# Parsing LEEF data

**URL:** https://discuss.elastic.co/t/parsing-leef-data/314448
**Category:** Logstash
**Created:** [September 14, 2022, 6:38pm UTC](https://discuss.elastic.co/t/parsing-leef-data/314448 "2022-09-14T18:38:54Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 14, 2022, 11:48pm UTC](https://discuss.elastic.co/t/parsing-leef-data/314448/2 "2022-09-14T23:48:31Z")

</div>

I would suggest using a mutate filter to change that into valid CEF and then using a TCP output/input pair with a cef codec on the input as shown [here](https://discuss.elastic.co/t/filter-cef/181215/5).

---

_[View the full topic](https://discuss.elastic.co/t/parsing-leef-data/314448)._