|
| 1 | +--- |
| 2 | +title: Custom dimensions for log entries |
| 3 | +toc: false |
| 4 | +weight: 200 |
| 5 | +nd-content-type: reference |
| 6 | +nd-product: NAP-WAF |
| 7 | +--- |
| 8 | + |
| 9 | +F5 WAF for NGINX can configure custom dimensions for log entries using the directive `app_protect_custom_log_attribute`. |
| 10 | + |
| 11 | +This directive can be added to the NGINX configuration file in the `http`, `server` and `location` scopes. The custom dimensions become part of every request in the [Security logs]({{< ref "/waf/logging/security-logs.md" >}}) based on the scope used. |
| 12 | + |
| 13 | +The `app_protect_custom_log_attribute` directive takes a key/value pair, such as `app_protect_custom_log_attribute 'customDimension' '1'`. The directive can cascade and override entries based on scope order: _location_, _server_ then _http_. |
| 14 | + |
| 15 | +For example, attributes at the _http_ level apply to all servers and locations unless a specific server or location overrides the same key with a different value. |
| 16 | + |
| 17 | +When a custom dimension is assigned to a scope, it appears in the `json_log` field as a new JSON property called "customLogAttributes" at the top level. This properly appears if the `app_protect_custom_log_attribute` directive is used. |
| 18 | + |
| 19 | +In the configuration example, the "environment" attribute appears in logs of all locations under that server block. |
| 20 | + |
| 21 | +```json |
| 22 | +""customLogAttributes"":[{""name"":""component"",""value"":""comp1""},{""name"":""gateway"",""value"":""gway1""}]}" |
| 23 | +``` |
| 24 | + |
| 25 | +The following example defines the `app_protect_custom_log_attribute` directive at the server and location level, with key/value pairs as strings. |
| 26 | + |
| 27 | +```nginx |
| 28 | +user nginx; |
| 29 | +load_module modules/ngx_http_app_protect_module.so; |
| 30 | +error_log /var/log/nginx/error.log debug; |
| 31 | +
|
| 32 | +events { |
| 33 | + worker_connections 65536; |
| 34 | +} |
| 35 | +server { |
| 36 | +
|
| 37 | + listen 80; |
| 38 | +
|
| 39 | + server_name localhost; |
| 40 | + proxy_http_version 1.1; |
| 41 | + app_protect_custom_log_attribute 'environment' 'env1'; |
| 42 | +
|
| 43 | + location / { |
| 44 | +
|
| 45 | + app_protect_enable on; |
| 46 | + app_protect_custom_log_attribute gateway gway1; |
| 47 | + app_protect_custom_log_attribute component comp1; |
| 48 | + proxy_pass http://172.29.38.211:80$request_uri; |
| 49 | + } |
| 50 | + } |
| 51 | +``` |
| 52 | + |
| 53 | +The key/value pairs are 'environment env1', 'gateway gway1' and 'component comp1' in the above examples: |
| 54 | + |
| 55 | +- app_protect_custom_log_attribute environment env1; |
| 56 | +- app_protect_custom_log_attribute gateway gway1; |
| 57 | +- app_protect_custom_log_attribute component comp1; |
| 58 | + |
| 59 | +The key/value pairs are parsed as follows: |
| 60 | + |
| 61 | +```shell |
| 62 | +"customLogAttributes": [ |
| 63 | + { |
| 64 | + "name": "gateway", |
| 65 | + "value": "gway1" |
| 66 | + }, |
| 67 | + { |
| 68 | + "name": "component", |
| 69 | + "value": "comp1" |
| 70 | + }, |
| 71 | +] |
| 72 | +``` |
| 73 | + |
| 74 | +The `app_protect_custom_log_attribute` directive has constraints you should keep in mind: |
| 75 | + |
| 76 | +- Key and value strings are limited to 64 chars |
| 77 | +- There are a maximum of 10 key/value pairs in each scope |
| 78 | + |
| 79 | +An error message beginning with "_'app_protect_custom_log_attribute' directive is invalid_" will be displayed in the security log if: |
| 80 | + |
| 81 | +1. The `app_protect_custom_log_attribute` exceeds the maximum number of 10 directives |
| 82 | +1. The `app_protect_custom_log_attribute` exceeds the maximum name length of 64 chars |
| 83 | +1. The `app_protect_custom_log_attribute` exceeds the maximum value of 64 chars |
| 84 | + |
| 85 | +The log will specify the precise issue: |
| 86 | + |
| 87 | +```text |
| 88 | +app_protect_custom_log_attribute directive is invalid. Number of app_protect_custom_log_attribute directives exceeds maximum |
| 89 | +``` |
| 90 | + |
| 91 | + |
0 commit comments