topic Re: CP_LOG_EXPORTER - export only spesific fields and add quots to fields in General Topics

CP_LOG_EXPORTER - export only spesific fields and add quots to fields

asher — Mon, 07 Dec 2020 11:14:06 GMT

Hi all

i working and testing the cp_log_exporter tool,

i create a syslog target server with format LEEF for the example.

i want to:

1. add quots to all fields

2. export only spesific fields and not all

i edit the leef file configuration and i managed add quots to values but not to fields:

part off the syslog output:

method:"GET" sev:"Unknown" sev:"Low"

you can see that only valus get quots .

also i want to export only spesifics fields and not all log,

which file i need to edit ?

Re: CP_LOG_EXPORTER - export only spesific fields and add quots to fields

Rohit_Raut — Mon, 07 Dec 2020 12:06:25 GMT

Hi,

To export only specific fields you can edit /opt/CPrt-R80.40/log_exporter/targets/<name>/conf/fieldsMapping.xml file or create your own fields mapping file and call it to /opt/CPrt-R80.40/log_exporter/targets/Syslog/targetConfiguration.xml file. You have to provide path of the file at mapping configuration. Below snapshot FYR.

Re: CP_LOG_EXPORTER - export only spesific fields and add quots to fields

asher — Tue, 08 Dec 2020 07:22:19 GMT

do you have an example for fields mapping file?

Re: CP_LOG_EXPORTER - export only spesific fields and add quots to fields

Rohit_Raut — Tue, 08 Dec 2020 11:31:28 GMT

Hi,

Follow below link for details

https://community.checkpoint.com/t5/Logging-and-Reporting/Check-Point-Log-Export-filtering-field/m-p/96866