Start your 14-day free trial today

No Credit Card Required

Try Logit.io Free

Already have an account? Sign In

Send data via CheckPoint to your Logstash instance provided by Logit.io

CheckPoint

Ship logs from CheckPoint to logstash

Step 1 - Pre-requisitesCopy

Check Point "Log Exporter" is an easy and secure method for exporting Check Point logs over the syslog protocol. Exporting can be done in few standard protocols and formats.

CheckPoint Log Exporter

Step 2 - Configure Check Point Log ExporterCopy

You can start CheckPoint Log Exporter with the following syntax:

To send logs from all domains:

cp_log_export add name logitio_filebeat_exporter \
target-server <Insert_IP_of_Filebeat_Server> \
target-port 514 \
protocol udp \
format syslog \
--apply-now

To send logs for a specific domain

cp_log_export add name logitio_filebeat_exporter \
domain-server <Insert_Your_Domain> \
target-server <Insert_IP_of_Filebeat_Server> \
target-port 514 \
protocol udp \
format syslog \
--apply-now

For more configuration options see CheckPoint Log Exporter

Step 3 - Install FilebeatCopy

deb (Debian/Ubuntu/Mint)

curl -L -O https://artifacts.elastic.co/downloads/beats//-oss-7.15.1-amd64.deb
sudo dpkg -i -oss-7.15.1-amd64.deb

rpm (CentOS/RHEL/Fedora)

curl -L -O https://artifacts.elastic.co/downloads/beats//-oss-7.15.1-x86_64.rpm
sudo rpm -vi -oss-7.15.1-x86_64.rpm

macOS

curl -L -O https://artifacts.elastic.co/downloads/beats//-oss-7.15.1-darwin-x86_64.tar.gz
tar xzvf -oss-7.15.1-darwin-x86_64.tar.gz

Windows

  • Download and extract the Windows zip file.
  • Rename the -<version>-windows directory to ``.
  • Open a PowerShell prompt as an Administrator.
  • Run the following to install as a Windows service:
.\install-service-.ps1
If script execution is disabled on your system, you need to set the execution policy for the current session to allow the script to run. For example: PowerShell.exe -ExecutionPolicy UnRestricted -File .\install-service-.ps1.
My OS isn't here! Chat to support now

Step 4 - Configure FilebeatCopy

Copy and use the CheckPoint Filebeat configuration below.

For use with version 7.x Filebeats.
# ============================== Filebeat inputs ==============================
filebeat.inputs:

- type: udp

  # Change to true to enable this input configuration.
  enabled: true
  max_message_size: 10MiB
  host: "0.0.0.0:514"
  
  fields_under_root: true
  encoding: utf-8
  ignore_older: 3h

# ================================== Outputs ===================================
<div class="sw-warning">
    <b>No input available! </b> Your stack is missing the required input for this data source <a href="#" onclick="Intercom('showNewMessage')" class="btn btn-info btn-sm">Talk to support to add the input</a>
</div> 

Step 5 - How to diagnose no data in StackCopy

If you don't see data appearing in your Stack after following the steps, visit the Help Centre guide for steps to diagnose no data appearing in your Stack or Chat to support now.

Toggle View

Expand View

Return to Search

© 2022 Logit.io Ltd, All rights reserved.