# SAP

### **SAP**

SAP stores logs in binary format by default. A schedule task to dump logs in CSV format has to be created in SAP.

1. Save SAP logs on particular folder (eg: /opt/g14/saplogs/) on the system/server in csv format.
2. Schedule an activity in SAP to generate the audit logs in required intervals (eg: hourly).
3. Download and install filebeat latest version by using below link.

<https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html>

4. Before starting Filebeat Edit filebeat.yml file

`File path: C:\Program Files\filebeat\filebeat.yml`

5. In Filebeat input session, can modify input enabled field false to true

![](/files/ihXbmV9bZW4OzM2mtDs1)

6\. Place your log folder path(step-2) under paths field.

![](/files/zPHOBXfSKPUg1eN94SiX)

7\. Under Elastic search output session, put # to all lines.

![](/files/YbVCgCg8mOkDY23F6YWZ)

8\. Under Logstash output session, remove comments (#) and place IP and Port.

![](/files/gMz80GhfqQFycWgfLPS7)

9\. Modify localhost to Log collector IP and modify port number (provided by blusapphire).

10\. After configuration is completed then Start the Filebeat service on PowerShell

`PS C:\Program Files\filebeat> Start-Service filebeat`


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.blusapphire.io/log-forwarding/03_log-forwarding-guide/log-forward/sap.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.