# Help with filter

**URL:** <https://discuss.elastic.co/t/help-with-filter/239556>\
**Category:** Logstash\
**Created:** [July 2, 2020, 12:28am UTC](https://discuss.elastic.co/t/help-with-filter/239556 "2020-07-02T00:28:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rocanelo](https://avatars.discourse-cdn.com/v4/letter/r/a9a28c/32.png) [@rocanelo](https://discuss.elastic.co/u/rocanelo)\
**Post date:** [July 2, 2020, 12:28am UTC](https://discuss.elastic.co/t/help-with-filter/239556/1 "2020-07-02T00:28:10Z")

</div>

Dear community  
I have the next logs:

\<6\> CEF:0|A10|TH1040S|4.1.4-GR1-P2|WAF62| **filter-resp-hdrs** |6|rt=Jul 01 2020 20:14:29 src=X.X.X.X spt=36230 dst=X.X.X.X dpt=443 dhost=axd341sas12jf.enjoy.cl cs1=WAF\_TEST cs2=8e139634be358ee9 act=sanitize cs3=learn app=HTTPS requestMethod=GET cn1=2 request=/crm.secciones/api/cms/Secciones/Seccion/GetUnidadHeader?idUnidad=3&idIdioma=1 msg=Header Server filtered

I'm using kv and work fine, but I need extract the data in column "filter-resp-hdrs" this field is changing accord the event, I'm try using gork but was not suscefuly.  
what do you suggest??

best regards.

---

<div class="post-metadata">

**Author:** ![chitreshg](https://avatars.discourse-cdn.com/v4/letter/c/df705f/32.png) [@chitreshg](https://discuss.elastic.co/u/chitreshg)\
**Post date:** [July 2, 2020, 5:06am UTC](https://discuss.elastic.co/t/help-with-filter/239556/2 "2020-07-02T05:06:39Z")

</div>

can you give the example of how do you want to form the data, what are the fields and respected value you require?

---

<div class="post-metadata">

**Author:** ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)\
**Post date:** [July 2, 2020, 5:13pm UTC](https://discuss.elastic.co/t/help-with-filter/239556/3 "2020-07-02T17:13:39Z")

</div>

take a look at cef codec

[https://www.elastic.co/guide/en/logstash/current/plugins-codecs-cef.html](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-cef.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 30, 2020, 5:13pm UTC](https://discuss.elastic.co/t/help-with-filter/239556/4 "2020-07-30T17:13:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.