CheckPoint
Ship logs from CheckPoint to logstash
Follow this step by step guide to get 'logs' from your system to Logit.io:
Step 1 - Pre-requisites
Check Point "Log Exporter" is an easy and secure method for exporting Check Point logs over the syslog protocol. Exporting can be done in few standard protocols and formats.
Step 2 - Configure Check Point Log Exporter
You can start CheckPoint Log Exporter with the following syntax:
To send logs from all domains:
cp_log_export add name logitio_filebeat_exporter \
target-server <Insert_IP_of_Filebeat_Server> \
target-port 514 \
protocol udp \
format syslog \
--apply-now
To send logs for a specific domain
cp_log_export add name logitio_filebeat_exporter \
domain-server <Insert_Your_Domain> \
target-server <Insert_IP_of_Filebeat_Server> \
target-port 514 \
protocol udp \
format syslog \
--apply-now
For more configuration options see CheckPoint Log Exporter
Step 4 - Update your configuration file
The configuration file below is pre-configured to send data to your Logit.io Stack.
Copy the configuration file below and overwrite the contents of the Filebeat configuration file typically located at /etc/filebeat/filebeat.yml
# ============================== Filebeat inputs ===============================
filebeat.inputs:
- type: udp
max_message_size: 10MiB
host: "0.0.0.0:514"
enabled: true
fields:
type:
fields_under_root: true
encoding: utf-8
ignore_older: 12h
# ================================== Outputs ===================================
output.logstash:
hosts: ["your-logstash-host:your-ssl-port"]
loadbalance: true
ssl.enabled: true
If you’re running Filebeat 7, add this code block to the end. Otherwise, you can leave it out.
# ... For Filebeat 7 only ...
filebeat.registry.path: /var/lib/filebeat
If you’re running Filebeat 6, add this code block to the end.
# ... For Filebeat 6 only ...
registry_file: /var/lib/filebeat/registry
It’s a good idea to run the configuration file through a YAML validator to rule out indentation errors, clean up extra characters, and check if your YAML file is valid. Yamllint.com is a great choice.
Step 5 - Check Logit.io for your logs
Now you should view your data:
If you don't see logs take a look at How to diagnose no data in Stack below for how to diagnose common issues.
Step 6 - How to diagnose no data in Stack
If you don't see data appearing in your Stack after following the steps, visit the Help Centre guide for steps to diagnose no data appearing in your Stack or Chat to support now.