Question about setup

[cloudmatt]

Hi 👋🏻 ,
First of all, thank you so much for publishing this the dashboards look really awesome! I'm running into an issue when trying to use the dashboards and I'm curious where our AWS WAF <> Datadog integrations differ.

I notice in a lot of queries in the dashboard you use source:waf and webacl: webaclname and I'm curious where/how you're adding those? The logs I have for my WAF integration in Datadog seem to be missing those fields so curious if you have some special pipeline processing stuff that is adding those in.

[jamesiarmes]

@cloudmatt those come from tags we've added to the CloudWatch Log Group that the logs are ingested from. The forwarder lambda can be configured to add these tags automatically: https://docs.datadoghq.com/logs/guide/forwarder/?tab=cloudformation#advanced-optional. We use the name of the WebACL for the webacl tag, which allows us to correlate the logs to different metrics.