Hello friend, a question by chance, you do not have an extractor for the checkpoint firewall. I will give you an example of the logs.
-5:00 192.168.1.2 Action="allow" UUid="{0x61b35b25,0x0,0xf1137d7f,0xc0000003}" src="35.1.1.5" dst="142.250.78.68" proto="17" bytes="23081" sent_bytes="7311" received_bytes="15770" app_id="60341234" browse_time="0:00:00" Suppressed logs="4" product="Application Control" service="443" s_port="58164"

Hello friend, a question by chance, you do not have an extractor for the checkpoint firewall. I will give you an example of the logs.
-5:00 192.168.1.2 Action="allow" UUid="{0x61b35b25,0x0,0xf1137d7f,0xc0000003}" src="35.1.1.5" dst="142.250.78.68" proto="17" bytes="23081" sent_bytes="7311" received_bytes="15770" app_id="60341234" browse_time="0:00:00" Suppressed logs="4" product="Application Control" service="443" s_port="58164"