Logstash CEF Field Mapping Inconsistency Between 7.16.2 and 8.16.3

Elastic Stack Logstash
1

I am running Logstash containers to process CEF messages, and I have observed an inconsistency in field mappings between Logstash 7.16.2 and 8.16.3.

When using Logstash 7.16.2, fields are mapped as expected, but in 8.16.3, certain fields have changed their structure and naming conventions.

For example, in 7.16.2, deviceCustomString1 is parsed correctly, whereas in 8.16.3, it is mapped as device_custom_string_1.value under a nested structure.

I attempted to resolve this by explicitly setting Plugin codec-cef version to match the one used in 7.16.2, but the issue persists.

Observed Differences:

7.16.2

{
"deviceCustomString1": "0x1000"
}

8.16.3
{
"device_custom_string_1": {
"value": "xxx-DB",
"label": "Query Name"
},
}

i just put here deviceCustomString1 but its appear in many fields

  • Logstash Version (Working): 7.16.2
  • Logstash Version (Issue Observed): 8.16.3
2

This expected, is a breaking change on version 8 related to ecs_compatibility.

The name of the fields using ecs are described here.

To have the same behavior as on version 7 you need to add pipeline.ecs_compatibility: disabled into the pipeline configuration on pipelines.yml, or globally on logstash.yml.

1 Like
3

You can also change the ECS compatability on the just the codec.

3 Likes
4

thank you
it works