=2726415 Rules_Names=XXXXX DataOwner_Name=해당 없음 DataOwner_Email=해당 없음 Quaramtine_Parent_Path=해당 없음\u0000`

can't parse "(" ")" in filebeat CEF module ????

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [October 15, 2020, 9:22am UTC](https://discuss.elastic.co/t/filebeat/252146/2 "2020-10-15T09:22:26Z")

</div>

I looked into the issue and seems to be a valid concern. Would you mind opening an issue for Beats and report this problem?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 12, 2020, 11:22am UTC](https://discuss.elastic.co/t/filebeat/252146/3 "2020-11-12T11:22:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.