# Transforming/filtering json logs
**URL:** https://discuss.elastic.co/t/transforming-filtering-json-logs/220523
**Category:** Logstash
**Created:** [February 23, 2020, 2:34am UTC](https://discuss.elastic.co/t/transforming-filtering-json-logs/220523 "2020-02-23T02:34:18Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@swisscheese](https://discuss.elastic.co/u/swisscheese)
#### Post date: [February 23, 2020, 2:34am UTC](https://discuss.elastic.co/t/transforming-filtering-json-logs/220523/1 "2020-02-23T02:34:18Z")
I have some WAF logs (from AWS) that are already in json format. I want to modify them with logstash in a few specific ways, and it’s not clear to me from the docs what the best way to do this is. Hoping someone can point me in the right direction.
Here’s an example entry:
{
"action": "ALLOW",
"formatVersion": 1,
"httpRequest": {
"args": "",
"clientIp": "1.2.3.4",
"country": "US",
"headers": [
{
"name": "Host",
"value": "[www.example.com](http://www.example.com)"
},
{
"name": "Content-Length",
"value": "890"
},
{
"name": "accept",
"value": "application/json"
},
{
"name": "content-type",
"value": "application/json"
},
{
"name": "cookie",
"value": "session=abcdefgh”
},
{
"name": "accept-encoding",
"value": "gzip,deflate"
},
{
"name": "user-agent",
"value": "curl 7.54.0"
}
],
"httpMethod": "POST",
"httpVersion": "HTTP/1.1",
"requestId": null,
"uri": “/upload”
}
"httpSourceName": "ALB",
"nonTerminatingMatchingRules": [
],
"rateBasedRuleList": [
],
"ruleGroupList": [
{
"excludedRules": null,
"nonTerminatingMatchingRules": [
],
"ruleGroupId": "",
"terminatingRule": null
}
],
"terminatingRuleId": "Default\_Action",
"terminatingRuleMatchDetails": [
],
"terminatingRuleType": "REGULAR",
"timestamp": 1581541188137,
"webaclId": ""
}
What I would like logstash to send to ES in this case is this with the following changes:
1. Only keep what’s under httpRequest, throw away everything else and make that the top level object. Although I’ll want the timestamp field as well, and use that as @timestamp.
2. Reformat the way the headers are organized from name/values in an array from (for example) headers[0].name=“Host”, headers[0].value=“[www.example.com](http://www.example.com)”
to the more logical and searchable format of [headers.Host=www.example.com](http://headers.Host=www.example.com), so something like
“headers”: {
“host”: “[www.example.com](http://www.example.com)”
...
}
1. And I probably want to get this confirming to Elastic Common Schema, but I can probably figure that out once I know what to use to accomplish 1 and 2.
Any pointers appreciated!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 22, 2020, 2:34am UTC](https://discuss.elastic.co/t/transforming-filtering-json-logs/220523/2 "2020-03-22T02:34:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.