# Logstash config - Kafka and CEF

**URL:** <https://discuss.elastic.co/t/logstash-config-kafka-and-cef/333669>\
**Category:** Logstash\
**Created:** [May 17, 2023, 2:18pm UTC](https://discuss.elastic.co/t/logstash-config-kafka-and-cef/333669 "2023-05-17T14:18:23Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![elizZ](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elizz/32/119704_2.png) [@elizZ](https://discuss.elastic.co/u/elizZ)\
**Post date:** [May 17, 2023, 2:18pm UTC](https://discuss.elastic.co/t/logstash-config-kafka-and-cef/333669/1 "2023-05-17T14:18:23Z")

</div>

Hi,

I have a Logstash input of Kafka(codec cef), that consumes arcsight CEF format events from a kafka topic and writes it to elastic with 'elasticsearch' output

I have an issue when some of the events have multiline fields.  
The events stored in kafka has new line characters("\n").  
for example(from kafka topic):

```auto
msg=ExecutionPolicy:Undefined\nScope:MachinePolicy\nUser:xxx\noccurrences:1

```

When the logstash consumes(pulls) the events from the kafka and stores them to elastic, instead of leaving it as is so Kibana could read it as a new line, it adds another backslash(escaping).  
for example(json from kibana discover):

```auto
"message": "ExecutionPolicy:Undefined\\nScope:MachinePolicy\\nUser:xxx\\noccurrences:1",

```

example(table from kibana discover):

```auto
message
ExecutionPolicy:Undefined\nScope:MachinePolicy\nUser:xxx\noccurrences:1

```

I want Logstash to avoid escaping the backslash with another backslash so elk show it as new line.  
good exapmple(json from kibana discover):

```auto
"message": "NLA_Enabled:Disabled\nRDS_Enabled:Disabled\nService_Startup_Type:Manual\nService_Status:Stopped\noccurrences:1",

```

good example(table from kibana discover):  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/e/5efdca7db5f1b148363ac202da44a6b65bd84edb.png)

logstash config:

```auto
input {
 kafka {
	    bootstrap_servers=> "xxx"
		codec => cef {}
		topics => "xxx"
		group_id => "xxx"      
		auto_offset_reset => "latest"
		client_id => "xxx"
     }
}
output {  
	elasticsearch {
		hosts => ["xxx"]		
		index => "xxx"
		template_name => "xxx"
		user => "xxx"
		password => "xxx"
		ssl => true
        ssl_certificate_verification => false
        cacert => "xxx.cer"
	}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 14, 2023, 2:18pm UTC](https://discuss.elastic.co/t/logstash-config-kafka-and-cef/333669/2 "2023-06-14T14:18:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.