How does logstash know what human-readable names to translate the CEF log into?

Question

logstash

Hello.
I deployed the ELK stack, I send logs from the firewall to it via SYSLOG, in the CEF format.
input like this:

type => "syslog"
syslog_field => "syslog"
codec => "cef"

Sobsno everything. filters don’t do anything special, I send it to elasticsearch immediately on output.
And if I now go to kibana, then all the logs are parsed there, and instead of encodings like "src", "spt", the values ​​of the keys are already "sourceAddress" and "sourcePort". Where it's written, I can't find it.
And one more small question. In the log, Key\Value pairs are passed in two different parameters. For example,

cs4Label=Destination Zone
cs4=Untrusted.

How can they be correlated to each other during parsing and sent to the database a pair of "Destination Zone = Untrusted"?

Answer 1

Codec plugins
CEF codec for Logstash

/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-codec-cef-6.0.1-java
grep cs4Label * -iR
lib/logstash/codecs/cef.rb: "cs4Label" => "deviceCustomString4Label",