# Logs from Firewall CheckPoint **URL:** \ **Category:** Logstash\ **Created:** [June 19, 2020, 4:31pm UTC](https://discuss.elastic.co/t/logs-from-firewall-checkpoint/237835 "2020-06-19T16:31:47Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![julianksanchez](https://avatars.discourse-cdn.com/v4/letter/j/54ee81/32.png) [@julianksanchez](https://discuss.elastic.co/u/julianksanchez)\ **Post date:** [June 19, 2020, 4:31pm UTC](https://discuss.elastic.co/t/logs-from-firewall-checkpoint/237835/1 "2020-06-19T16:31:48Z")
Hello, I am new in Elastic, and I want to send the logs of our firewalls CheckPoint to logstash. I configurate the log exporter in CheckPoint, however we dont know how received and configurate this information in logstash. I need create one file in logstash with input and filters? Anyone have done it? Any advance? ---
**Author:** ![mgotechlock](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Post date:** [June 19, 2020, 5:28pm UTC](https://discuss.elastic.co/t/logs-from-firewall-checkpoint/237835/2 "2020-06-19T17:28:54Z")
Not done it yet myself, but try the CheckPoint module in Filebeat. You could, on your logstash server, run filebeat, with the checkpoint module enabled, listening on some port. You configure checkpoint to send logs to that port. Configure filebeat to read them in and then output to logstash. Using this module benefits you because it comes with all the parsers to parse the chkp logs to the proper ecs fields, so you dont have to write filters in logstash to do that. ---
**Author:** ![julianksanchez](https://avatars.discourse-cdn.com/v4/letter/j/54ee81/32.png) [@julianksanchez](https://discuss.elastic.co/u/julianksanchez)\ **Post date:** [June 19, 2020, 6:09pm UTC](https://discuss.elastic.co/t/logs-from-firewall-checkpoint/237835/3 "2020-06-19T18:09:42Z")
Hi, I read the documentation, and I download filebeat 7.8 in my logstash server, this have CheckPoint module. I enabled it, and this have this configuration - module: checkpoint firewall: var.syslog\_host: 0.0.0.0 var.syslog\_port: 9001 I have a question, the var.syslog\_host is the IP from CheckPoint firewall? And I need configure the output for send the elasticsearch or if I use this module I should be able of view from filebeat index pattern? ---
**Author:** ![mgotechlock](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Post date:** [June 19, 2020, 6:32pm UTC](https://discuss.elastic.co/t/logs-from-firewall-checkpoint/237835/4 "2020-06-19T18:32:26Z")
No, var.syslog\_host is the interface on the logstash server to listen on. 0.0.0.0 means listen on all interfaces. Otherwise, you could just put in the IP of the logstash server itself, not the CHKP. So on your CHKP, you configure it to send logs to UDP 9001 of the logstash/filebeat server IP. Have you read [https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-checkpoint.html](https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-checkpoint.html)? As for outputs, filebeat supports output directly to elasticsearch if desired, as well as to logstash and others. See [https://www.elastic.co/guide/en/beats/filebeat/master/configuring-output.html](https://www.elastic.co/guide/en/beats/filebeat/master/configuring-output.html) ---
**Author:** ![julianksanchez](https://avatars.discourse-cdn.com/v4/letter/j/54ee81/32.png) [@julianksanchez](https://discuss.elastic.co/u/julianksanchez)\ **Post date:** [June 19, 2020, 6:46pm UTC](https://discuss.elastic.co/t/logs-from-firewall-checkpoint/237835/5 "2020-06-19T18:46:57Z")
OK. I understand, I could put the IP of my server, as I trying because if the firts time with Elastic I have a deployment of Kibana, elasticsearch and logstash in the same server. IN CP is ok the configuration. Thanks ---
**Author:** ![julianksanchez](https://avatars.discourse-cdn.com/v4/letter/j/54ee81/32.png) [@julianksanchez](https://discuss.elastic.co/u/julianksanchez)\ **Post date:** [June 21, 2020, 2:26am UTC](https://discuss.elastic.co/t/logs-from-firewall-checkpoint/237835/6 "2020-06-21T02:26:48Z")
hello, I dont know if I have any error in the configuration look: > Module: checkpoint > > - module: checkpoint > firewall: > enabled: true > > output.elasticsearch: > hosts: ["[https://172.18.110.35:9200](https://172.18.110.35:9200)"] > index: "filebeat-%{[agent.version]}-%{+yyyy.MM.dd}" this is the configuration on the module checkpoint.yml. and in Kibana I have an index pattern filebeat-\*, but I dont see any information. ---
**Author:** ![mgotechlock](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Post date:** [June 21, 2020, 1:11pm UTC](https://discuss.elastic.co/t/logs-from-firewall-checkpoint/237835/7 "2020-06-21T13:11:09Z")
Where did you get "var.input: syslog" from? I don't see that as a valid option anywhere in [https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-checkpoint.html](https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-checkpoint.html). You would know if you have an error in your config if you view the /var/log/filebeat/filebeat file and maybe /var/log/syslog. Restart filebeat and watch those files for any messages. Also: Confirm you see logs coming in (tcpdump udp port 514). Confirm you are connected to elasticsearch (netstat -an | grep 9200) ---
**Author:** ![julianksanchez](https://avatars.discourse-cdn.com/v4/letter/j/54ee81/32.png) [@julianksanchez](https://discuss.elastic.co/u/julianksanchez)\ **Post date:** [June 21, 2020, 3:20pm UTC](https://discuss.elastic.co/t/logs-from-firewall-checkpoint/237835/8 "2020-06-21T15:20:52Z")
Hello, Thank for your help. I can review and I found one error. I reviewed tcpdump in elastic server and I getting traffic from port 514, I can see this in overview for index pattern filebeat-\*. My question is Should I see this en section SIEM tab network? Or not? ---
**Author:** ![julianksanchez](https://avatars.discourse-cdn.com/v4/letter/j/54ee81/32.png) [@julianksanchez](https://discuss.elastic.co/u/julianksanchez)\ **Post date:** [June 21, 2020, 3:37pm UTC](https://discuss.elastic.co/t/logs-from-firewall-checkpoint/237835/9 "2020-06-21T15:37:23Z")
I review the format JSON of one log and I getting it: > Provided Grok expressions do not match field value: [\<134\>1 2020-06-22T00:09:36Z CP\_BOG CheckPoint 5561 - [action:"Accept"; flags:"278528"; ifdir:"inbound"; ifname:"eth0"; logid:"1"; loguid:"{}"; origin:"X.X.X.X"; I need create a grok or edit any another parameter? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 19, 2020, 3:47pm UTC](https://discuss.elastic.co/t/logs-from-firewall-checkpoint/237835/10 "2020-07-19T15:47:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.