Is the request body written to the log?

Short answer

Conditionally, yes. The body of a request for which an Event Logs record is written is written to the record as it is if two conditions are met together: the body has not been truncated during the inspection (it has been received in full and has not exceeded the Max. Body Size to Process(kB) limit) and its length does not exceed the Max. Body Size to Log(kB) value; the default of this value is 2 kB. If one of the conditions is not met, the body is not written at all, and no shortened part of it is written either; if the value is set to 0, no body is written. The length of the body and whether it was truncated are kept separately in every record. The written body appears in the Body row on the Request & Location tab of the Event Logs preview; the row is hidden by default and is opened with the eye icon, and if the body has not been written, the row is not listed at all. The matching content itself (Description on the Attacks tab) is independent of the body record and depends on the Detailed Log setting of the check field.

How Does It Work?

Situation	Is the body written to the record?
The whole body was received and its length is ≤ Max. Body Size to Log(kB)	Yes, as it is
Its length is greater than the Max. Body Size to Log(kB) value	No
The body exceeded the Max. Body Size to Process(kB) limit or was inspected before it was received in full	No
Max. Body Size to Log(kB) = 0	No
The Event Logs record of the request was not written (clean request, Learning mode)	No; there is no record

• The setting is on the Request Body Limits card on the WAF Management tab; if the value is greater than 0, the sentence At most … of the body is logged appears on the card. The steps for changing the limit and its effect: How is a body that exceeds the Max. Body Size to Log(kB) limit written to the log; should I raise this limit?
• In WEB-CLI, the same setting is the --bodyMaxLogSize field of the waf options update command (kB) (body processing).
• The Traffic view of WAF Report groups the records by body length (<128B, <1KB, 1-128KB, 128KB-1MB, >1MB); this distribution is calculated from the length information in the record even if the body itself is not written.

Body, Payload and SIEM

Information	Where does it come from?	Where does it appear?
Body	The full body of the request; subject to the two conditions above	Only the Event Logs preview
Description	The section that matches the signature and its surroundings; depends on the Detailed Log setting of the check field	Event Logs → Attacks tab
The attack payload going to SIEM	The Attack Payload in WAF Info setting	The line sent with the log profile (Is the attack payload sent to the SIEM (Same as 'detailed log' / Always Send / Never Send)?)

Common Misconceptions

• "The first part of a large body is recorded." A body that exceeds the limit is not written at all; only its length is in the record.
• "2 kB is a fixed limit." 2 kB is the default; it is changed on the Request Body Limits card.
• "If there is no Body row, the body was not inspected." Whether the body is inspected is determined by Max. Body Size to Process(kB), and whether it is written to the record by Max. Body Size to Log(kB); the two are separate limits.

How it is done in the documentation

• Request Body Limits · Max. Body Size to Log (kB)
• Event Logs · Request & Location Tab
• WEB-CLI · waf options · The Body Processing

Related questions

• How is a body that exceeds the Max. Body Size to Log(kB) limit written to the log; should I raise this limit?
• What does the "Detailed Log" option do; is a log written if I turn it off?
• Is the attack payload sent to the SIEM (Same as 'detailed log' / Always Send / Never Send)?