在CloudWatch Insight中搜索键 /值对以获取WAF日志

Question

因此，AWS CloudFront WAF日志被发送到AWS Cloud Insights。如何为HTTPREQUEST数组搜索密钥 /值对的随机位置？

示例日志看起来像这样：

httpRequest.headers.0.name  host
httpRequest.headers.0.value www.somedomain.com
httpRequest.headers.1.name  cache-control
httpRequest.headers.1.value no-cache
httpRequest.headers.2.name  pragma
httpRequest.headers.2.value no-cache
httpRequest.headers.3.name  accept
httpRequest.headers.3.value */*
httpRequest.headers.4.name  accept-encoding
httpRequest.headers.4.value gzip, deflate
httpRequest.headers.5.name  from
httpRequest.headers.5.value bingbot(at)microsoft.com
httpRequest.headers.6.name  user-agent
httpRequest.headers.6.value Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)

所以，一个带有2个哈希的JSON数组。该数组中的顺序是随机的。有时用户代理将在1或3或X中。如何搜索与“用户代理”的“名称”字段相对应的“值”字段的值？即：我想搜索“ bingbot”，但特定于与“用户代理”匹配。我知道我只能在@message上对bingbot < / code>进行过滤器，但这似乎很昂贵，而不是特定 /容易出现错误的命中。

Answer 1

好的，所以我认为“最简单的”方法是将@message视为字符串并写下自己的解析规则，将您想要的价值拉到自己的列中，然后您可以在此上搜索 /做任何事情。

如果有人有更好的主意，我全都是耳朵。

fields @timestamp, @message
| parse @message /(?i)"name":"user-agent","value":"(?<httpRequestUserAgent>[^"]+)/
| filter action == "BLOCK"
| stats count() as httpRequestUserAgentCount by httpRequestUserAgent 
| sort by httpRequestUserAgentCount desc 

（？i）将其标记为情况不敏感。

Answer 2

它由AWS给出：

fields @timestamp, @message
| parse @message '{"name":"User-Agent","value":"*"}' as userAgent
| stats count(*) as requestCount by userAgent
| sort requestCount desc
| limit 100

个人对WAF我发现这很有用：

fields @timestamp, action, httpRequest.country, httpRequest.uri
| parse @message /"name":"Host","value":"(?<host>[^"]*)"/
| parse @message /"name":"User-Agent","value":"(?<useragent>[^"]*)"/
| display @timestamp, host, useragent, action, httpRequest.country, httpRequest.uri
| sort @timestamp desc
| limit 100