# Parsing LEEF data

**URL:** https://discuss.elastic.co/t/parsing-leef-data/314448
**Category:** Logstash
**Created:** [September 14, 2022, 6:38pm UTC](https://discuss.elastic.co/t/parsing-leef-data/314448 "2022-09-14T18:38:54Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![sta02](https://avatars.discourse-cdn.com/v4/letter/s/5f8ce5/32.png) [@sta02](https://discuss.elastic.co/u/sta02)
#### Post date: [September 14, 2022, 6:38pm UTC](https://discuss.elastic.co/t/parsing-leef-data/314448/1 "2022-09-14T18:38:54Z")

</div>

Hello,  
How can I parse LEEF data. The format includes | separation in the heard and SPACE separation in Body. Below is a sample event, please advise.

The objective is to parse both the LEEF header (LEEF:1.0|Cyber-Ark|Vault|12.2.0002|361|sev=6 ) and rest of the body

\<5\>1 2022-09-14T07:56:47Z WIN0981 LEEF:1.0|Cyber-Ark|Vault|12.2.0002|361|sev=6 Action=Keystroke logging EventMessage=Keystroke logging OSUser= usrName=a9010@adest src=13.23.6.4 SourceUser= TargetUser= File=Root\Operating System-\_A\_UNI\_AE\_WE-10.1.10.3-ars-root Safe=APP27-LNX Location= Category= RequestId= Reason= ExtraDetails=Command=more recover\_database\_MADR03\_archivelog.log;ConnectionComponentId=PSMP-SSH;DstHost=10.1.10.3;ManagedAccount=Yes;Protocol=SSH;PSMID=PSMServer;SessionID=b546aade-3402-11ed-9b51-0050569774b7;SrcHost=10.11.5.22;User=ars-root;VIDOffset=29T; GatewayStation= CAPolicy= shost=15.29.3.8 dhost=10.1.10.3 duser=ars-root externalId=b546aade-3402-11ed-9b51-0050569774b7 app=SSH reason=more recover\_database

--  
Thanks,  
Siddarth

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 14, 2022, 11:48pm UTC](https://discuss.elastic.co/t/parsing-leef-data/314448/2 "2022-09-14T23:48:31Z")

</div>

I would suggest using a mutate filter to change that into valid CEF and then using a TCP output/input pair with a cef codec on the input as shown [here](https://discuss.elastic.co/t/filter-cef/181215/5).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 12, 2022, 11:48pm UTC](https://discuss.elastic.co/t/parsing-leef-data/314448/3 "2022-10-12T23:48:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.