Logstash CEF codec


(Mariusz Derela) #1

Together with my collegue we found a few problems with this codec:

The first one is described here -> https://github.com/logstash-plugins/logstash-codec-cef/issues/9
Second one is related with the changes in Elasticsearch 2.0 like:

MapperParsingException[Field name [FOO.BAR] cannot contain '.']

Does anyone of you have a plan to solve that?


(Magnus B├Ąck) #2

As documented, Elasticsearch 2.0 doesn't allow periods in field names. You'll have to rename your fields.

https://www.elastic.co/guide/en/elasticsearch/reference/2.0/_mapping_changes.html#_field_names_may_not_contain_dots


(Mariusz Derela) #3

yes I know that. But maybe a good idea is to implement such kind of functionality (properly) directly on the codec layer.
There is a problem with the codec itself cause some fields like "cef_ext.whatever" are splited correctly. I have noticed this problem with for ex "ad.arcSightEventPath" field.


(Aaron Mildenstein) #4

Please see: Please read: Upgrading Logstash and Elasticsearch to 2.0


(system) #5