Logstash ECS to CEF Produces Common Event Format (CEF) events for ingestion by ArcSight, from Elastic Common Schema (ECS) events. Roughly based on the mapping spreadsheet from this ECS Github Issue Suggestions for improvements welcome.