JSON Input Transformer Path Specification - arrays

Question

I am trying to transform the following JSON log: (AWS CloudWatch/Trail if it matters)
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "xxx",
"arn": "arn:aws:iam::xxx",
"accountId": "xxx",
"accessKeyId": "xxx",
"userName": "xxx",
"sessionContext": {
"sessionIssuer": {},
"webIdFederationData": {},
"attributes": {
"mfaAuthenticated": "true",
"creationDate": "2021-01-07T13:50:07Z"
}
}
},
"eventTime": "2021-01-07T14:55:03Z",
"eventSource": "ec2.amazonaws.com",
"eventName": "AuthorizeSecurityGroupIngress",
"awsRegion": "us-east-1",
"sourceIPAddress": "xxx",
"userAgent": "console.ec2.amazonaws.com",
"requestParameters": {
"groupId": "sg-xxx",
"ipPermissions": {
"items": [
{
"ipProtocol": "tcp",
"fromPort": 22,
"toPort": 22,
"groups": {},
"ipRanges": {
"items": [
{
"cidrIp": "x.x.x.x/32"
"description": "x"
}
]
},
"ipv6Ranges": {},
"prefixListIds": {}
}
]
}
},
"responseElements": {
"requestId": "xxx",
"_return": true
},
"requestID": "xxx",
"eventID": "xxx",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"eventCategory": "Management",
"recipientAccountId": "xxx"
}
To the following output:
"AuthorizeSecurityGroupIngress made against sg-xxx on [accountname] from [user#x.x.x.x]"
"Port range: 22"
"Source IP: x.x.x.x"
"Description: x"
Currently, by passing these 2 blocks into the CloudWatch Input Transformer:
{
"event":"$.detail.eventName",
"sg":"$.detail.requestParameters.groupId",
"user":"$.detail.userIdentity.userName",
"sourceip":"$.detail.sourceIPAddress",
"dsc":"$.detail.requestParameters.ipPermissions.items"
}
"<event> made against <sg> on [accountname] from [<user>#<sourceip>]"
"Details: <dsc>"
I am able to create the following output:
"AuthorizeSecurityGroupIngress made against sg-xxx on [accountname] from [x#x.x.x.x]"
"Details: {items:[{ipProtocol:tcp,fromPort:22,toPort:22,groups:{},ipRanges:{items:[{cidrIp:x.x.x.x/32,description:x}]},ipv6Ranges:{},prefixListIds:{}}]}"
However, when I attempt to specify the input path even further by passing more specific placeholders:
{
"event":"$.detail.eventName",
"sg":"$.detail.requestParameters.groupId",
"user":"$.detail.userIdentity.userName",
"sourceip":"$.detail.sourceIPAddress",
"prt":"$.detail.requestParameters.ipPermissions.items.toPort",
"src":"$.detail.requestParameters.ipPermissions.items.ipRanges.items.cidrIp",
"dsc":"$.detail.requestParameters.ipPermissions.items.ipRanges.items.description"
}
"<event> made against <sg> on [accountname] from [<user>#<sourceip>]"
"Port Range: <prt>"
"Source IP: <src>"
"Description: <dsc>"
The output is blank for the placeholders' (prt,src,dsc) values:
"AuthorizeSecurityGroupIngress made against sg-xxx on [accountname] from [user#x.x.x.x]"
"Port range: "
"Source IP: "
"Description: "
VS. expected
"AuthorizeSecurityGroupIngress made against sg-xxx on [accountname] from [user#x.x.x.x]"
"Port range: 22"
"Source IP: x.x.x.x"
"Description: x"
Where am I messing up in the input path?
Is it the '[]' brackets causing the issue?

Answer 1

In two places your JSON has an items array, but your code treats them like objects. You need to call out the array element you want to pluck properties from:
"prt":"$.detail.requestParameters.ipPermissions.items[0].toPort",
"src":"$.detail.requestParameters.ipPermissions.items[0].ipRanges.items[0].cidrIp",
"dsc":"$.detail.requestParameters.ipPermissions.items[0].ipRanges.items[0].description"