Problem in logging CheckPoint R80.30 Gaia events

[HEMA2K]

In our company, we monitor CheckPoint. To determine the source of the event, it is important for us to know the value of the "ProductName" field, that is, to know the name of the blade. At the end of some logs we see characters like " id=...]  " . How can we fix this problem? An example of the full log is below.

Log [Fields@X.X.X.X.X.X.X duration="*** Confidential ***" last_hit_time="*** Confidential ***" update_count="*** Confidential ***" creation_time="*** Confidential ***" connection_count="*** Confidential ***" aggregated_log_count="*** Confidential ***" url_count="*** Confidential ***" src="*** Confidential ***" dst="*** Confidential ***" proto="*** Confidential ***" client_type_os="*** Confidential ***" web_client_type="*** Confidential ***" web_server_type="*** Confidential ***" user="*** Confidential ***" src_user_name="*** Confidential ***" src_machine_name="*** Confidential ***" src_user_dn="*** Confidential ***" snid="*** Confidential ***" dst_user_name="*** Confidential ***" dst_machine_name="*** Confidential ***" dst_user_dn="*** Confidential ***" UserCheck_incident_uid="*** Confidential ***" UserCheck="*** Confidential ***" log_id="*** Confidential ***" user_status="*** Confidential ***" portal_message="*** Confidential ***" UserCheck_Confirmation_Level="*** Confidential ***" frequency="*** Confidential ***" UserCheck_Interaction_name="*** Confidential ***" service_id="*** Confidential ***" https_inspection_action="Inspect" inzone="*** Confidential ***" outzone="*** Confidential ***" UP_match_table="*** Confidential ***" ROW_START="*** Confidential ***" match_id="*** Confidential ***" layer_uuid="*** Confidential ***" layer_name="*** Confidential ***" rule_uid="*** Confidential ***" rule_name="Internet for PC" ROW_END="*** Confidential ***" ROW_START="*** Confidential ***" match_id="*** Confidential ***" layer_uuid="*** Confidential ***" layer_name="*** Confidential ***" rule_uid="*** Confidential ***" rule_name="White List for ALL" ROW_END="*** Confidential ***" UP_match_table="*** Confidential ***" UP_action_table="*** Confidential ***" ROW_START="*** Confidential ***" action="*** Confidential ***" ROW_END="*** Confidential ***" ROW_START="*** Confidential ***" action="*** Confidential ***" ROW_END="*** Confidential ***" UP_action_table="*** Confidential ***" UP_par...]

Thanks in advance for your reply!

[_Val_]

It looks like sk101570

[HEMA2K]

Thanks for your quick answer!
But I'm afraid sk101570 doesn't solve the underlying problem. This article talks about ***Confidential*** fields. For me, this is not a solution to a non-primary problem. It is important for me to receive logs in full, without "...]" at the end.

I'll add another example. This is the end of the log, which contains fields that are important to us.

...log_uid="{36DA12B2-419E-AF4B-8FAA-36FCB53D7F12}" Extracted_file_types="" Extracted_file_names="" Extracted_file_hash="" Extracted_file_verdict="" Extracted_file_uid="" parent_file_hash="" parent_file_name="" parent_file_uid="" malware_type="" malware_family="" similar_iocs="" similar_hashes="" similar_strings="" similar_communication="" mitre_initial_access="" mitre_execution="" ...]

[PhoneBoy]

It’s not clear exactly how these logs are being monitored.
Can you elaborate on what tool(a) are being used and the precise process used?