# Filter cef

**URL:** https://discuss.elastic.co/t/filter-cef/181215
**Category:** Logstash
**Created:** [May 15, 2019, 2:22pm UTC](https://discuss.elastic.co/t/filter-cef/181215 "2019-05-15T14:22:24Z")
**Posts on this page:** 1
**Showing post:** 5

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 16, 2019, 2:28pm UTC](https://discuss.elastic.co/t/filter-cef/181215/5 "2019-05-16T14:28:57Z")

</div>

I was assuming that pipeline inputs and outputs would respect the codec if the user configured one, but that appears not to be the case. However, it works with a tcp input and output

```
input { generator { count => 1 lines => ['Foo'] } }
filter {
    mutate { add_field => { cefField => "Jan 18 11:07:53 dsmhost CEF:0|Trend Micro|Deep Security Manager|<DSM version>|600|Administrator Signed In|4|suser=Master randomPiggyBackedData=a1s2d3f4g5" } }
}
output { tcp { host => "localhost" port => 12888 codec => plain { format => "%{cefField}" } } }

```

and

```
input { tcp { host => localhost port => 12888 codec => cef } }
output { stdout {} }

```

gets me

```
           "cefVersion" => "0",
        "deviceVersion" => "<DSM version>",
           "@timestamp" => 2019-05-16T14:27:44.576Z,
   "deviceEventClassId" => "600",
                 "port" => 48406,
       "sourceUserName" => "Master",
                 "name" => "Administrator Signed In",
"randomPiggyBackedData" => "a1s2d3f4g5",
               "syslog" => "Jan 18 11:07:53 dsmhost",
         "deviceVendor" => "Trend Micro",
                 "host" => "localhost",
             "@version" => "1",
        "deviceProduct" => "Deep Security Manager",
             "severity" => "4"

```

Note the randomPiggyBackedData, which could be all of the other fields encoded. As charlie suggested, you could then decode in the second pipeline so you do not have to join different events together.

---

_[View the full topic](https://discuss.elastic.co/t/filter-cef/181215)._