AWS WAF

{
    "@timestamp": "2019-12-13T23:40:12.771Z",
    "agent": {
        "ephemeral_id": "3f08e9d1-4bf2-48ac-a1c2-5f964731b310",
        "id": "43134ba7-5828-4a32-939f-51cbba764839",
        "name": "elastic-agent-83365",
        "type": "filebeat",
        "version": "8.19.4"
    },
    "aws": {
        "s3": {
            "bucket": {
                "arn": "arn:aws:s3:::elastic-package-aws-bucket-75204",
                "name": "elastic-package-aws-bucket-75204"
            },
            "object": {
                "key": "waf.log"
            }
        },
        "waf": {
            "arn": "arn:aws:wafv2:ap-southeast-2:EXAMPLE12345:regional/webacl/STMTest/1EXAMPLE-2ARN-3ARN-4ARN-123456EXAMPLE",
            "format_version": "1",
            "id": "regional/webacl/STMTest/1EXAMPLE-2ARN-3ARN-4ARN-123456EXAMPLE",
            "labels": [
                {
                    "name": "value"
                }
            ],
            "request": {
                "headers": {
                    "Accept": "*/*",
                    "Host": "localhost:1989",
                    "User-Agent": "curl/7.61.1",
                    "x-stm-test": "10 AND 1=1"
                }
            },
            "terminating_rule_match_details": [
                {
                    "conditionType": "SQL_INJECTION",
                    "location": "HEADER",
                    "matchedData": [
                        "10",
                        "AND",
                        "1"
                    ]
                }
            ]
        }
    },
    "cloud": {
        "account": {
            "id": "EXAMPLE12345"
        },
        "provider": "aws",
        "region": "ap-southeast-2",
        "service": {
            "name": "wafv2"
        }
    },
    "data_stream": {
        "dataset": "aws.waf",
        "namespace": "99205",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "43134ba7-5828-4a32-939f-51cbba764839",
        "snapshot": false,
        "version": "8.19.4"
    },
    "event": {
        "action": "BLOCK",
        "agent_id_status": "verified",
        "category": [
            "web",
            "network"
        ],
        "dataset": "aws.waf",
        "ingested": "2026-01-29T05:58:10Z",
        "kind": "event",
        "original": "{\"timestamp\":1576280412771,\"formatVersion\":1,\"webaclId\":\"arn:aws:wafv2:ap-southeast-2:EXAMPLE12345:regional/webacl/STMTest/1EXAMPLE-2ARN-3ARN-4ARN-123456EXAMPLE\",\"terminatingRuleId\":\"STMTest_SQLi_XSS\",\"terminatingRuleType\":\"REGULAR\",\"action\":\"BLOCK\",\"terminatingRuleMatchDetails\":[{\"conditionType\":\"SQL_INJECTION\",\"location\":\"HEADER\",\"matchedData\":[\"10\",\"AND\",\"1\"]}],\"httpSourceName\":\"-\",\"httpSourceId\":\"-\",\"ruleGroupList\":[],\"rateBasedRuleList\":[],\"nonTerminatingMatchingRules\":[],\"httpRequest\":{\"clientIp\":\"89.160.20.156\",\"country\":\"AU\",\"headers\":[{\"name\":\"Host\",\"value\":\"localhost:1989\"},{\"name\":\"User-Agent\",\"value\":\"curl/7.61.1\"},{\"name\":\"Accept\",\"value\":\"*/*\"},{\"name\":\"x-stm-test\",\"value\":\"10 AND 1=1\"}],\"uri\":\"/foo\",\"args\":\"\",\"httpVersion\":\"HTTP/1.1\",\"httpMethod\":\"GET\",\"requestId\":\"rid\"},\"labels\":[{\"name\":\"value\"}]}",
        "type": [
            "access",
            "denied"
        ]
    },
    "http": {
        "request": {
            "id": "rid",
            "method": "GET"
        },
        "version": "1.1"
    },
    "input": {
        "type": "aws-s3"
    },
    "log": {
        "file": {
            "path": "https://elastic-package-aws-bucket-75204.s3.us-east-1.amazonaws.com/waf.log"
        },
        "offset": 0
    },
    "network": {
        "protocol": "http",
        "transport": "tcp"
    },
    "related": {
        "ip": [
            "89.160.20.156"
        ]
    },
    "rule": {
        "id": "STMTest_SQLi_XSS",
        "ruleset": "REGULAR"
    },
    "source": {
        "as": {
            "number": 29518,
            "organization": {
                "name": "Bredband2 AB"
            }
        },
        "geo": {
            "city_name": "Linköping",
            "continent_name": "Europe",
            "country_iso_code": "SE",
            "country_name": "Sweden",
            "location": {
                "lat": 58.4167,
                "lon": 15.6167
            },
            "region_iso_code": "SE-E",
            "region_name": "Östergötland County"
        },
        "ip": "89.160.20.156"
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "aws-waf"
    ],
    "url": {
        "path": "/foo"
    }
}