You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The decode_cef processor is a fairly strict implementation of the Micro Focus Security ArcSight Common Event Format Version 25 specification. In this document the CEF specification declares in (aka bytesIn) and out (aka bytesOut) as Integer types.
Our parser could be more permissive and allow these fields to be treated as int64 values. It will be a slightly less strict implementation of the specification, but I think the spec should have originally marked these a Long types.
Describe the enhancement:
The
decode_cef
processor is a fairly strict implementation of the Micro Focus Security ArcSight Common Event Format Version 25 specification. In this document the CEF specification declaresin
(akabytesIn
) andout
(akabytesOut
) asInteger
types.Our parser could be more permissive and allow these fields to be treated as int64 values. It will be a slightly less strict implementation of the specification, but I think the spec should have originally marked these a
Long
types.beats/x-pack/filebeat/processors/decode_cef/cef/keys.go
Lines 91 to 98 in 57d649d
Describe a specific use case for the enhancement or feature:
Network devices with counters will be able to pass values larger than 2 GiB.
The text was updated successfully, but these errors were encountered: