https://community.checkpoint.com/t5/API-CLI-Discussion/log-exporter-fieldmapping-xml-how-to-exclusions/m-p/211931#M8481 <P>Hello Everyone,</P><P>&nbsp;</P><P>i would like to understand how to exclude certain log fields of certain blades.</P><P>As far as i unterstand and according to <SPAN>sk122323,&nbsp;</SPAN>you add a filterGroup to the fieldmapping.xml, so this is what i came up with so far:</P><LI-CODE lang="markup">&lt;filterGroup operator="and"&gt; &lt;!-- Firewall blade --&gt; &lt;product name="Firewall" operator="and"&gt; &lt;field name="layer_name" operator="or"&gt;&lt;/field&gt; &lt;field name="layer_uuid" operator="or"&gt;&lt;/field&gt; &lt;field name="logid" operator="or"&gt;&lt;/field&gt; &lt;field name="nat_addtnl_rulenum" operator="or"&gt;&lt;/field&gt; &lt;field name="parent_rule" operator="or"&gt;&lt;/field&gt; &lt;required&gt;false&lt;/required&gt; &lt;/product&gt; &lt;!-- HTTPS Inspection blade --&gt; &lt;product name="HTTPS Inspection" operator="and"&gt; &lt;field name="https_inspection_rule_id" operator="or"&gt;&lt;/field&gt; &lt;field name="service" operator="or"&gt;&lt;/field&gt; &lt;field name="proto" operator="or"&gt;&lt;/field&gt; &lt;field name="ifdir" operator="or"&gt;&lt;/field&gt; &lt;required&gt;false&lt;/required&gt; &lt;/product&gt; &lt;!-- Threat Emulation blade --&gt; &lt;product name="Threat Emulation" operator="and"&gt; &lt;field name="file_sha1" operator="or"&gt;&lt;/field&gt; &lt;field name="file_sha256" operator="or"&gt;&lt;/field&gt; &lt;field name="layer_uuid" operator="or"&gt;&lt;/field&gt; &lt;required&gt;false&lt;/required&gt; &lt;/field&gt; &lt;/product&gt; &lt;/filterGroup&gt;</LI-CODE><P>Am i on the right track? I feel like this is not a difficult task, but i&nbsp;cant wrap my head around about what the interpreter expects.</P><P>Has someone done this before and can give me some advise?</P> Mon, 22 Apr 2024 08:04:06 GMT Ambross 2024-04-22T08:04:06Z https://community.checkpoint.com/t5/API-CLI-Discussion/log-exporter-fieldmapping-xml-how-to-exclusions/m-p/211931#M8481 <P>Hello Everyone,</P><P>&nbsp;</P><P>i would like to understand how to exclude certain log fields of certain blades.</P><P>As far as i unterstand and according to <SPAN>sk122323,&nbsp;</SPAN>you add a filterGroup to the fieldmapping.xml, so this is what i came up with so far:</P><LI-CODE lang="markup">&lt;filterGroup operator="and"&gt; &lt;!-- Firewall blade --&gt; &lt;product name="Firewall" operator="and"&gt; &lt;field name="layer_name" operator="or"&gt;&lt;/field&gt; &lt;field name="layer_uuid" operator="or"&gt;&lt;/field&gt; &lt;field name="logid" operator="or"&gt;&lt;/field&gt; &lt;field name="nat_addtnl_rulenum" operator="or"&gt;&lt;/field&gt; &lt;field name="parent_rule" operator="or"&gt;&lt;/field&gt; &lt;required&gt;false&lt;/required&gt; &lt;/product&gt; &lt;!-- HTTPS Inspection blade --&gt; &lt;product name="HTTPS Inspection" operator="and"&gt; &lt;field name="https_inspection_rule_id" operator="or"&gt;&lt;/field&gt; &lt;field name="service" operator="or"&gt;&lt;/field&gt; &lt;field name="proto" operator="or"&gt;&lt;/field&gt; &lt;field name="ifdir" operator="or"&gt;&lt;/field&gt; &lt;required&gt;false&lt;/required&gt; &lt;/product&gt; &lt;!-- Threat Emulation blade --&gt; &lt;product name="Threat Emulation" operator="and"&gt; &lt;field name="file_sha1" operator="or"&gt;&lt;/field&gt; &lt;field name="file_sha256" operator="or"&gt;&lt;/field&gt; &lt;field name="layer_uuid" operator="or"&gt;&lt;/field&gt; &lt;required&gt;false&lt;/required&gt; &lt;/field&gt; &lt;/product&gt; &lt;/filterGroup&gt;</LI-CODE><P>Am i on the right track? I feel like this is not a difficult task, but i&nbsp;cant wrap my head around about what the interpreter expects.</P><P>Has someone done this before and can give me some advise?</P> Mon, 22 Apr 2024 08:04:06 GMT https://community.checkpoint.com/t5/API-CLI-Discussion/log-exporter-fieldmapping-xml-how-to-exclusions/m-p/211931#M8481 Ambross 2024-04-22T08:04:06Z https://community.checkpoint.com/t5/API-CLI-Discussion/log-exporter-fieldmapping-xml-how-to-exclusions/m-p/211943#M8482 <P>AFAIK the filter configuration of log exporter is to exclude entire logs and not specific fields.</P> Mon, 22 Apr 2024 09:53:59 GMT https://community.checkpoint.com/t5/API-CLI-Discussion/log-exporter-fieldmapping-xml-how-to-exclusions/m-p/211943#M8482 Amir_Senn 2024-04-22T09:53:59Z