Logstash CEF output 5.x vs 2.x

[hybrid (Jeff Mills)]

Hi all.
I'm successfully using an ArcSight CEF connector to read a cef output file in logstash 2.3.2.
I have just done the same using 5.2.0

However, the ArcSight connector is not picking up any events.
It seems to be because the 5.2.0 logstash is not outputting CEF line by line like the old version was.

My config is this:

if [type] == "MSDNSLog" {
    file {
      path => "/opt/logstashout/msdns-%{+YYYY-MM-dd.HH}.cef"
      codec => cef {
        fields => [end, dvchost, src, dhost, deviceExternalId, app, deviceDirection, deviceSeverity, in, out]
        product => "DNS Trace Log"
        vendor => "Microsoft"
      }
    }
  }

Is this a bug, or do I need to do something differently in the new version?

I notice in the encode section of the rb file, the old version has this:

@on_event.call(event, "#{header}|#{values}\n")

New version has this:

@on_event.call(event, "#{header}|#{values}#{@delimiter}")

[magnusbaeck (Magnus Bäck)]

It looks like you need to set delimiter => "\n" in your cef codec configuration.

[hybrid (Jeff Mills)]

Yes that's what it was.
I thought I had replied to the thread to that effect, but obviously I didn't!