Log Export Script-version 1.1.0

This page describes changes in Log Export Script version 1.1.0. Refer to the [Log Export Script ] page for prerequisites, setup, and general usage.

What's new
  1. -pp/--ppcode and -c/--collection now accept any licensed product code and exportable collection for your tenant.
  2. At startup, the script checks whether the requested product code and collection are licensed and exportable for the tenant. If not, the script stops with a clear message.
  3. New optional includeFields setting in config.ini to request the default field set or all fields without listing each one.

Action required when upgrading from 1.0.0

The -pp/--ppcode option is now required. Earlier versions defaulted to SSE. Update any existing commands to include -pp explicitly. Please refer to the Collection options for various exportable collections.

Before (Version 1.0.0)

python3 insights_log_exporter.py -a start -c SWG ...
Version 1.1.0
python3 insights_log_exporter.py -a start -pp SSE -c SWG ...

Setup Changes

Updated config.ini options

In addition to the existing Fields and Filters sections (described in Log Export Script ), 1.1.0 introduces a new includeFields key.
  1. includeFields: Inside the [{ppcode}_{collection}_fields] section, add an includeFields key to indicate whether to export the default field set or all available fields.

    Accepted values are default or all (case-sensitive ALL, Default etc. are not accepted).

Note: If no config.ini is supplied, or it has no [{ppcode}_{collection}_fields] section for a collection, only the default fields are exported for that collection. For SSE point product code and SWG collection name, the default filter act != Allowed is also applied when no config.ini is supplied.
If the [{ppcode}_{collection}_fields] section is present, the values are used as follows:
  • If fields is specified, only the listed fields are exported (includeFields is ignored).
  • If only includeFields is specified, the corresponding field set (default or all) is exported.
Note:

Changed in 1.1.0:

Previously, when a config file was supplied without a fields section for a collection, all fields were exported. In 1.1.0, only the default fields are exported in that case. Use includeFields = all to retain the previous behavior.

Example config.ini using the new key:

# Fields
[SSE_SWG_fields]
fields = eventTime,crc,cry

[SSE_Admin_fields]
includeFields = all

[WS_Telemetry_fields]
includeFields = default

# Filters
[SSE_Admin_filter_crc]
eq = US

[SSE_SWG_filter_act]
ne = Allowed
Table 1. Updated Usage
Options Description Requirement
-pp, --ppcode

Licensed product code

Required (was Optional with default SSE in 1.0.0)
-c, --collection

Name of an exportable collection for the given product code

Required (no longer restricted to a fixed list of names)

For all other options, refer to the Log Export Script parent page.

Updated Examples

The example below shows the 1.1.0 command form with the now-required -pp SSE flag. Compare to the 1.0.0 example on the parent page where -pp was absent.

Start collecting logs with the 1.1.0 command form:
python3 insights_log_exporter.py -a start -d '2025-01-01 00:00:00' -k \
    -pp SSE -c SWG \
    -p portal.forcepointone.com -i tenant.insights.forcepointone.com  \
    -df csv -f config.ini