Handle WAF organization logs

[adrien-goetz-wmx]

Hi (:

I have multiple AWS accounts that are in one organization. I activated WAF in each account and I centralized WAF logs in the same bucket. We ingest them in an OpenSearch but we have a time retention of 5 days because of the size ( > 500go/day).

I want to use your tool to grep some IP in past logs but log type is not handle.

Log format is jsonl ( each line of the file is a valid json ).

Thanks

[chrisdoman]

Hello - Whilst the JSON may not be parsed, you should still be able to search the logs as raw text. Do you receive an error when searching the logs?