# Logstash CEF output 5.x vs 2.x

**URL:** <https://discuss.elastic.co/t/logstash-cef-output-5-x-vs-2-x/79107>\
**Category:** Logstash\
**Created:** [March 18, 2017, 1:16am UTC](https://discuss.elastic.co/t/logstash-cef-output-5-x-vs-2-x/79107 "2017-03-18T01:16:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![hybrid](https://avatars.discourse-cdn.com/v4/letter/h/e99b99/32.png) [@hybrid](https://discuss.elastic.co/u/hybrid)\
**Post date:** [March 18, 2017, 1:16am UTC](https://discuss.elastic.co/t/logstash-cef-output-5-x-vs-2-x/79107/1 "2017-03-18T01:16:23Z")

</div>

Hi all.  
I'm successfully using an ArcSight CEF connector to read a cef output file in logstash 2.3.2.  
I have just done the same using 5.2.0

However, the ArcSight connector is not picking up any events.  
It seems to be because the 5.2.0 logstash is not outputting CEF line by line like the old version was.

My config is this:

```auto
if [type] == "MSDNSLog" {
    file {
      path => "/opt/logstashout/msdns-%{+YYYY-MM-dd.HH}.cef"
      codec => cef {
        fields => [end, dvchost, src, dhost, deviceExternalId, app, deviceDirection, deviceSeverity, in, out]
        product => "DNS Trace Log"
        vendor => "Microsoft"
      }
    }
  }
```

Is this a bug, or do I need to do something differently in the new version?

I notice in the encode section of the rb file, the old version has this:

```auto
@on_event.call(event, "#{header}|#{values}\n")
```

New version has this:

```auto
@on_event.call(event, "#{header}|#{values}#{@delimiter}")
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 21, 2017, 6:16am UTC](https://discuss.elastic.co/t/logstash-cef-output-5-x-vs-2-x/79107/2 "2017-03-21T06:16:35Z")

</div>

It looks like you need to set `delimiter => "\n"` in your cef codec configuration.

---

<div class="post-metadata">

**Author:** ![hybrid](https://avatars.discourse-cdn.com/v4/letter/h/e99b99/32.png) [@hybrid](https://discuss.elastic.co/u/hybrid)\
**Post date:** [March 21, 2017, 7:26am UTC](https://discuss.elastic.co/t/logstash-cef-output-5-x-vs-2-x/79107/3 "2017-03-21T07:26:54Z")

</div>

Yes that's what it was.  
I thought I had replied to the thread to that effect, but obviously I didn't!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 18, 2017, 7:26am UTC](https://discuss.elastic.co/t/logstash-cef-output-5-x-vs-2-x/79107/4 "2017-04-18T07:26:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.