@Override
    public CEFParserResult evaluate(FunctionArgs args, EvaluationContext context) {
        final String cef = valueParam.required(args, context);
        final boolean useFullNames = useFullNamesParam.optional(args, context).orElse(false);

        final CEFParser parser = CEFParserFactory.create();
        if (cef == null || cef.isEmpty()) {
            LOG.debug("NULL or empty parameter passed to CEF parser function. Not evaluating.");
            return null;
        }

        LOG.debug("Running CEF parser for [{}].", cef);

        final MappedMessage message;
        try (Timer.Context timer = parseTime.time()) {
            message = new MappedMessage(parser.parse(cef.trim()), useFullNames);
        } catch (Exception e) {
            LOG.error("Error while parsing CEF message: {}", cef, e);
            return null;
        }

        final Map<String, Object> fields = new HashMap<>();

        /*
         * Add all CEF standard fields. We are prefixing with cef_ to avoid overwriting existing fields or to be
         * overwritten ourselves later in the processing. The user is encouraged to run another pipeline function
         * to clean up field names if desired.
         */
        fields.put("cef_version", message.cefVersion());
        fields.put("device_vendor", message.deviceVendor());
        fields.put("device_product", message.deviceProduct());
        fields.put("device_version", message.deviceVersion());
        fields.put("device_event_class_id", message.deviceEventClassId());
        fields.put("name", message.name());
        fields.put("severity", message.severity());

        // Add all custom CEF fields.
        fields.putAll(message.mappedExtensions());

        return new CEFParserResult(fields);
    }
@Test
    public void evaluate_returns_result_for_valid_CEF_string_with_short_names_if_useFullNames_parameter_is_missing() throws Exception {
        final Map<String, Expression> arguments = Collections.singletonMap(
                CEFParserFunction.VALUE, new StringExpression(new CommonToken(0), "CEF:0|vendor|product|1.0|id|name|low|dvc=example.com msg=Foobar")
        );
        final FunctionArgs functionArgs = new FunctionArgs(function, arguments);
        final Message message = messageFactory.createMessage("__dummy", "__dummy", DateTime.parse("2010-07-30T16:03:25Z"));
        final EvaluationContext evaluationContext = new EvaluationContext(message);

        final CEFParserResult result = function.evaluate(functionArgs, evaluationContext);
        assertNotNull(result);
        assertEquals(0, result.get("cef_version"));
        assertEquals("vendor", result.get("device_vendor"));
        assertEquals("product", result.get("device_product"));
        assertEquals("1.0", result.get("device_version"));
        assertEquals("id", result.get("device_event_class_id"));
        assertEquals("low", result.get("severity"));
        assertEquals("example.com", result.get("dvc"));
        assertEquals("Foobar", result.get("msg"));
    }