# All AWS WAF event goes to message field even after using correct mapping

**URL:** https://discuss.elastic.co/t/all-aws-waf-event-goes-to-message-field-even-after-using-correct-mapping/329227
**Category:** Logstash
**Created:** [April 3, 2023, 2:55pm UTC](https://discuss.elastic.co/t/all-aws-waf-event-goes-to-message-field-even-after-using-correct-mapping/329227 "2023-04-03T14:55:22Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![SSP1](https://avatars.discourse-cdn.com/v4/letter/s/8baadc/32.png) [@SSP1](https://discuss.elastic.co/u/SSP1)
#### Post date: [April 3, 2023, 2:55pm UTC](https://discuss.elastic.co/t/all-aws-waf-event-goes-to-message-field-even-after-using-correct-mapping/329227/1 "2023-04-03T14:55:22Z")

</div>

HI, I'm using Logstash to ingest AWS WAF Logs from S3 using S3 Input login with SQS and logs are going through to elasticsearch. I can see those in Kibana but all the waf event goes to message filed. I have tried to use the following mapping but it's not working. Still all the log goes to message filed. Same goes with AWS WAF integration.

But if I manually upload the log file then it works well.

Can someone please help me? Thanks

```auto
{
  "properties": {
    "@timestamp": {
      "type": "date"
    },
    "action": {
      "type": "keyword"
    },
    "formatVersion": {
      "type": "long"
    },
    "httpRequest": {
      "type": "object"
    },
    "httpSourceId": {
      "type": "keyword"
    },
    "httpSourceName": {
      "type": "keyword"
    },
    "labels": {
      "type": "object"
    },
    "ruleGroupList": {
      "type": "object"
    },
    "terminatingRuleId": {
      "type": "keyword"
    },
    "terminatingRuleType": {
      "type": "keyword"
    },
    "timestamp": {
      "type": "date",
      "format": "epoch_millis"
    },
    "webaclId": {
      "type": "keyword"
    }
  }
}

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 1, 2023, 2:55pm UTC](https://discuss.elastic.co/t/all-aws-waf-event-goes-to-message-field-even-after-using-correct-mapping/329227/2 "2023-05-01T14:55:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.