# Logstash CEF codec and ECS cannot parse 'rt' field throws an error

**URL:** https://discuss.elastic.co/t/logstash-cef-codec-and-ecs-cannot-parse-rt-field-throws-an-error/310705
**Category:** Logstash
**Created:** [July 27, 2022, 4:17am UTC](https://discuss.elastic.co/t/logstash-cef-codec-and-ecs-cannot-parse-rt-field-throws-an-error/310705 "2022-07-27T04:17:38Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 27, 2022, 6:17pm UTC](https://discuss.elastic.co/t/logstash-cef-codec-and-ecs-cannot-parse-rt-field-throws-an-error/310705/2 "2022-07-27T18:17:37Z")

</div>

A simple configuration to reproduce this is

```
output { stdout { codec => rubydebug { metadata => false } } }
input {
    generator {
        count => 1
        lines => [
            '2022-07-26T12:03:33+08:00 InsightCef CEF:0|CMERP|INSIGHT|1|1075168|Common Name Without Domain Name|High|rt=2022-07-26T12:03:33+08:00',
            '2022-07-26T12:03:33+08:00 InsightCef CEF:0|CMERP|INSIGHT|1|1075168|Common Name Without Domain Name|High|smac=50:3e:aa:e4:19:ae'
        ]
        codec => cef
    }
}

```

with `--pipeline.ecs_compatibility disabled` both lines are parsed, but with the default ecs\_compatability setting the first one gets that timestamp parsing error. The problem is that the codec tries to normalize the field as a timestamp (you would have the same problem for end and other timestamp fields). The [timestamp normalizer](https://github.com/logstash-plugins/logstash-codec-cef/blob/032e16949ac12ba248ed510b9b8c4db903b779d9/lib/logstash/codecs/cef/timestamp_normalizer.rb#L33) is looking for something that matches

```
"MMM dd[yyyy] HH:mm:ss[.SSSSSSSSS][.SSSSSS][.SSS][zzz]"

```

From what I have read, the rt field should be formatted as "MMM dd yyyy HH:mm:ss or milliseconds since epoch (Jan 1st 1970)". It does not accept ISO8601 style formats. The parser expects a month name at the start of the timestamp string so when it gets a year it "could not be parsed at index 0".

Personally I think demanding a specific format for rt/end etc is A Bridge Too Far, but that's not my call.

To fix this, stop using a cef codec on the initial input. grok the rt= out of the message and parse it using a date filter, then mutate+gsub it out of the message. Then use a tcp output to send the event to a tcp input with a cef codec. An example of that is [here](https://discuss.elastic.co/t/filter-cef/181215/5). Do not try pipeline-to-pipeline communication, that ignores the codec setting.

---

_[View the full topic](https://discuss.elastic.co/t/logstash-cef-codec-and-ecs-cannot-parse-rt-field-throws-an-error/310705)._