Function parse_cef() does not parsed the string, but on playground.vrl.dev website the message is parsed #1454
Description
A note for the community
Message for parsed:
{ "message": "CEF:1|Microsoft|Microsoft Windows WMI Activity||Microsoft-Windows-WMI-Activity:5857|Microsoft-Windows-WMI-Activity|Low|eventId=10223573 externalId=5857 start=1753856830316 end=1753856830316 art=1753856959017 cat=Microsoft-Windows-WMI-Activity/Operational deviceSeverity=Information rt=1753856830316 duser=NETWORK SERVICE oldFileHash=en_US|UTF-8 cs1={\"Operation_StartedOperational\":{\"@_xmlns_\":\"http://manifests.microsoft.com/win/2006/windows/WMI\",\"ProviderName\":\"Win32_WIN32_TERMINALSERVICE_Prov\",\"Code\":\"0x0\",\"HostProcess\":\"wmiprvse.exe\",\"ProcessID\":\"7080\",\"ProviderPath\":\"%SystemRoot%\\system32\\tscfgwmi.dll\"}} cs2=None cs3=Microsoft-Windows-WMI-Activity cs2Label=EventlogCategory cs3Label=UserData ahost=abc.abc.abc.net agt=10.10.10.10 agentZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 10.0.0.0-10.255.255.255 amac=40-A6-B7-B8-39-A9 at=winc dvchost=abc.abc.abc.net dvc=10.10.15.13 deviceZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 172.16.0.0-172.31.255.255 _cefVer=1.0 ad.EventRecordID=277537 ad.Version=0 ad.ThreadID=20360 ad.Opcode=Info ad.ProcessID=7080 aid=39u1FgJEBABCACHtAUahVXQ\\=\\=" }
Problem
Function parse_cef() does not parsed the string, but on playground.vrl.dev website the message is parsed
VRL Program
transforms:
decode_cef:
type: remap
inputs: ["kafka_cef"]
source: |
messagecef = string!(.message)
del(.)
messagecef = replace!(messagecef, "| ", "|")
parsedcef, err = parse_cef(messagecef, translate_custom_fields: true)
.parsed77 = parsedcef
if err == null {
.parsed77 = parsedcef
.source77 = messagecef
} else {
.error77 = messagecef
log("CEF RAW: " + string!(messagecef))
}
VRL and/or Vector Version
vector 0.48.0 (x86_64-pc-windows-msvc a67e4e2 2025-06-30 18:25:45.272082383)
Debug Output
Example
Additional Context
No response
References
No response