# Logstash doesn't want to split my CEF events

**URL:** <https://discuss.elastic.co/t/logstash-doesnt-want-to-split-my-cef-events/202562>\
**Category:** Logstash\
**Created:** [October 7, 2019, 3:50pm UTC](https://discuss.elastic.co/t/logstash-doesnt-want-to-split-my-cef-events/202562 "2019-10-07T15:50:05Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![nico88](https://avatars.discourse-cdn.com/v4/letter/n/c0e974/32.png) [@nico88](https://discuss.elastic.co/u/nico88)\
**Post date:** [October 7, 2019, 3:50pm UTC](https://discuss.elastic.co/t/logstash-doesnt-want-to-split-my-cef-events/202562/1 "2019-10-07T15:50:05Z")

</div>

Hello,

I try to parse a CEF event with logstash with this mutate:  
mutate {  
split =\> {"message" =\> "|"}  
add\_field =\> { "cef\_sig\_name" =\> "%{message[5]}" }  
add\_field =\> { "cef\_extension" =\> "%{message[7]}"}  
}

I get each time a \_mutate\_error tag because mutate cannot access to message [5] and message[7].  
I think split don't convert string to array but only replace my | by , ... So the error seems "normal".

Do you have an idea why logstash cannot convert message to array ?

I try several mutate, use a temporary field, change array access...

No idea how to resolve this 😕

Thank you for your help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2019, 3:50pm UTC](https://discuss.elastic.co/t/logstash-doesnt-want-to-split-my-cef-events/202562/2 "2019-11-04T15:50:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.