AWS WAFのWeb ACL(保護パック)でCloudWatch Logsにログを出力している場合はコスト削減のためにも、運用負荷軽減のためにも新しいコンソールを使用する方が良いと感じた件

fields httpRequest.clientIp, action
        | parse @message '"nonTerminatingMatchingRules":[{"ruleId":"*","action"' as nonTerminatingMatchingRules 
        | filter strcontains(nonTerminatingMatchingRules, 'GeoBlockRule') or terminatingRuleId == "GeoBlockRule" 
        | filter action in ['ALLOW','BLOCK','CHALLENGE','CAPTCHA'] 
        | filter webaclId in ['arn:aws:wafv2:us-east-1:<AWSアカウントID>:global/webacl/website/84a704a7-6965-44af-887e-d196dcd881ac']
        | stats count(*) as cnt by httpRequest.clientIp 
        | sort cnt desc 
        | limit 100 | limit 100

stats count(*) as cnt by concat(httpSourceName, ' | ', httpSourceId) as combined_field 
        | parse @message '"nonTerminatingMatchingRules":[{"ruleId":"*","action"' as nonTerminatingMatchingRules 
        | filter strcontains(nonTerminatingMatchingRules, 'GeoBlockRule') or terminatingRuleId == "GeoBlockRule" 
        | filter action in ['ALLOW','BLOCK','CHALLENGE','CAPTCHA'] 
        | filter webaclId in ['arn:aws:wafv2:us-east-1:<AWSアカウントID>:global/webacl/website/84a704a7-6965-44af-887e-d196dcd881ac'] 
        | sort cnt desc 
        | limit 100 | limit 100

fields httpRequest.httpMethod, action 
        | parse @message '"nonTerminatingMatchingRules":[{"ruleId":"*","action"' as nonTerminatingMatchingRules 
        | filter strcontains(nonTerminatingMatchingRules, 'GeoBlockRule') or terminatingRuleId == "GeoBlockRule" 
        | filter action in ['ALLOW','BLOCK','CHALLENGE','CAPTCHA'] 
        | filter webaclId in ['arn:aws:wafv2:us-east-1:<AWSアカウントID>:global/webacl/website/84a704a7-6965-44af-887e-d196dcd881ac'] 
        | stats count(*) as count by httpRequest.httpMethod 
        | sort count desc 
        | limit 100 | limit 100

fields httpRequest.uri as uri, action
        | parse @message '"nonTerminatingMatchingRules":[{"ruleId":"*","action"' as nonTerminatingMatchingRules 
        | filter strcontains(nonTerminatingMatchingRules, 'GeoBlockRule') or terminatingRuleId == "GeoBlockRule" 
        | filter action in ['ALLOW','BLOCK','CHALLENGE','CAPTCHA'] 
        | filter webaclId in ['arn:aws:wafv2:us-east-1:<AWSアカウントID>:global/webacl/website/84a704a7-6965-44af-887e-d196dcd881ac']
        | stats count(*) as cnt by uri 
        | sort cnt desc 
        | limit 100 | limit 100

fields jsonParse(@message) as json_message , action
        | parse @message '"nonTerminatingMatchingRules":[{"ruleId":"*","action"' as nonTerminatingMatchingRules 
        | filter strcontains(nonTerminatingMatchingRules, 'GeoBlockRule') or terminatingRuleId == "GeoBlockRule" 
        | filter action in ['ALLOW','BLOCK','CHALLENGE','CAPTCHA'] 
        | filter webaclId in ['arn:aws:wafv2:us-east-1:<AWSアカウントID>:global/webacl/website/84a704a7-6965-44af-887e-d196dcd881ac']
        | unnest json_message.labels into labelsvalues
        | stats count(*) as cnt by labelsvalues.name
        | sort cnt desc 
        | limit 100 | limit 100

fields @timestamp, @message 
        | parse @message /\{"name":"(U|u)ser-(A|a)gent","value":"(?<userAgent>.*?)"\}/ 
        | parse @message '"nonTerminatingMatchingRules":[{"ruleId":"*","action"' as nonTerminatingMatchingRules 
        | filter strcontains(nonTerminatingMatchingRules, 'GeoBlockRule') or terminatingRuleId == "GeoBlockRule" 
        | filter action in ['ALLOW','BLOCK','CHALLENGE','CAPTCHA'] 
        | filter webaclId in ['arn:aws:wafv2:us-east-1:<AWSアカウントID>:global/webacl/website/84a704a7-6965-44af-887e-d196dcd881ac'] 
        | stats count(*) as requestCount by userAgent 
        | sort requestCount desc 
        | limit 100 | limit 100

fields ja4Fingerprint 
        | parse @message '"nonTerminatingMatchingRules":[{"ruleId":"*","action"' as nonTerminatingMatchingRules 
        | filter strcontains(nonTerminatingMatchingRules, 'GeoBlockRule') or terminatingRuleId == "GeoBlockRule" 
        | filter action in ['ALLOW','BLOCK','CHALLENGE','CAPTCHA'] 
        | filter webaclId in ['arn:aws:wafv2:us-east-1:<AWSアカウントID>:global/webacl/website/84a704a7-6965-44af-887e-d196dcd881ac'] 
        | stats count(*) as cnt by ja4Fingerprint 
        | sort cnt desc 
        | limit 100 | limit 100

fields ja3Fingerprint 
        | parse @message '"nonTerminatingMatchingRules":[{"ruleId":"*","action"' as nonTerminatingMatchingRules 
        | filter strcontains(nonTerminatingMatchingRules, 'GeoBlockRule') or terminatingRuleId == "GeoBlockRule" 
        | filter action in ['ALLOW','BLOCK','CHALLENGE','CAPTCHA'] 
        | filter webaclId in ['arn:aws:wafv2:us-east-1:<AWSアカウントID>:global/webacl/website/84a704a7-6965-44af-887e-d196dcd881ac'] 
        | stats count(*) as cnt by ja3Fingerprint 
        | sort cnt desc 
        | limit 100 | limit 100

fields timestamp, action, httpRequest.host as host, httpRequest.uri as uri, httpRequest.httpMethod as httpMethod, httpRequest.clientIp as clientIp, httpRequest.country as country, terminatingRuleId, httpSourceName, httpSourceId, concat(httpSourceName, ' | ', httpSourceId) as resourceDetails, ja3Fingerprint, ja4Fingerprint, @message | parse @message '"name":"User-Agent","value":"*"' as userAgent
        | filter action in ['BLOCK'] 
        | filter webaclId in ['arn:aws:wafv2:us-east-1:<AWSアカウントID>:global/webacl/website/84a704a7-6965-44af-887e-d196dcd881ac'] 
        | filter timestamp > 1757188173 
        | filter httpRequest.httpMethod = 'GET' 
        | filter httpRequest.country = 'US'
        | sort timestamp desc 
        | limit 500 | limit 500