logstash-codec-cef icon indicating copy to clipboard operation
logstash-codec-cef copied to clipboard

Published 20 hours ago • verified publisher icon logstash-plugins

Update mapping for new global eventID field

Open P1llus opened this issue 6 years ago • 0 comments

With the newest release of Connectors (7.11), ArcMC(2.90 and Logger(6.70) a new field is introduced.

The field itself is generated on the Connector, based on a unique ID per connector mapped to the CEF field "geid".

This ID is a way for all the products to have the same eventID throughout the portfolio, and it would be nice if we could reference the same ID in elastic as we do in ArcSight.

A suggestion would be to create a new indexed field called geid, leaving the current mapping as it is. Any comments?

P1llus avatar Feb 28 '19 10:02 P1llus