# Unable to parse Timestamp on CEF LOGS
**URL:** https://discuss.elastic.co/t/unable-to-parse-timestamp-on-cef-logs/288781
**Category:** Beats
**Tags:** filebeat
**Created:** [November 9, 2021, 3:27pm UTC](https://discuss.elastic.co/t/unable-to-parse-timestamp-on-cef-logs/288781 "2021-11-09T15:27:55Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Mmatos](https://discuss.elastic.co/u/Mmatos)
#### Post date: [November 9, 2021, 3:27pm UTC](https://discuss.elastic.co/t/unable-to-parse-timestamp-on-cef-logs/288781/1 "2021-11-09T15:27:55Z")
Hi,
I am having problems parsing a set of logs from sophos central Intercept X Antivirus. I am using the sophos tool to download the logs and store them in a File. "[Service and Support](https://support.sophos.com/support/s/article/KB-000036372?language=en_US)"
Of the multiple formats, the CEF is the one that is working better in Elastic. I am using Filebeat to read the file and send the logs to elastic, to parse them I am using the Decode\_cef Processor.
the problem that I have is that on the CEF logs there are two fields "end" & "rt". the "end" field is the timestamp of the event but when I get the following error "error.message
error in field 'end': value is not a valid timestamp, error in field 'rt': value is not a valid timestamp"
Is there a way to parse the end field as the timestamp without the use of logstatsh. I also tried the Timestamp processor with no luck.
Here is a sample of the logs.
Thanks
CEF:0|sophos|sophos central|1.0|Event::Endpoint::UpdateFailure|Download of WindowsCloudNextGen failed from server http:∕∕dci.sophosupd.com.|1|source\_info\_ip=192.168.1.10 customer\_id=3wertr17-rtrde-4rt35-art7-fcwre46515 endpoint\_id=456d78df-56787-3e337-basd-23e53464549347 endpoint\_type=computer id=4e36d78df-5343687-3e33347-basd-23543643433435347 group=UPDATING datastream=event **end=2021-11-09T03:14:03.523Z** duid=asdfaer4652366579y rt=2021-11-09T03:14:03.536Z dhost=frt-Gwe4231-1 suser=MMEer\erp4r64
CEF:0|sophos|sophos central|1.0|Event::Endpoint::UpdateFailure|Failed to install sed64: general error.|1|source\_info\_ip=192.168.1.1 customer\_id=3wertr17-rtrde-4rt35-art7-fcw3446515 endpoint\_id=4346d78df-53487-3e347-basd-23e53334394347 endpoint\_type=computer id=45336d78df4663487-3e347-basd-23e534453439347 group=UPDATING datastream=event **end=2021-11-09T03:24:54.588Z** duid=asdfaer4652366579y rt=2021-11-09T03:24:54.606Z dhost=lty17829 suser=MMEer\erp4r64
CEF:0|sophos|sophos central|1.0|Event::Endpoint::UpdateFailure|Download of WindowsCloudNextGen failed from server http:∕∕dci.sophosupd.com.|1|source\_info\_ip=192.168.1.18 customer\_id=334ertr17-r34de-4rt345-art7-fc34wre3415 endpoint\_id=456d34df-53437-3e3437-basd-2343434349347 endpoint\_type=computer id=4346d78df-5347-3e3447-basd-23345634534447 group=UPDATING datastream=event **end=2021-11-09T03:27:25.269Z** duid=asdfaer4652366579y rt=2021-11-09T03:27:25.297Z dhost=f34rt-Gwe4231-1 suser=MMEer\erp4r64
---
### Author:  [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [November 9, 2021, 3:46pm UTC](https://discuss.elastic.co/t/unable-to-parse-timestamp-on-cef-logs/288781/2 "2021-11-09T15:46:59Z")
Maybe just the [set processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/set-processor.html). Just run this after the cef processor.
```auto
{
"set": {
"field": "@timestamp",
"value": "{{{end}}}"
}
}
```
You might need to set your format for your @timestamp field in your [mappings](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-date-format.html) also.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 7, 2021, 5:47pm UTC](https://discuss.elastic.co/t/unable-to-parse-timestamp-on-cef-logs/288781/3 "2021-12-07T17:47:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.