# Fleet Agent - CEF Integration - Is there any way to listen on TCP?

**URL:** <https://discuss.elastic.co/t/fleet-agent-cef-integration-is-there-any-way-to-listen-on-tcp/318915>\
**Category:** Elastic Agent\
**Tags:** filebeat\
**Created:** [November 15, 2022, 2:30am UTC](https://discuss.elastic.co/t/fleet-agent-cef-integration-is-there-any-way-to-listen-on-tcp/318915 "2022-11-15T02:30:28Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![scanlan](https://avatars.discourse-cdn.com/v4/letter/s/c37758/32.png) [@scanlan](https://discuss.elastic.co/u/scanlan)\
**Post date:** [November 15, 2022, 2:30am UTC](https://discuss.elastic.co/t/fleet-agent-cef-integration-is-there-any-way-to-listen-on-tcp/318915/1 "2022-11-15T02:30:28Z")

</div>

I'm ingesting CEF based logs from another SIEM and utilizing the "Common Event Format (CEF)" integration.

It is only able to receive CEF events via _input file_, or via _UDP listener._ There is no **TCP listener** option.

 ![Screenshot 2022-11-15 132810](https://us1.discourse-cdn.com/elastic/original/3X/1/3/13521290ecc57fb69a5a672c257e6b9895933cc7.png)

As I understand it, it's built on Filebeat. I've attempted to modify the configuration files manually to try flick it over to TCP, but no luck.

Has anyone got any ideas or experience with this? Or is there a recommended workaround method where I could stand up a listener (preferably managed by Fleet if possible), that sits on the TCP port and forwards to the Fleet Agent's UDP listener port? (If not I'm thinking of trying to deploy an ArcSight SmartConnector to act as a forwarder, but I'd rather not have to go down that path.)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 15, 2022, 4:03am UTC](https://discuss.elastic.co/t/fleet-agent-cef-integration-is-there-any-way-to-listen-on-tcp/318915/2 "2022-11-15T04:03:08Z")

</div>

You will need to open an issue on github [in the integrations repository](https://github.com/elastic/integrations/issues) so elastic can implement the tcp input in this integration.

i'm not sure it is possible to add a new input to an integration without releasing a new version of it.

---

<div class="post-metadata">

**Author:** ![scanlan](https://avatars.discourse-cdn.com/v4/letter/s/c37758/32.png) [@scanlan](https://discuss.elastic.co/u/scanlan)\
**Post date:** [November 15, 2022, 5:45am UTC](https://discuss.elastic.co/t/fleet-agent-cef-integration-is-there-any-way-to-listen-on-tcp/318915/3 "2022-11-15T05:45:43Z")

</div>

Thanks for your response. I've noticed a couple of stale issues on github re. this matter from a few years back. Can't hurt to bring it to their attention again. It would make life so much easier.  
Cheers!

---

<div class="post-metadata">

**Author:** ![scanlan](https://avatars.discourse-cdn.com/v4/letter/s/c37758/32.png) [@scanlan](https://discuss.elastic.co/u/scanlan)\
**Post date:** [November 15, 2022, 7:57am UTC](https://discuss.elastic.co/t/fleet-agent-cef-integration-is-there-any-way-to-listen-on-tcp/318915/4 "2022-11-15T07:57:52Z")

</div>

Just an FYI to anyone who may stumble across this in future, I managed to find somewhat of a solution: **Processors** 🥳

Using the custom TCP Fleet integration, and adding the below `decode_cef` processors as per [here](https://www.elastic.co/guide/en/beats/filebeat/current/processor-decode-cef.html), I've managed to start ingesting CEF logs via TCP.

You can utilize the builtin assets from the CEF integration such as pipelines and dashboards as well by modifying other integration parameters. And copy the index & mapping settings from the CEF package component templates to a custom one and set in the integration settings.

**Processors JSON**

```auto
[
  {
    "decode_cef": {
      "field": message
    }
  }
]

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 13, 2022, 7:58am UTC](https://discuss.elastic.co/t/fleet-agent-cef-integration-is-there-any-way-to-listen-on-tcp/318915/5 "2022-12-13T07:58:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.