Logstash CEF codec

Together with my collegue we found a few problems with this codec:

The first one is described here -> https://github.com/logstash-plugins/logstash-codec-cef/issues/9
Second one is related with the changes in Elasticsearch 2.0 like:

MapperParsingException[Field name [FOO.BAR] cannot contain '.']

Does anyone of you have a plan to solve that?

As documented, Elasticsearch 2.0 doesn't allow periods in field names. You'll have to rename your fields.


yes I know that. But maybe a good idea is to implement such kind of functionality (properly) directly on the codec layer.
There is a problem with the codec itself cause some fields like "cef_ext.whatever" are splited correctly. I have noticed this problem with for ex "ad.arcSightEventPath" field.

Please see: Please read: Upgrading Logstash and Elasticsearch to 2.0