diff --git a/docs/parsers/cef.md b/docs/parsers/cef.md index c59bbb2b..4ddb7072 100644 --- a/docs/parsers/cef.md +++ b/docs/parsers/cef.md @@ -12,7 +12,8 @@ needs. This parser will accept a single CEF string or multiple CEF string lines. Any text before "CEF" will be ignored. Syslog and CEF escaped characters -(`\\`, `\\"`, `\\]`, `\\|`, `\\n`, `\\r`) are unescaped. +(`\\`, `\\"`, `\\]`, `\\|`, `\\=`, `\\%`, ``\\#, `\\n`, `\\r`) are +unescaped. Extended fields, as defined in the CEF specification, are relabeled and the values are converted to their respective types. Extra naive and diff --git a/jc/parsers/cef.py b/jc/parsers/cef.py index f00a4746..6a2bdce4 100644 --- a/jc/parsers/cef.py +++ b/jc/parsers/cef.py @@ -7,7 +7,8 @@ needs. This parser will accept a single CEF string or multiple CEF string lines. Any text before "CEF" will be ignored. Syslog and CEF escaped characters -(`\\`, `\\"`, `\\]`, `\\|`, `\\n`, `\\r`) are unescaped. +(`\\`, `\\"`, `\\]`, `\\|`, `\\=`, `\\%`, ``\\#, `\\n`, `\\r`) are +unescaped. Extended fields, as defined in the CEF specification, are relabeled and the values are converted to their respective types. Extra naive and