I am parsing via the cef input plugin in Logstash log files in cef format to elasticsearch. At some log files I recevice the message Failed to decode CEF payload. It seems that the problem could be this values in the log file:


So how could I parse these lines of the log correctly without an error message? But for me it seems that the problem occurs at the input directive of the logstash config.

Here is my input directive of the logstash config:

    input {
       tcp {
         port => 1337
         codec => cef { delimiter => "\n\n" }



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.