checkpoint-fw.conf

input {
  file {
    type => "checkpoint-firewall"
    start_position => "beginning"
    path => "/Checkpoint/*.txt"
  }
}
filter {
  if ([message] =~ /^#/) {
    drop { }
    }
  if [type] == "checkpoint-firewall" {
    csv {
      columns => ["number","date","time","interface","orgin","fw-type","action","service","s-port","s-ip","d-ip","proto","rule","rule-name","rule-number","user","information","product","src-machine","src-user"]
      separator => " "
      remove_field => [ "message" ]
      remove_field => [ "rule" ]
      remove_field => [ "rule-name" ]
      remove_field => [ "rule-number" ]
      remove_field => [ "user" ]
      remove_field => [ "product" ]
      remove_field => [ "number" ]
      remove_field => [ "interface" ]
      remove_field => [ "src-machine" ]
      remove_field => [ "src-user" ]
    }
    mutate {
      replace => [ "date", "%{date} %{time}" ]
      remove_field => [ "time" ]
    }
    date {
      match => [ "date", "ddMMMYYYY HH:mm:ss" ]
      target => [ "datetime"]
      remove_field => [ "date" ]
    }
    geoip {
      source => "s-ip"
    }
  }
}
output {
  elasticsearch {
    embedded => true
    index => "checkpointlogs"
  }
}