# Plugin to generate CEF output for ARCsight **URL:** \ **Category:** Logstash\ **Created:** [November 1, 2017, 10:18am UTC](https://discuss.elastic.co/t/plugin-to-generate-cef-output-for-arcsight/106016 "2017-11-01T10:18:02Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![oscario](https://avatars.discourse-cdn.com/v4/letter/o/f19dbf/32.png) [@oscario](https://discuss.elastic.co/u/oscario)\ **Post date:** [November 1, 2017, 10:18am UTC](https://discuss.elastic.co/t/plugin-to-generate-cef-output-for-arcsight/106016/1 "2017-11-01T10:18:03Z")
Hi, I see a lot of answers using the cef-codes plugin to parse CEF output from i.e. ARCsight. I need the other way around: generate CEF output (from syslog but probably also from other formats) to use as input for ARCsight. I saw a similar question here unanswered ([Need to config codec-cef as output](https://discuss.elastic.co/t/need-to-config-codec-cef-as-output/101596)). Forgive me if this is a dumb question... Kind regards, Oscar. ---
**Author:** ![oscario](https://avatars.discourse-cdn.com/v4/letter/o/f19dbf/32.png) [@oscario](https://discuss.elastic.co/u/oscario)\ **Post date:** [November 1, 2017, 12:09pm UTC](https://discuss.elastic.co/t/plugin-to-generate-cef-output-for-arcsight/106016/2 "2017-11-01T12:09:55Z")
Hi, I just understood ARCsight can listen for syslog messages. When ARCsight wants to _pull_ data it wants CEF.. I guess this answers my question, thanks anyway, correct my if I'm wrong. Kind regards, Oscar. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 29, 2017, 12:09pm UTC](https://discuss.elastic.co/t/plugin-to-generate-cef-output-for-arcsight/106016/3 "2017-11-29T12:09:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.