Filtering mistake for spt field in logstash-codec-cef codec

Elastic Stack Logstash
1

i noticed that occasionally the logstash-codec-cef version 3.0.0 will put additional info in the cef_ext.spt field. i'm not sure if this was an issue with the previous version of the codec. After the port it will add "externalI". This does not happen every time, just often enough to be noticeable. below is an example of how it is parsed out in kibana, does anyone know how to go about figuring out how to get this to stop happening?

cef_ext.spt 39920 externalI

2

can you post an example message that generates that output and what you expected?

3

I'm trying to get the source message now but it's proving to be a little difficult. I should be able to get it though