Multiline logs in F5 Big

Question

I am trying to Audit F5 ASM Logs in SIEM platform.

The issue is, it seems like F5 is storing some of the logs with multiline description:

This makes it very difficult to parse in SIEM as they receive all the lines in reverse order:

This log is generated from: "Security ›› Application Security : URLs : Allowed URLs : Allowed HTTP URLs >> Create" action.

Is there any way to have the log description in single line?

zamroni777 · Answer

i guess they are in json or xml format.if it is, the parser should not process them as plain text but as json/xml

utkc137 · Answer

I don't think so, here's a screenshot from F5 backend:&nbsp;Any way to make F5 store these as a single line event?

nikoolayy1 · Answer

Except setting a filter with a specific source and a destination that is a format like SIEM ELK, Splunk etc. I do not see way to to do it from F5 side.
&nbsp;
https://techdocs.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-implementations-12-1-0/42.html

&nbsp;

sorapi · Answer

Hi, I also don't think there is another way.&nbsp;Mini Militia App Lock

Forum Discussion

Multiline logs in F5 Big

Recent Discussions

Outlook application issue

Why does WAF block HTTP OPTION method

Rewriting Location Header in iRule

HA Configuration (One in primary and One in DR)

Sending a trusted certificate to server

Related Content

Generating irule logs, emails and reports for Shadow API Endpoints on the F5 BIG-IP AWAF/ASM device

The BIG-IP Application Security Manager Part 10: Event Logging

Prepare BIG-IP Central Manager for Automation

F5 BIG-IP SSL Orchestrator Configuration with Advanced WAFaaS

BIG-IP deployment options with Openshift