Merge pull request #97278 from dantecit0/patch-4

Update web-application-firewall-logs.md

Author: Jak-MS

articles/web-application-firewall/ag/web-application-firewall-logs.md

@@ -75,11 +75,11 @@ Activity logging is automatically enabled for every Resource Manager resource. Y
 
 5. Type a name for the settings, confirm the settings, and select **Save**.
 
-### Activity log
+## Activity log
 
 Azure generates the activity log by default. The logs are preserved for 90 days in the Azure event logs store. Learn more about these logs by reading the [View events and activity log](../../azure-monitor/essentials/activity-log.md) article.
 
-### Access log
+## Access log
 
 The access log is generated only if you've enabled it on each Application Gateway instance, as detailed in the preceding steps. The data is stored in the storage account that you specified when you enabled the logging. Each access of Application Gateway is logged in JSON format, as shown in the following example for v1:
 
@@ -176,7 +176,7 @@ For Application Gateway and WAF v2, the logs show a little more information:
 }
 ```
 
-### Performance log
+## Performance log
 
 The performance log is generated only if you have enabled it on each Application Gateway instance, as detailed in the preceding steps. The data is stored in the storage account that you specified when you enabled the logging. The performance log data is generated in 1-minute intervals. It is available only for the v1 SKU. For the v2 SKU, use [Metrics](../../application-gateway/application-gateway-metrics.md) for performance data. The following data is logged:
 
@@ -213,7 +213,7 @@ The performance log is generated only if you have enabled it on each Application
 > [!NOTE]
 > Latency is calculated from the time when the first byte of the HTTP request is received to the time when the last byte of the HTTP response is sent. It's the sum of the Application Gateway processing time plus the network cost to the back end, plus the time that the back end takes to process the request.
 
-### Firewall log
+## Firewall log
 
 The firewall log is generated only if you have enabled it for each application gateway, as detailed in the preceding steps. This log also requires that the web application firewall is configured on an application gateway. The data is stored in the storage account that you specified when you enabled the logging. The following data is logged:
 
@@ -276,14 +276,14 @@ The firewall log is generated only if you have enabled it for each application g
 
 ```
 
-### View and analyze the activity log
+## View and analyze the activity log
 
 You can view and analyze activity log data by using any of the following methods:
 
 * **Azure tools**: Retrieve information from the activity log through Azure PowerShell, the Azure CLI, the Azure REST API, or the Azure portal. Step-by-step instructions for each method are detailed in the [Activity operations with Resource Manager](../../azure-monitor/essentials/activity-log.md) article.
 * **Power BI**: If you don't already have a [Power BI](https://powerbi.microsoft.com/pricing) account, you can try it for free. By using the [Power BI template apps](/power-bi/service-template-apps-overview), you can analyze your data.
 
-### View and analyze the access, performance, and firewall logs
+## View and analyze the access, performance, and firewall logs
 
 [Azure Monitor logs](../../azure-monitor/insights/azure-networking-analytics.md) can collect the counter and event log files from your Blob storage account. It includes visualizations and powerful search capabilities to analyze your logs.