cloudtrail.yml

message =~ parseJson(removePrefixes=Records, prefix=aws) | drop(message)
      | split(aws)
      | producer := "aws" | service := "cloudtrail"
      | case { aws.eventTime=* | aws.eventTime =~ findTimestamp(addErrors=false); *; }
      | rename(field="env", as="#env") | drop(env)
      | rename(field="aws.awsRegion", as="aws.region")
      | case { @rawstring ~= /\{"eventVersion":\d+\.\d+\}/ | dropEvent(); *; }
      | drop(_index)
      | drop(#type) | drop(type) | @type := "log"
      | case {
            aws.eventTime!= *
            aws.region !=*
            aws.requestID != *
            aws.eventSource != *
            aws.eventName != *
            aws.userIdentity.arn != *
            aws.userIdentity.invokedBy != *
              | eventTime := formatTime("%Y-%m-%dT%H:%M:%SZ", field=@timestamp, locale=en_US, timezone=Z)
              | object =~ /AWSLogs\/(?<accountID>[0-9]+)\/CloudTrail.*/
              | format("%s %s %s %s %s %s %s", field=[eventTime,
                                                      region,
                                                      aws.requestID,
                                                      aws.eventSource,
                                                      aws.userIdentity.type,
                                                      accountID,
                                                      aws.userIdentity.invokedBy], as=@rawstring) | @display := @rawstring;   
            aws.eventTime!= *
            aws.region !=*
            aws.requestID != *
            aws.eventSource != *
            aws.eventName != *
            aws.userIdentity.invokedBy != *
              | eventTime := formatTime("%Y-%m-%dT%H:%M:%SZ", field=@timestamp, locale=en_US, timezone=Z)
              | format("%s %s %s %s %s %s %s", field=[eventTime,
                                                      region,
                                                      aws.userIdentity.accessKeyId,
                                                      aws.eventSource,
                                                      aws.userIdentity.type,
                                                      aws.userIdentity.arn,
                                                      aws.userIdentity.invokedBy], as=@rawstring) | @display := @rawstring;
            aws.userIdentity.arn != *
              | format("%s %s %s %s %s %s %s", field=[aws.eventTime,
                                                      aws.region,
                                                      aws.requestID,
                                                      aws.eventSource,
                                                      aws.eventName,
                                                      aws.resources[0].ARN,
                                                      aws.userIdentity.invokedBy], as=@rawstring) | @display := @rawstring;
            aws.userIdentity.arn != *
            aws.resources[0].ARN != *
              | format("%s %s %s %s %s %s %s", field=[aws.eventTime,
                                                      aws.region,
                                                      aws.requestID,
                                                      aws.eventSource,
                                                      aws.eventName,
                                                      aws.requestParameters.roleArn,
                                                      aws.userIdentity.invokedBy], as=@rawstring) | @display := @rawstring;
            aws.userIdentity.invokedBy != *
              | format("%s %s %s %s %s %s %s", field=[aws.eventTime,
                                                      aws.region,
                                                      aws.requestID,
                                                      aws.eventSource,
                                                      aws.eventName,
                                                      aws.userIdentity.arn,
                                                      aws.userIdentity.type], as=@rawstring) | @display := @rawstring;
            * | format("%s %s %s %s %s %s %s", field=[aws.eventTime,
                                                      aws.region,
                                                      aws.requestID,
                                                      aws.eventSource,
                                                      aws.eventName,
                                                      aws.userIdentity.arn,
                                                      aws.userIdentity.invokedBy], as=@rawstring) | @display := @rawstring}
      ;
      };