JSON Input Transformer Path Specification

Question

I am trying to transform the following JSON log: (AWS CloudWatch/Trail if it matters)

    {
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "xxx",
        "arn": "arn:aws:iam::xxx",
        "accountId": "xxx",
        "accessKeyId": "xxx",
        "userName": "xxx",
        "sessionContext": {
            "sessionIssuer": {},
            "webIdFederationData": {},
            "attributes": {
                "mfaAuthenticated": "true",
                "creationDate": "2021-01-07T13:50:07Z"
            }
        }
    },
    "eventTime": "2021-01-07T14:55:03Z",
    "eventSource": "ec2.amazonaws.com",
    "eventName": "AuthorizeSecurityGroupIngress",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "xxx",
    "userAgent": "console.ec2.amazonaws.com",
    "requestParameters": {
        "groupId": "sg-xxx",
        "ipPermissions": {
            "items": [
                {
                    "ipProtocol": "tcp",
                    "fromPort": 22,
                    "toPort": 22,
                    "groups": {},
                    "ipRanges": {
                        "items": [
                            {
                                "cidrIp": "x.x.x.x/32"
                                "description": "x"
                            }
                        ]
                    },
                    "ipv6Ranges": {},
                    "prefixListIds": {}
                }
            ]
        }
    },
    "responseElements": {
        "requestId": "xxx",
        "_return": true
    },
    "requestID": "xxx",
    "eventID": "xxx",
    "readOnly": false,
    "eventType": "AwsApiCall",
    "managementEvent": true,
    "eventCategory": "Management",
    "recipientAccountId": "xxx"
}

To the following output:

"AuthorizeSecurityGroupIngress made against sg-xxx on [accountname] from [user@x.x.x.x]"

"Port range: 22"

"Source IP: x.x.x.x"

"Description: x"

Currently, by passing these 2 blocks into the CloudWatch Input Transformer:

{
"event":"$.detail.eventName",
"sg":"$.detail.requestParameters.groupId",
"user":"$.detail.userIdentity.userName",
"sourceip":"$.detail.sourceIPAddress",
"dsc":"$.detail.requestParameters.ipPermissions.items"
}

"<event> made against <sg> on [accountname] from [<user>@<sourceip>]"
"Details: <dsc>"

I am able to create the following output:

"AuthorizeSecurityGroupIngress made against sg-xxx on [accountname] from [x@x.x.x.x]"

"Details: {items:[{ipProtocol:tcp,fromPort:22,toPort:22,groups:{},ipRanges:{items:[{cidrIp:x.x.x.x/32,description:x}]},ipv6Ranges:{},prefixListIds:{}}]}"

However, when I attempt to specify the input path even further by passing more specific placeholders:

{
"event":"$.detail.eventName",
"sg":"$.detail.requestParameters.groupId",
"user":"$.detail.userIdentity.userName",
"sourceip":"$.detail.sourceIPAddress",
"prt":"$.detail.requestParameters.ipPermissions.items.toPort",
"src":"$.detail.requestParameters.ipPermissions.items.ipRanges.items.cidrIp",
"dsc":"$.detail.requestParameters.ipPermissions.items.ipRanges.items.description"
}

"<event> made against <sg> on [accountname] from [<user>@<sourceip>]"
"Port Range: <prt>"
"Source IP: <src>"
"Description: <dsc>"

The output is blank for the placeholders' (prt,src,dsc) values:

"AuthorizeSecurityGroupIngress made against sg-xxx on [accountname] from [user@x.x.x.x]"

"Port range: "

"Source IP: "

"Description: "

VS. expected

"AuthorizeSecurityGroupIngress made against sg-xxx on [accountname] from [user@x.x.x.x]"

"Port range: 22"

"Source IP: x.x.x.x"

"Description: x"

Where am I messing up in the input path?

Is it the '[]' brackets causing the issue?

Answer 1

In two places your JSON has an items array, but your code treats them like objects. You need to call out the array element you want to pluck properties from:

"prt":"$.detail.requestParameters.ipPermissions.items[0].toPort",
"src":"$.detail.requestParameters.ipPermissions.items[0].ipRanges.items[0].cidrIp",
"dsc":"$.detail.requestParameters.ipPermissions.items[0].ipRanges.items[0].description"