# Logstash and IDMEF **URL:** \ **Category:** Logstash\ **Created:** [December 9, 2015, 1:24pm UTC](https://discuss.elastic.co/t/logstash-and-idmef/36745 "2015-12-09T13:24:24Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![saidiahd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saidiahd/32/6554_2.png) [@saidiahd](https://discuss.elastic.co/u/saidiahd)\ **Post date:** [December 9, 2015, 1:24pm UTC](https://discuss.elastic.co/t/logstash-and-idmef/36745/1 "2015-12-09T13:24:24Z")
Hi Folk, is logstash support Collect, Enrich & Transport Data normalized in IDMEF (Intrusion Detection Message Exchange Format) format ? IDMEF it's define data formats and exchange procedures for sharing information of interest to intrusion detection and response systems and to the management systems that may need to interact with them. You can find all what you need about IDMEF in [http://ietf.org/rfc/rfc4765.txt](http://ietf.org/rfc/rfc4765.txt) or throw this PDF [http://ietf.org/rfc/rfc4765.txt.pdf](http://ietf.org/rfc/rfc4765.txt.pdf). cheers, ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 9, 2015, 1:44pm UTC](https://discuss.elastic.co/t/logstash-and-idmef/36745/2 "2015-12-09T13:44:35Z")
There's nothing built-in for this but maybe it's possible to write a plugin for it. If you can give an example of what you want to do maybe those of us who don't know IDMEF could better assess Logstash's suitability. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 10, 2015, 3:36am UTC](https://discuss.elastic.co/t/logstash-and-idmef/36745/3 "2015-12-10T03:36:07Z")
I am sure you could write a codec for it _hint hint_ 😉 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:19am UTC](https://discuss.elastic.co/t/logstash-and-idmef/36745/4 "2017-07-06T05:19:12Z")