Fleet CEF Processor

Elastic Stack Beats
1

Hello,

We are trying to use the CEF integration to parse syslogs sent over from SentinelOne, but are getting an error message on processing which appears to be due to the date format.

Error - Text '2022-02-09 00:25:02,862' could not be parsed, unparsed text found at index 10

Is there a simple fix to parsing this correctly that I could try?

Also, any plans on adding the ability to specify an event dataset name other than cef, like with other integrations (UDP).

Thanks

2

How did you configure it? Integration from Kibana or from Beats?

3

This is using the integration from Fleet. Using the logs-cef.log-1.3.1 pipeline.

{
  "index": {
    "default_pipeline": "logs-cef.log-1.3.1"
  }
}
4

Could you please open an issue here? Sign in to GitHub · GitHub

5

Yea I can but is there something I can do now to get it working?

6

Well, you can try to edit manually the Ingest pipeline to parse the timestamp correctly, but reporting the bug should be a simpler solution.

7

Created an issue Fleet CEF Integration Parsing Timestamp Error · Issue #2676 · elastic/integrations (github.com)

1 Like
8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.