Why are my AWS WAF logs filtered, missing entries, or showing incomplete data?

Short description

AWS WAF logs might appear incomplete or missing because of misconfigured logging filters, non-terminating rule actions, service-specific limitations, or log propagation delays.

Resolution

Before you begin, confirm that your destination receives AWS WAF logs. If no logs arrive at all, see Why aren't my AWS WAF logs publishing to the destination that I configured?

Check the logging filter configuration

AWS WAF logging filters control the log entries that the filter keeps or drops before delivery to your logging destination. If you don't have the expected log entries, then your filter configuration might drop them.

Missing logs might happen for the following reasons:

• The filter references a misspelled label or a non-matching condition. Because the default behavior is Drop, AWS WAF discards all logs.
• A filter intended to drop health check traffic might also match legitimate requests you need to investigate.
• A filter that keeps only BLOCK actions discards all ALLOW, COUNT, CAPTCHA, and Challenge entries. If you later need to investigate non-blocked traffic, those entries aren't available.

To check your logging filter configuration, complete the following steps:

1. Open the AWS WAF console.
2. Select your web access control list (web ACL), and then choose Logging and metrics.
3. Choose Edit, and then choose Logging destination.
4. Review the Filter logs section. Check the default behavior and each filter condition.
5. Temporarily remove the filter to confirm that AWS WAF generates logs, and then reconfigure it.

Note: AWS WAF logging filters support filtering on rule actions including Allow, Block, Count, EXCLUDED_AS_COUNT, CAPTCHA, and Challenge. For instructions, see How do I sanitize AWS WAF logging?

Review field redaction settings

If AWS WAF log fields show REDACTED instead of values, then you activated field redaction in your logging configuration. Redacted fields can include URI path, query string, single header, or HTTP method.

To review or modify redaction settings, complete the following steps:

1. Open the AWS WAF console.
2. Select your web ACL, and then choose Logging and metrics.
3. Choose Edit, and then choose Logging destination.
4. In the Redacted fields section, review the fields that show REDACTED.
5. To view the full content of a redacted field, remove that field from the redaction configuration.

Note: AWS WAF applies field redaction at the logging level and doesn't affect how AWS WAF evaluates requests. If you need to temporarily view full request data for investigation, then remove redaction and reproduce the issue. Then, reactivate redaction. For more information, see Log fields for protection pack (web ACL) traffic.

Understand empty or null ruleMatchDetails values

The ruleMatchDetails and terminatingRuleMatchDetails fields show what request that matched a rule. AWS WAF populates these fields only for the following rule types:

• SQL injection (SQLi) match rules
• Cross-site scripting (XSS) match rules

The ruleMatchDetails field returns empty or null values for other rule types by design. These include IPset, geo-match, rate-based, size constraint, label match, Bot Control, ATP, ACFP, and Known Bad Inputs rules. These rule types don't support matched detail logging. AWS WAF returns empty or null values in the log field as expected behavior.

Similarly, the matchedFieldName field remains empty when rules inspect broad components such as BODY or MULTI_QUERY_STRING rather than named fields like SINGLE_HEADER or SINGLE_COOKIE.

For more information, see Log fields for protection pack (web ACL) traffic and How do I detect false positives caused by AWS Managed Rules?

The nonTerminatingMatchingRules field lists rules that matched the request but didn't end it (rules with Count, CAPTCHA, or Challenge actions that didn't block). A rule in nonTerminatingMatchingRules doesn't populate terminatingRuleMatchDetails. Only the rule that stops the request populates that field. For more information, see Managing rule group behavior.

AWS WAF logging operates on a best-effort delivery model. There can be brief delays, typically up to 10 minutes, between when AWS WAF processes a request and when the log appears in your destination. On rare occasions, log delivery can fall below 100% during traffic throttling. AWS WAF prioritizes application security over logging completeness.

If you recently generated test traffic and don't see logs, then wait at least 10 minutes before concluding that logs are missing.