Logstash: parsing AWS WAF log

Elastic Stack Logstash
1

Hi. Can i use HTTP filter (or other filter) to parse some fields from json AWS WAF logs from s3 bucket?
logstash.conf:
input{
s3 {
bucket => "XXXX"
access_key_id => "XXXX"
secret_access_key => "XXXX"
region => "XXX"
codec => "json"
}
}

I recive messages like this:
image

Output in kibana should be like:

"httpRequest.headers.Host" => "test.example.com"
"httpRequest.headers.user-agent" => "Mozilla/5.0"

Is it possible to solve this task using the HTTP or any other filter?

I already read the previous discussion)

Thanks for any reply.

2

Take a look at this.

1 Like
3

Thank. I did everything according to the instructions, but maybe I was mistaken somewhere:

image
image.png652×650 34.3 KB

A result has not changed:
image

4

You need to adjust the ruby code to fit your use case. Your field is called [httpRequest][headers] and [name] and [value] are lowercase.

1 Like
5

Thank! Everything is working!
But, i found a small mistake. Need to add "[" and "]":
image

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.