# WAF logs Configuration from s3 bucket to Elasticsearch Using logstash s3 Plugin

**URL:** https://discuss.elastic.co/t/waf-logs-configuration-from-s3-bucket-to-elasticsearch-using-logstash-s3-plugin/315243
**Category:** Logstash
**Created:** [September 27, 2022, 9:23am UTC](https://discuss.elastic.co/t/waf-logs-configuration-from-s3-bucket-to-elasticsearch-using-logstash-s3-plugin/315243 "2022-09-27T09:23:27Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![dharminfadia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dharminfadia/32/119587_2.png) [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)
#### Post date: [September 27, 2022, 9:23am UTC](https://discuss.elastic.co/t/waf-logs-configuration-from-s3-bucket-to-elasticsearch-using-logstash-s3-plugin/315243/1 "2022-09-27T09:23:27Z")

</div>

Hello Everyone

I am trying to Configuring WAF 2.0 logs from s3 Bucket to elasticsearch but I am facing some erroorm please Helpme for the same.

**My Current Logstash configuration**

input {  
s3 {  
access\_key\_id =\> "myid"  
secret\_access\_key =\> "mykey"  
region =\> "eu-west-1"  
bucket =\> "aws-waf-logs-waf2.0"  
prefix =\> "AWSLogs/1234564897/WAFLogs/cloudfront/MY-WAF/2022/ **/** / **/** /1234564897\_waflogs\_cloudfront\_MY-WAF\*"  
type =\> "waf-log"  
interval =\> "10"  
sincedb\_path =\> "/tmp/.waf-log\_since.db"  
}  
}  
filter {  
if [type] == "waf-log" {  
json {  
source =\> "message"  
}  
date {  
match =\> ["[timestamp]", "UNIX\_MS" ]  
}  
geoip {  
source =\> ["[httpRequest][clientIp]" ]  
target =\> geoip  
}  
ruby {  
code =\> '  
event.get("[httpRequest][headers]").each { |kv|  
event.set(name = kv["name"], value = kv["value"])}  
'  
}  
}  
}  
output {  
elasticsearch {  
user =\> "myuser"  
password =\> "mypass"  
ssl =\> "true"  
ssl\_certificate\_verification =\> "false"  
hosts =\> ["[https://xx.xx.xx.xx:9200](https://xx.xx.xx.xx:9200)"]  
index =\> "waf-logs-%{+YYYY.MM.dd}"  
ilm\_enabled =\> false  
}  
}

**Current Error Which I am Facing**

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/6/a644763e97508c4a1f655ddcf3481d14d23ced56.png)

kindly Help ASAP I m Stuck in this situation.

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [September 27, 2022, 11:39am UTC](https://discuss.elastic.co/t/waf-logs-configuration-from-s3-bucket-to-elasticsearch-using-logstash-s3-plugin/315243/2 "2022-09-27T11:39:50Z")

</div>

Your error log is pretty clear, you have some error with your credentials to access the s3 bucket, you need to check if it is everything correct.

---

<div class="post-metadata">

### Author: ![dharminfadia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dharminfadia/32/119587_2.png) [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)
#### Post date: [October 19, 2022, 9:32am UTC](https://discuss.elastic.co/t/waf-logs-configuration-from-s3-bucket-to-elasticsearch-using-logstash-s3-plugin/315243/3 "2022-10-19T09:32:46Z")

</div>

@leandrojmp  
Thank you for Reply

Now In this Logs I am not able to coordinate map with geo\_point feild can any suggest how I can Achive this

and WAF logs size is too much can we decrease size in elasticsearch

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 16, 2022, 9:33am UTC](https://discuss.elastic.co/t/waf-logs-configuration-from-s3-bucket-to-elasticsearch-using-logstash-s3-plugin/315243/4 "2022-11-16T09:33:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.