> Source: [sk172984](https://support.checkpoint.com/results/sk/sk172984)

# sk172984 - Logs Exported to a 3rd party server show updates with missing or empty fields 

| Property | Value |
|----------|-------|
| Solution ID | sk172984 |
| Date Created | 2021-04-19 |
| Last Modified | 2021-04-22 |
| Technical Level | Advanced |
| Products | Security Management Server, Logging & Status |
| Versions | R81 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * Logs exported by the log_exporter tool to a 3rd party server show updates with empty fields such as "src" \& "dst".
* Logging rate is high on the server, which causes 'log-switch' on files to be frequent (every log file is switched to a new one once it reaches the maximum size of 2GB).
* The behavior is not for all logs, mostly the ones that were sent during the switch of the log file.
* The unification for the view on the 3rd party server was done using the 'hll_key' flag. This was used to search the logs and display them together.

## Cause

Expected behavior:
------------------

This is a limitation by code and cannot be changed at this time.

Limitation flow:
----------------

The SOLR engine along with the log processes on the Check Point servers are able to make a connection between the log details as SOLR holds the references for it **even after the log is switched.**   
The 3rd party server does not have any synchronization with the Check Point SOLR database, therefore it is unable to make the connection to the original log.  
When the log is switched, the LUUID field for that log changes and the 3rd party can no longer establish the connection with the missing fields.  
Because log_exporter does not perform unification on more than 1 log file this may happen.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content