3

I have a WAF log like

{
    "terminatingRuleId": "Default_Action",
    "action": "ALLOW",
    "nonTerminatingMatchingRules": [{
        "ruleId": "AWS-AWSManagedRulesSQLiRuleSet",
        "action": "COUNT",
        "ruleMatchDetails": [{
            "conditionType": "SQL_INJECTION",
            "location": "BODY",
            "matchedData": ["{", "limit", ":100}"]
        }]
    }],
    "requestHeadersInserted": null,
    "responseCodeSent": null,
    "httpRequest": {
        "uri": "/v0.1/updates",
        "args": "",
        "httpVersion": "HTTP/1.1",
        "httpMethod": "POST",
    }
}

Now httpRequest_uri and httpRequest_httpMethod is set as a label but we don't set nonTerminatingMatchingRules as a label. I'm looking for a way to show a log line like

POST - /v0.1/updates
 -- ruleId | COUNT | contents of ruleMatchDetails

I've tried things like

{s3="aws-waf-logs", action="ALLOW"} 
  | json match="nonTerminatingMatchingRules"
  | line_format "{{ .httpRequest_uri }}"

Because i set match to the embedded json, I can't reference httpRequest_uri anymore it seems.

Mike
  • 7,769
  • 13
  • 57
  • 81

0 Answers0