diff --git a/internal/web/actions/default/servers/components/waf/log.go b/internal/web/actions/default/servers/components/waf/log.go
index 793ce52a..09be53fc 100644
--- a/internal/web/actions/default/servers/components/waf/log.go
+++ b/internal/web/actions/default/servers/components/waf/log.go
@@ -1,8 +1,11 @@
 package waf
 
 import (
+	"encoding/json"
 	"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
 	"github.com/TeaOSLab/EdgeCommon/pkg/rpc/pb"
+	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/firewallconfigs"
+	"github.com/iwind/TeaGo/maps"
 	timeutil "github.com/iwind/TeaGo/utils/time"
 	"regexp"
 	"strings"
@@ -20,6 +23,7 @@ func (this *LogAction) RunGet(params struct {
 	Day              string
 	RequestId        string
 	FirewallPolicyId int64
+	GroupId          int64
 }) {
 	if len(params.Day) == 0 {
 		params.Day = timeutil.Format("Y-m-d")
@@ -27,6 +31,7 @@ func (this *LogAction) RunGet(params struct {
 
 	this.Data["path"] = this.Request.URL.Path
 	this.Data["day"] = params.Day
+	this.Data["groupId"] = params.GroupId
 	this.Data["accessLogs"] = []interface{}{}
 
 	day := params.Day
@@ -35,10 +40,11 @@ func (this *LogAction) RunGet(params struct {
 		size := int64(10)
 
 		resp, err := this.RPC().HTTPAccessLogRPC().ListHTTPAccessLogs(this.AdminContext(), &pb.ListHTTPAccessLogsRequest{
-			RequestId:        params.RequestId,
-			FirewallPolicyId: params.FirewallPolicyId,
-			Day:              day,
-			Size:             size,
+			RequestId:           params.RequestId,
+			FirewallPolicyId:    params.FirewallPolicyId,
+			FirewallRuleGroupId: params.GroupId,
+			Day:                 day,
+			Size:                size,
 		})
 		if err != nil {
 			this.ErrorPage(err)
@@ -59,11 +65,12 @@ func (this *LogAction) RunGet(params struct {
 		if len(params.RequestId) > 0 {
 			this.Data["hasPrev"] = true
 			prevResp, err := this.RPC().HTTPAccessLogRPC().ListHTTPAccessLogs(this.AdminContext(), &pb.ListHTTPAccessLogsRequest{
-				RequestId:        params.RequestId,
-				FirewallPolicyId: params.FirewallPolicyId,
-				Day:              day,
-				Size:             size,
-				Reverse:          true,
+				RequestId:           params.RequestId,
+				FirewallPolicyId:    params.FirewallPolicyId,
+				FirewallRuleGroupId: params.GroupId,
+				Day:                 day,
+				Size:                size,
+				Reverse:             true,
 			})
 			if err != nil {
 				this.ErrorPage(err)
@@ -75,5 +82,29 @@ func (this *LogAction) RunGet(params struct {
 		}
 	}
 
+	// 所有分组
+	policyResp, err := this.RPC().HTTPFirewallPolicyRPC().FindEnabledFirewallPolicyConfig(this.AdminContext(), &pb.FindEnabledFirewallPolicyConfigRequest{
+		FirewallPolicyId: params.FirewallPolicyId,
+	})
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+	policyConfig := &firewallconfigs.HTTPFirewallPolicy{}
+	err = json.Unmarshal(policyResp.FirewallPolicyJSON, policyConfig)
+	if err != nil {
+		this.ErrorPage(err)
+		return
+	}
+
+	groupMaps := []maps.Map{}
+	for _, group := range policyConfig.AllRuleGroups() {
+		groupMaps = append(groupMaps, maps.Map{
+			"id":   group.Id,
+			"name": group.Name,
+		})
+	}
+	this.Data["groups"] = groupMaps
+
 	this.Show()
 }
diff --git a/web/views/@default/servers/components/waf/log.html b/web/views/@default/servers/components/waf/log.html
index a3e64b83..3e828f6a 100644
--- a/web/views/@default/servers/components/waf/log.html
+++ b/web/views/@default/servers/components/waf/log.html
@@ -14,21 +14,27 @@
 <div class="right-box">
 	{$template "waf_menu"}
 
-	<first-menu>
+	<form class="ui form small" :action="path" autocomplete="off">
+	<first-menu style="margin-top: -1em">
+		<div class="item">
+			<select class="ui dropdown" name="groupId" v-model="groupId">
+				<option value="0">[规则分组]</option>
+				<option v-for="group in groups" :value="group.id">{{group.name}}</option>
+			</select>
+		</div>
 		<div class="item right">
-			<form class="ui form small" :action="path" autocomplete="off">
-				<input type="hidden" name="firewallPolicyId" :value="firewallPolicyId"/>
-				<div class="ui fields inline">
-					<div class="ui field">
-						<input type="text" name="day" maxlength="10" placeholder="选择日期" style="width:7.8em" id="day-input" v-model="day"/>
-					</div>
-					<div class="ui field">
-						<button class="ui button small" type="submit">查找</button>
-					</div>
+			<input type="hidden" name="firewallPolicyId" :value="firewallPolicyId"/>
+			<div class="ui fields inline">
+				<div class="ui field">
+					<input type="text" name="day" maxlength="10" placeholder="选择日期" style="width:7.8em" id="day-input" v-model="day"/>
 				</div>
-			</form>
+				<div class="ui field">
+					<button class="ui button small" type="submit">查找</button>
+				</div>
+			</div>
 		</div>
 	</first-menu>
+	</form>
 
 	<p class="comment" v-if="accessLogs.length == 0">暂时还没有日志。</p>
 
@@ -40,10 +46,10 @@
 	</table>
 
 	<div v-if="accessLogs.length > 0">
-		<a :href="path + '?requestId=' + lastRequestId + '&day=' + day + '&firewallPolicyId=' + firewallPolicyId" v-if="hasPrev">上一页</a>
+		<a :href="path + '?requestId=' + lastRequestId + '&day=' + day + '&firewallPolicyId=' + firewallPolicyId + '&groupId=' + groupId" v-if="hasPrev">上一页</a>
 		<span v-else class="disabled">上一页</span>
 		<span class="disabled">&nbsp; | &nbsp;</span>
-		<a :href="path + '?requestId=' + nextRequestId + '&day=' + day + '&firewallPolicyId=' + firewallPolicyId" v-if="hasMore">下一页</a>
+		<a :href="path + '?requestId=' + nextRequestId + '&day=' + day + '&firewallPolicyId=' + firewallPolicyId + '&groupId=' + groupId" v-if="hasMore">下一页</a>
 		<span v-else class="disabled">下一页</span>
 	</div>
 </div>
\ No newline at end of file