# Logstash CEF Field Mapping Inconsistency Between 7.16.2 and 8.16.3

**URL:** <https://discuss.elastic.co/t/logstash-cef-field-mapping-inconsistency-between-7-16-2-and-8-16-3/374212>\
**Category:** Logstash\
**Created:** [February 7, 2025, 9:21am UTC](https://discuss.elastic.co/t/logstash-cef-field-mapping-inconsistency-between-7-16-2-and-8-16-3/374212 "2025-02-07T09:21:38Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kfiro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kfiro/32/46872_2.png) [@Kfiro](https://discuss.elastic.co/u/Kfiro)\
**Post date:** [February 7, 2025, 9:21am UTC](https://discuss.elastic.co/t/logstash-cef-field-mapping-inconsistency-between-7-16-2-and-8-16-3/374212/1 "2025-02-07T09:21:38Z")

</div>

I am running Logstash containers to process CEF messages, and I have observed an inconsistency in field mappings between Logstash **7.16.2** and **8.16.3**.

When using Logstash **7.16.2** , fields are mapped as expected, but in **8.16.3** , certain fields have changed their structure and naming conventions.

For example, in **7.16.2** , `deviceCustomString1` is parsed correctly, whereas in **8.16.3** , it is mapped as `device_custom_string_1.value` under a nested structure.

I attempted to resolve this by explicitly setting **Plugin codec-cef version** to match the one used in 7.16.2, but the issue persists.

Observed Differences:

**7.16.2**

{  
"deviceCustomString1": "0x1000"  
}

**8.16.3**  
{  
"device\_custom\_string\_1": {  
"value": "xxx-DB",  
"label": "Query Name"  
},  
}

i just put here deviceCustomString1 but its appear in many fields

- **Logstash Version (Working):** 7.16.2
- **Logstash Version (Issue Observed):** 8.16.3

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 7, 2025, 1:37pm UTC](https://discuss.elastic.co/t/logstash-cef-field-mapping-inconsistency-between-7-16-2-and-8-16-3/374212/2 "2025-02-07T13:37:45Z")

</div>

This expected, is a breaking change on version 8 related to ecs\_compatibility.

The name of the fields using ecs are described [here](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-cef.html#plugins-codecs-cef-field-mapping).

To have the same behavior as on version 7 you need to add `pipeline.ecs_compatibility: disabled` into the pipeline configuration on `pipelines.yml`, or globally on `logstash.yml`.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 7, 2025, 1:41pm UTC](https://discuss.elastic.co/t/logstash-cef-field-mapping-inconsistency-between-7-16-2-and-8-16-3/374212/3 "2025-02-07T13:41:55Z")

</div>

You can also change the ECS compatability on the [just the codec](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-cef.html#plugins-codecs-cef-ecs_compatibility).

---

<div class="post-metadata">

**Author:** ![Kfiro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kfiro/32/46872_2.png) [@Kfiro](https://discuss.elastic.co/u/Kfiro)\
**Post date:** [February 8, 2025, 7:57am UTC](https://discuss.elastic.co/t/logstash-cef-field-mapping-inconsistency-between-7-16-2-and-8-16-3/374212/4 "2025-02-08T07:57:55Z")

</div>

thank you  
it works