# Check Point Filebeat module clarification

**URL:** <https://discuss.elastic.co/t/check-point-filebeat-module-clarification/243360>\
**Category:** Beats\
**Tags:** beats-module, filebeat\
**Created:** [July 31, 2020, 1:52pm UTC](https://discuss.elastic.co/t/check-point-filebeat-module-clarification/243360 "2020-07-31T13:52:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jasonwomack](https://avatars.discourse-cdn.com/v4/letter/j/e47774/32.png) [@jasonwomack](https://discuss.elastic.co/u/jasonwomack)\
**Post date:** [July 31, 2020, 1:52pm UTC](https://discuss.elastic.co/t/check-point-filebeat-module-clarification/243360/1 "2020-07-31T13:52:51Z")

</div>

I’m hoping someone can clarify how Filebeat is supposed to be setup when being used to process logs from a Check Point firewall (as covered here: [https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-checkpoint.html](https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-checkpoint.html))

The article doesn’t indicate if Filebeat is to be installed on the Check Point server or on a intermediary server that is setup to receive the output of Check Point’s cp\_log\_exporter.

Ideally, I’d like to avoid having to setup an intermediary server but I’m not sure that Filebeat can be installed on the Check Point server and how it would receive/process the output of cp\_log\_exporter all on the same system.

Thank you,  
Jason

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 28, 2020, 3:52pm UTC](https://discuss.elastic.co/t/check-point-filebeat-module-clarification/243360/2 "2020-08-28T15:52:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.