cef

Collect logs from CEF

Type: cef

{% code title=”sample.yaml” %}

sources:
  cef_example:
    type: cef
    address: 0.0.0.0:9000
    mode: tcp
    route_label: ''
    tls:
      tls.enabled: false
      tls.alpn_protocols: ''
      tls.verify_certificate: true
      tls.verify_hostname: true
      tls.ca_file: ''
      tls.crt_file: ''
      tls.key_file: ''
      tls.key_pass: ''
  # optional:
  #   <key>: <value>

{% endcode %}

Fields Reference

Below are tables for Base, TLS, and Optional sections. Columns: Key, Label, Type, Default, Required, Depends on, Enum / Notes.

Base

Key	Label	Type	Default	Required	Enum / Notes	Depends on
address	Address	regex	0.0.0.0:9000	✅	The socket address to listen for connections on, or systemd{#N} to use the Nth socket passed by systemd socket activation.	—
mode	Mode	enum	tcp	✅	The type of socket to use. Enum: [“tcp”, “udp”]	—
route_label	Event Routing Label	string	“”	—	The label to use in routing these events to a destination. Defaults to source name-type.	—

TLS

Key	Label	Type	Default	Required	Enum / Notes	Depends on
tls.enabled	TLS Enabled	bool	false	—	Whether or not to require TLS for incoming or outgoing connections. When enabled and used for incoming connections, an identity certificate is also required. See tls.crt_file for more information.	mode = tcp
tls.alpn_protocols	ALPN protocols	string	“”	—	Sets the list of supported ALPN protocols. Declare the supported ALPN protocols, which are used during negotiation with peer. They are prioritized in the order that they are defined.	—
tls.verify_certificate	Verify Certificate	bool	true	—	Enables certificate verification. For components that create a server, this requires that the client connections have a valid client certificate. For components that initiate requests, this validates that the upstream has a valid certificate.	—
tls.verify_hostname	Verify Hostname	bool	true	—	Enables hostname verification. If enabled, the hostname used to connect to the remote host must be present in the TLS certificate presented by the remote host, either as the Common Name or as an entry in the Subject Alternative Name extension. Only relevant for outgoing connections.	—
tls.ca_file	Certificate Authority File	file_ca_file	“”	—	Absolute path to an additional CA certificate file.	—
tls.crt_file	Certificate File	file_crt_file	“”	—	Absolute path to a certificate file used to identify this server.	—
tls.key_file	Private Key	file_key_file	“”	—	Absolute path to a private key file used to identify this server.	—
tls.key_pass	Private Key Passphrase	string	“”	—	Passphrase used to unlock the encrypted key file.	—

Optional

Key	Label	Type	Default	Required	Enum / Notes	Depends on
description	Description	string	“”	—	The description of the entry.	—
translate_custom_fields	Translate Custom Fields	bool	false	—	Toggles translation of custom field pairs to key:value.	—
max_length	Max Length	int	—	—	The maximum buffer size of incoming messages.	mode = udp
receive_buffer_bytes	Receive Buffer	int	—	—	The size of the receive buffer used for each connection. Relevant when: mode = ‘tcp’ or mode = ‘udp’	—
permit_origin	Permit Origin	string	—	—	List of allowed origin IP networks. IP addresses must be in CIDR notation.	mode = tcp
timezone	Timezone	string	local	—	The name of the timezone to apply to timestamp conversions that do not contain an explicit time zone. The time zone name may be any name in the TZ database, or local to indicate system local time.	—