# SAP

### **SAP**

SAP stores logs in binary format by default. A schedule task to dump logs in CSV format has to be created in SAP.

1. Save SAP logs on particular folder (eg: /opt/g14/saplogs/) on the system/server in csv format.
2. Schedule an activity in SAP to generate the audit logs in required intervals (eg: hourly).
3. Download and install filebeat latest version by using below link.

<https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html>

4. Before starting Filebeat Edit filebeat.yml file

`File path: C:\Program Files\filebeat\filebeat.yml`

5. In Filebeat input session, can modify input enabled field False to true

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MMRHZBPHlLDUc8519fX%2Fuploads%2FFTCJbiV4A2kjcuuEDg8q%2F9683dc4c%20906a%204c4b%20b73d%201a1897c177e1.png?alt=media)

6\. Place your log folder path(step-2) under paths field.

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MMRHZBPHlLDUc8519fX%2Fuploads%2FN2TEvEBYUUjdPQfQsE7H%2Fb8b52ca5%20b4fe%20490c%209f93%2020c1fd6e5268.png?alt=media)

7\. Under Elastic search output session, put # to all lines.

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MMRHZBPHlLDUc8519fX%2Fuploads%2FYxr7Q4CqUdbEpfmmOqh9%2F065ed7a0%200365%204981%209bfa%20775772068497.png?alt=media)

8\. Under Logstash output session, remove comments (#) and place IP and Port.

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MMRHZBPHlLDUc8519fX%2Fuploads%2FmQ2sI5mStfau4s5F9rPe%2F2b26928e%2047a2%204a58%20b54c%2073ff1919d1b6.png?alt=media)

9\. Modify localhost to Log collector IP and modify port number (provided by blusapphire).

10\. After configuration is completed then Start the Filebeat service on PowerShell

`PS C:\Program Files\filebeat> Start-Service filebeat`