# AWS WAF: Further parsing of http\_request in logstash
**URL:** https://discuss.elastic.co/t/aws-waf-further-parsing-of-http-request-in-logstash/312347
**Category:** Logstash
**Created:** [August 18, 2022, 7:00am UTC](https://discuss.elastic.co/t/aws-waf-further-parsing-of-http-request-in-logstash/312347 "2022-08-18T07:00:24Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@kelk](https://discuss.elastic.co/u/kelk)
#### Post date: [August 18, 2022, 7:00am UTC](https://discuss.elastic.co/t/aws-waf-further-parsing-of-http-request-in-logstash/312347/1 "2022-08-18T07:00:24Z")
Further to the query: [Writing multiline grok](https://discuss.elastic.co/t/writing-multiline-grok/178214)
The raw data comes in json, so the NEW line is technically new line but `\r\n` in the json payload.
```auto
"GET /myapp/health HTTP/1.1\\r\\nHost: 52.123.133.46\\r\\nUser-Agent: Mozilla/5.0 zgrab/0.x\\r\\nAccept: */*\\r\\nAccept-Encoding: gzip\\r\\nX-Forwarded-For: 111.222.205.143\\r\\n\\r\\n"
```
Is there an already written http parser for the http\_request? Any help would be much appreciated.
Cheers
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 15, 2022, 7:00am UTC](https://discuss.elastic.co/t/aws-waf-further-parsing-of-http-request-in-logstash/312347/2 "2022-09-15T07:00:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.