Logstash CEF codec

Elastic Stack Logstash
1

Together with my collegue we found a few problems with this codec:

The first one is described here -> https://github.com/logstash-plugins/logstash-codec-cef/issues/9
Second one is related with the changes in Elasticsearch 2.0 like:

MapperParsingException[Field name [FOO.BAR] cannot contain '.']

Does anyone of you have a plan to solve that?

2

As documented, Elasticsearch 2.0 doesn't allow periods in field names. You'll have to rename your fields.

https://www.elastic.co/guide/en/elasticsearch/reference/2.0/_mapping_changes.html#_field_names_may_not_contain_dots

3

yes I know that. But maybe a good idea is to implement such kind of functionality (properly) directly on the codec layer.
There is a problem with the codec itself cause some fields like "cef_ext.whatever" are splited correctly. I have noticed this problem with for ex "ad.arcSightEventPath" field.

4

Please see: Please read: Upgrading Logstash and Elasticsearch to 2.0