> For the complete documentation index, see [llms.txt](https://docs.blusapphire.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.blusapphire.io/log-forwarding/03_log-forwarding-guide/log-forward/sap.md).

# SAP

### **SAP**

SAP stores logs in binary format by default. A schedule task to dump logs in CSV format has to be created in SAP.

1. Save SAP logs on particular folder (eg: /opt/g14/saplogs/) on the system/server in csv format.
2. Schedule an activity in SAP to generate the audit logs in required intervals (eg: hourly).
3. Download and install filebeat latest version by using below link.

<https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html>

4. Before starting Filebeat Edit filebeat.yml file

`File path: C:\Program Files\filebeat\filebeat.yml`

5. In Filebeat input session, can modify input enabled field false to true

![](/files/ihXbmV9bZW4OzM2mtDs1)

6\. Place your log folder path(step-2) under paths field.

![](/files/zPHOBXfSKPUg1eN94SiX)

7\. Under Elastic search output session, put # to all lines.

![](/files/YbVCgCg8mOkDY23F6YWZ)

8\. Under Logstash output session, remove comments (#) and place IP and Port.

![](/files/gMz80GhfqQFycWgfLPS7)

9\. Modify localhost to Log collector IP and modify port number (provided by blusapphire).

10\. After configuration is completed then Start the Filebeat service on PowerShell

`PS C:\Program Files\filebeat> Start-Service filebeat`