CP_LOG_EXPORTER - export only spesific fields and add quots to fields

[asher]

Hi all

i working and testing the cp_log_exporter tool,

i create a syslog target server with format LEEF for the example.

i want to:

1. add quots to all fields 

2. export only spesific fields and not all

i edit the leef file configuration and i managed add quots to values but not to fields:

<ExportLogFormat>
<start_message_body>{</start_message_body>
<end_message_body>}</end_message_body>
<message_separator>&#10;</message_separator> <!-- &#10;=='\n' -->
<value_encapsulation_start>&quot;</value_encapsulation_start>
<value_encapsulation_end>&quot;</value_encapsulation_end>
<fields_separatator>;</fields_separatator> <!-- &#09;=='\t' -->
<field_value_separatator> = </field_value_separatator>
<escape_chars>

part off the syslog output:

method:"GET" sev:"Unknown" sev:"Low"

you can see that only valus get quots .

also i want to export only spesifics fields and not all log,

which file i need to edit ?

[Rohit_Raut]

Hi,

To export only specific fields you can edit /opt/CPrt-R80.40/log_exporter/targets/<name>/conf/fieldsMapping.xml file or create your own fields mapping file and call it to /opt/CPrt-R80.40/log_exporter/targets/Syslog/targetConfiguration.xml file. You have to provide path of the file at mapping configuration. Below snapshot FYR.

[asher]

do you have an example for  fields mapping file?

[Rohit_Raut]

Hi,

Follow below link for details

https://community.checkpoint.com/t5/Logging-and-Reporting/Check-Point-Log-Export-filtering-field/m-p...