i noticed that occasionally the logstash-codec-cef version 3.0.0 will put additional info in the cef_ext.spt field. i'm not sure if this was an issue with the previous version of the codec. After the port it will add "externalI". This does not happen every time, just often enough to be noticeable. below is an example of how it is parsed out in kibana, does anyone know how to go about figuring out how to get this to stop happening?
cef_ext.spt 39920 externalI