From 8128ad95780b8a91a2bc78f4e070c7b180a24b03 Mon Sep 17 00:00:00 2001 From: Mathieu Leplatre Date: Fri, 7 Aug 2026 15:50:37 +0200 Subject: [PATCH] feat(fastly): Log response Content-Encoding into BigQuery --- google_fastly_waf/bigquery.tf | 6 ++++++ google_fastly_waf/logging/bq_format.txt | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/google_fastly_waf/bigquery.tf b/google_fastly_waf/bigquery.tf index 6f289323..64940bcc 100644 --- a/google_fastly_waf/bigquery.tf +++ b/google_fastly_waf/bigquery.tf @@ -180,6 +180,12 @@ resource "google_bigquery_table" "fastly" { "mode": "NULLABLE", "description": "proxy description" }, + { + "name": "response_content_encoding", + "type": "STRING", + "mode": "NULLABLE", + "description": "Response Content-Encoding" + }, { "name": "fastly_request_id", "type": "STRING", diff --git a/google_fastly_waf/logging/bq_format.txt b/google_fastly_waf/logging/bq_format.txt index 72215ad9..530339f6 100644 --- a/google_fastly_waf/logging/bq_format.txt +++ b/google_fastly_waf/logging/bq_format.txt @@ -1 +1 @@ -{ "timestamp":"%{strftime(\{"%Y-%m-%dT%H:%M:%S"\}, time.start)}V", "url":"%{json.escape(req.url)}V", "request_method":"%{json.escape(req.method)}V", "request_protocol":"%{json.escape(req.proto)}V", "request_referer":"%{json.escape(req.http.referer)}V", "request_user_agent":"%{json.escape(req.http.User-Agent)}V", "response_state":"%{json.escape(fastly_info.state)}V", "response_status":%{resp.status}V, "response_reason":%{if(resp.response, "%22"+json.escape(resp.response)+"%22", "null")}V, "waf_executed": %{if(waf.executed, "true", "false")}V, "ngwaf_agentresponse": "%{if(fastly.ff.visits_this_service == 0, req.http.x-sigsci-agentresponse, resp.http.x-sigsci-agentresponse)}V", "ngwaf_decision_ms": "%{if(fastly.ff.visits_this_service == 0, req.http.x-sigsci-decision-ms, resp.http.x-sigsci-decision-ms)}V", "ngwaf_signals": "%{if(fastly.ff.visits_this_service == 0, req.http.x-sigsci-tags, resp.http.x-sigsci-tags)}V", "response_bytes_written": "%{resp.bytes_written}V", "ja3": "%{tls.client.ja3_md5}V", "ja4": "%{tls.client.ja4}V", "request_client_ip": "%{req.http.Fastly-Client-IP}V", "h2fp":"%{json.escape(req.http.h2fp)}V", "asn":"%{json.escape(req.http.asn)}V", "proxy_desc":"%{json.escape(req.http.proxy-desc)}V", "proxy_type":"%{json.escape(req.http.proxy-type)}V", "ohfp":"%{json.escape(req.http.ohfp)}V", "fastly_request_id":"%{json.escape(req.http.x-fastly-ngwaf:requestid)}V" } +{ "timestamp":"%{strftime(\{"%Y-%m-%dT%H:%M:%S"\}, time.start)}V", "url":"%{json.escape(req.url)}V", "request_method":"%{json.escape(req.method)}V", "request_protocol":"%{json.escape(req.proto)}V", "request_referer":"%{json.escape(req.http.referer)}V", "request_user_agent":"%{json.escape(req.http.User-Agent)}V", "response_state":"%{json.escape(fastly_info.state)}V", "response_status":%{resp.status}V, "response_reason":%{if(resp.response, "%22"+json.escape(resp.response)+"%22", "null")}V, "waf_executed": %{if(waf.executed, "true", "false")}V, "ngwaf_agentresponse": "%{if(fastly.ff.visits_this_service == 0, req.http.x-sigsci-agentresponse, resp.http.x-sigsci-agentresponse)}V", "ngwaf_decision_ms": "%{if(fastly.ff.visits_this_service == 0, req.http.x-sigsci-decision-ms, resp.http.x-sigsci-decision-ms)}V", "ngwaf_signals": "%{if(fastly.ff.visits_this_service == 0, req.http.x-sigsci-tags, resp.http.x-sigsci-tags)}V", "response_bytes_written": "%{resp.bytes_written}V", "ja3": "%{tls.client.ja3_md5}V", "ja4": "%{tls.client.ja4}V", "request_client_ip": "%{req.http.Fastly-Client-IP}V", "response_content_encoding":"%{json.escape(resp.http.Content-Encoding)}V", "h2fp":"%{json.escape(req.http.h2fp)}V", "asn":"%{json.escape(req.http.asn)}V", "proxy_desc":"%{json.escape(req.http.proxy-desc)}V", "proxy_type":"%{json.escape(req.http.proxy-type)}V", "ohfp":"%{json.escape(req.http.ohfp)}V", "fastly_request_id":"%{json.escape(req.http.x-fastly-ngwaf:requestid)}V" }