# Filtering mistake for spt field in logstash-codec-cef codec

**URL:** <https://discuss.elastic.co/t/filtering-mistake-for-spt-field-in-logstash-codec-cef-codec/64610>\
**Category:** Logstash\
**Created:** [November 1, 2016, 6:43pm UTC](https://discuss.elastic.co/t/filtering-mistake-for-spt-field-in-logstash-codec-cef-codec/64610 "2016-11-01T18:43:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![emegen](https://avatars.discourse-cdn.com/v4/letter/e/a8b319/32.png) [@emegen](https://discuss.elastic.co/u/emegen)\
**Post date:** [November 1, 2016, 6:43pm UTC](https://discuss.elastic.co/t/filtering-mistake-for-spt-field-in-logstash-codec-cef-codec/64610/1 "2016-11-01T18:43:16Z")

</div>

i noticed that occasionally the logstash-codec-cef version 3.0.0 will put additional info in the cef\_ext.spt field. i'm not sure if this was an issue with the previous version of the codec. After the port it will add "externalI". This does not happen every time, just often enough to be noticeable. below is an example of how it is parsed out in kibana, does anyone know how to go about figuring out how to get this to stop happening?

cef\_ext.spt 39920 externalI

---

<div class="post-metadata">

**Author:** ![jsvd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsvd/32/6203_2.png) [@jsvd](https://discuss.elastic.co/u/jsvd)\
**Post date:** [November 2, 2016, 11:28am UTC](https://discuss.elastic.co/t/filtering-mistake-for-spt-field-in-logstash-codec-cef-codec/64610/2 "2016-11-02T11:28:57Z")

</div>

can you post an example message that generates that output and what you expected?

---

<div class="post-metadata">

**Author:** ![emegen](https://avatars.discourse-cdn.com/v4/letter/e/a8b319/32.png) [@emegen](https://discuss.elastic.co/u/emegen)\
**Post date:** [November 3, 2016, 7:42pm UTC](https://discuss.elastic.co/t/filtering-mistake-for-spt-field-in-logstash-codec-cef-codec/64610/3 "2016-11-03T19:42:21Z")

</div>

I'm trying to get the source message now but it's proving to be a little difficult. I should be able to get it though

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:31am UTC](https://discuss.elastic.co/t/filtering-mistake-for-spt-field-in-logstash-codec-cef-codec/64610/4 "2017-07-06T04:31:13Z")

</div>

Closed on July 6, 2017, 4:31am UTC