F5 BIG-IP Advanced WAF Parsing Rule

Parsing Rule

F5 BIG-IP Advanced WAF

Details

IDF5_BIG-IP_Advanced_WAF_ParsingRule
From Version8.4.0

Source

F5BigIPAWAF.xif F5BigIPAWAF.yml
Download History Raw 
[INGEST:vendor="f5", product="waf", target_dataset="f5_waf_raw", no_hit=keep]
filter _raw_log ~= "\<\d+\>\s*\d{4}\-\d{2}\-\d{2}T\d{2}\:\d{2}\:\d{2}[+-]\d{2}\:\d{2}"
| alter
    tmp_timestamp = arrayindex(regextract(_raw_log,"\d{4}\-\d{2}\-\d{2}T\d{2}\:\d{2}\:\d{2}[+-]\d{2}\:\d{2}"),0)
| alter
    _time = parse_timestamp("%Y-%m-%dT%H:%M:%S%Ez", tmp_timestamp)
| fields -tmp_timestamp;