title: How to parse ArcSight CEF into Elasticsearch, if Logstash ArcSight module, Logstash CEF codec and FIlebeat decode_cef processor do not work?
body: <p>My goal is to get ArcSight CEF messages from ArcSight Transformation Hub into Elasticsearch in the parsed form. Hoever, none of the input options available from Elastic Stack do not work:</p>
  <ol>
  <li><p>Logstash ArcSight module does not work at all via SSL with Transformation Hub: <a href="https://stackoverflow.com/q/64333530/1075993">Kafka Consumer Failed to load SSL keystore (Logstash ArcSight module) for any keystore type and path</a></p>
  </li>
  <li><p>Logstash with Kafka Plugin can indeed read data from ArcSight Transofrmation Hub using SSL, but it only reads approximately 50% of the data, so that Kafka queue lag always increases, no matter what kind of setting I try (I have also tried to have 9 Logstash instances, each reading 1 of 9 Transformation Hub / Kafka pipeline, but still get the same amount of events as single Logstash instance):</p>
  <ul>
  <li><a href="https://discuss.elastic.co/t/logstash-slow-input-for-tcp-cef-codec/199808" rel="nofollow noreferrer">https://discuss.elastic.co/t/logstash-slow-input-for-tcp-cef-codec/199808</a></li>
  <li><a href="https://discuss.elastic.co/t/never-possible-to-ingest-more-than-2-5k-with-cef-codec-enabled/152496" rel="nofollow noreferrer">https://discuss.elastic.co/t/never-possible-to-ingest-more-than-2-5k-with-cef-codec-enabled/152496</a></li>
  </ul>
  </li>
  <li><p>Filebeat also works with ArcSight Transformation Hub via SSL with client certificate authentication. However, it uses decode_cef processor. Without a modified filebeat pipeline, it is unable to parse some Windows Events and has maximum 5k EPS (I need 50k EPS). With a custom pipeline, it probably can parse everything, but almost no events are coming into the Elasticsearch (5000 events per hour instead of 50,000 events per second).</p>
  </li>
  </ol>
  <p>So the question is how to get data from ArcSight into Elasticsearch if none of 3 &quot;standard&quot; options offered by Elastic work?</p>