shaeqahmed

{"version":1,"resource":"file:///Users/shaeqahmed/testt/matano/lambdas/KafkaTopicProviderLambda/transform-rs/src/liberror.rs","entries":[{"id":"LECp.rs","timestamp":1656427002204},{"id":"XOz5.rs","timestamp":1656427074991},{"id":"ZmYv.rs","timestamp":1656427087703},{"id":"tnCu.rs","timestamp":1656427106431},{"id":"fEP9.rs","timestamp":1656427391671}]}

shaeqahmed

shaeqahmed

  .event.kind = "event"
  .event.type = ["info"]
  .event.category = ["web"]

  .o365.audit = object!(del(.json.o365audit))

  if .o365.audit.CreationTime != null {
    creation_time, err = split(string!(.o365.audit.CreationTime), "Z")[0] + "Z"                                          
    .ts = to_timestamp!(creation_time) 
  }

shaeqahmed

name: system

transform: |
  .event.kind = "event"
  .event.category = []
  .event.type = []
      
  if .json.published != null {                                               
    .ts = to_timestamp!(.json.published, "seconds") 
  }