# Logstash: parsing AWS WAF log

**URL:** https://discuss.elastic.co/t/logstash-parsing-aws-waf-log/195925
**Category:** Logstash
**Created:** [August 20, 2019, 12:18pm UTC](https://discuss.elastic.co/t/logstash-parsing-aws-waf-log/195925 "2019-08-20T12:18:14Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Igor\_Belyakov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/igor_belyakov/32/52615_2.png) [@Igor\_Belyakov](https://discuss.elastic.co/u/Igor_Belyakov)
#### Post date: [August 20, 2019, 12:18pm UTC](https://discuss.elastic.co/t/logstash-parsing-aws-waf-log/195925/1 "2019-08-20T12:18:14Z")

</div>

Hi. Can i use HTTP filter (or other filter) to parse some fields from json AWS WAF logs from s3 bucket?  
logstash.conf:  
input{  
s3 {  
bucket =\> "XXXX"  
access\_key\_id =\> "XXXX"  
secret\_access\_key =\> "XXXX"  
region =\> "XXX"  
codec =\> "json"  
}  
}

I recive messages like this:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/7/47bee0f7aa11657766a9280f592a244b67f6186d.png)

Output in kibana should be like:

"httpRequest.headers.Host" =\> "[test.example.com](http://test.example.com)"  
"httpRequest.headers.user-agent" =\> "Mozilla/5.0"

Is it possible to solve this task using the HTTP or any other filter?

I already read the previous [discussion](https://discuss.elastic.co/t/logstash-parsing-fields-from-json-in-array-of-another-json/149854))

Thanks for any reply.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 20, 2019, 12:35pm UTC](https://discuss.elastic.co/t/logstash-parsing-aws-waf-log/195925/2 "2019-08-20T12:35:38Z")

</div>

Take a look at [this](https://discuss.elastic.co/t/solved-split-filter-question-a-k-a-flatten-json-sub-array/130481/12).

---

<div class="post-metadata">

### Author: ![Igor\_Belyakov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/igor_belyakov/32/52615_2.png) [@Igor\_Belyakov](https://discuss.elastic.co/u/Igor_Belyakov)
#### Post date: [August 20, 2019, 1:07pm UTC](https://discuss.elastic.co/t/logstash-parsing-aws-waf-log/195925/3 "2019-08-20T13:07:08Z")

</div>

Thank. I did everything according to the instructions, but maybe I was mistaken somewhere:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/c/ec891b4b70c32c75500e84d9f6ea6f3756314439.png)

A result has not changed:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/e/1ec10a515fa661d6b7f5b5ee71ef885ab74cbbd1.png)

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 20, 2019, 1:10pm UTC](https://discuss.elastic.co/t/logstash-parsing-aws-waf-log/195925/4 "2019-08-20T13:10:15Z")

</div>

You need to adjust the ruby code to fit your use case. Your field is called [httpRequest][headers] and [name] and [value] are lowercase.

---

<div class="post-metadata">

### Author: ![Igor\_Belyakov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/igor_belyakov/32/52615_2.png) [@Igor\_Belyakov](https://discuss.elastic.co/u/Igor_Belyakov)
#### Post date: [August 20, 2019, 1:58pm UTC](https://discuss.elastic.co/t/logstash-parsing-aws-waf-log/195925/5 "2019-08-20T13:58:20Z")

</div>

Thank! Everything is working!  
But, i found a small mistake. Need to add "[" and "]":  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/0/4050ee0620ed062861e19caa722121e5e0b637de.png)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 17, 2019, 1:58pm UTC](https://discuss.elastic.co/t/logstash-parsing-aws-waf-log/195925/6 "2019-09-17T13:58:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.