Would the AWAF parse JSON in a http responses?

techdocs.f5.com/en-us/bigip-14-1-0/big-ip-asm-implementations-14-1-0/logging-application-security-events.html

About logging responses

If you enable response logging in the logging profile, the system can log only responses that include the following content headers:

• “text/…”
• “application/x-shockwave-flash”
• “application/sgml”
• “application/x-javascript”
• “application/xml”
• “application/x-asp”
• “application/x-aspx”
• “application/xhtml+xml”
• “application/soap+xml”
• “application/json”

The system cannot log other responses.

If your response have the “application/json” then system should log the response.

The manual for v12.1.x says the same.