I have strange issue,
I am receiving logs in CEF format from fireeye under index=fireeye. On search Head I am seeing fields being properly extracted under CEF format but on ES app, it is not showing as on search head. on both ends I have same type of packages installed. Is ES app stops CEF format field extraction ?
