---
title: Cef codec plugin v5.0.2
description: Plugin version: v5.0.2, Released on: 2017-11-07, Changelog. For other versions, see the overview list. To learn more about Logstash, see the Logstash...
url: https://www.elastic.co/docs/reference/logstash/versioned-plugins/v5-0-2-plugins-codecs-cef
products:
  - Logstash
applies_to:
  - Elastic Stack: Generally available
---

# Cef codec plugin v5.0.2
- Plugin version: v5.0.2
- Released on: 2017-11-07
- [Changelog](https://github.com/logstash-plugins/logstash-codec-cef/blob/v5.0.2/CHANGELOG.md)

For other versions, see the [overview list](https://www.elastic.co/docs/reference/logstash/versioned-plugins/codec-cef-index).
To learn more about Logstash, see the [Logstash Reference](https://www.elastic.co/guide/en/logstash/current/index.html).

## Getting help

For questions about the plugin, open a topic in the [Discuss](http://discuss.elastic.co) forums. For bugs or feature requests, open an issue in [Github](https://github.com/logstash-plugins/logstash-codec-cef). For the list of Elastic supported plugins, please consult the [Elastic Support Matrix](https://www.elastic.co/support/matrix#matrix_logstash_plugins).

## Description

Implementation of a Logstash codec for the ArcSight Common Event Format (CEF) Based on Revision 20 of Implementing ArcSight CEF, dated from June 05, 2013 
If this codec receives a payload from an input that is not a valid CEF message, then it will produce an event with the payload as the *message* field and a *_cefparsefailure* tag.

## Cef Codec Configuration Options


| Setting                                             | Input type                                                    | Required |
|-----------------------------------------------------|---------------------------------------------------------------|----------|
| [`delimiter`](#v5.0.2-plugins-codecs-cef-delimiter) | [string](/docs/reference/logstash/plugins/value-types#string) | No       |
| [`fields`](#v5.0.2-plugins-codecs-cef-fields)       | [array](/docs/reference/logstash/plugins/value-types#array)   | No       |
| [`name`](#v5.0.2-plugins-codecs-cef-name)           | [string](/docs/reference/logstash/plugins/value-types#string) | No       |
| [`product`](#v5.0.2-plugins-codecs-cef-product)     | [string](/docs/reference/logstash/plugins/value-types#string) | No       |
| [`severity`](#v5.0.2-plugins-codecs-cef-severity)   | [string](/docs/reference/logstash/plugins/value-types#string) | No       |
| [`signature`](#v5.0.2-plugins-codecs-cef-signature) | [string](/docs/reference/logstash/plugins/value-types#string) | No       |
| [`vendor`](#v5.0.2-plugins-codecs-cef-vendor)       | [string](/docs/reference/logstash/plugins/value-types#string) | No       |
| [`version`](#v5.0.2-plugins-codecs-cef-version)     | [string](/docs/reference/logstash/plugins/value-types#string) | No       |


### `delimiter`

- Value type is [string](/docs/reference/logstash/plugins/value-types#string)
- There is no default value for this setting.

If your input puts a delimiter between each CEF event, you’ll want to set this to be that delimiter.
For example, with the TCP input, you probably want to put this:
```
input {
  tcp {
    codec => cef { delimiter => "\r\n" }
    # ...
  }
}
```

This setting allows the following character sequences to have special meaning:
- `\r` (backslash "r") - means carriage return (ASCII 0x0D)
- `\n` (backslash "n") - means newline (ASCII 0x0A)


### `deprecated_v1_fields` (OBSOLETE)

- OBSOLETE WARNING: This configuration item is obsolete and will prevent the pipeline from starting if used
- Value type is [boolean](/docs/reference/logstash/plugins/value-types#boolean)
- There is no default value for this setting.


### `fields`

- Value type is [array](/docs/reference/logstash/plugins/value-types#array)
- Default value is `[]`

Fields to be included in CEV extension part as key/value pairs

### `name`

- Value type is [string](/docs/reference/logstash/plugins/value-types#string)
- Default value is `"Logstash"`

Name field in CEF header. The new value can include `%{foo}` strings to help you build a new value from other parts of the event.

### `product`

- Value type is [string](/docs/reference/logstash/plugins/value-types#string)
- Default value is `"Logstash"`

Device product field in CEF header. The new value can include `%{foo}` strings to help you build a new value from other parts of the event.

### `sev` (OBSOLETE)

- OBSOLETE WARNING: This configuration item is obsolete and will prevent the pipeline from starting.
- Value type is [string](/docs/reference/logstash/plugins/value-types#string)
- There is no default value for this setting.

Obsolete severity field for CEF header use :severity instead.

### `severity`

- Value type is [string](/docs/reference/logstash/plugins/value-types#string)
- Default value is `"6"`

Severity field in CEF header. The new value can include `%{foo}` strings to help you build a new value from other parts of the event.
Defined as field of type string to allow sprintf. The value will be validated to be an integer in the range from 0 to 10 (including). All invalid values will be mapped to the default of 6.

### `signature`

- Value type is [string](/docs/reference/logstash/plugins/value-types#string)
- Default value is `"Logstash"`

Signature ID field in CEF header. The new value can include `%{foo}` strings to help you build a new value from other parts of the event.

### `vendor`

- Value type is [string](/docs/reference/logstash/plugins/value-types#string)
- Default value is `"Elasticsearch"`

Device vendor field in CEF header. The new value can include `%{foo}` strings to help you build a new value from other parts of the event.

### `version`

- Value type is [string](/docs/reference/logstash/plugins/value-types#string)
- Default value is `"1.0"`

Device version field in CEF header. The new value can include `%{foo}` strings to help you build a new value from other parts of the event.