AWS CloudWatch - Log Insights Query - CloudTrail

cw_ct_log_insights_query.sql

# CloudTrail events: By Service / Role / principalId / etc
  fields
  eventTime
  ,eventName
  ,eventSource
  ,errorCode
  ,errorMessage
  ,userIdentity.principalId as principalId
  ,userIdentity.sessionContext.sessionIssuer.userName as SESSIONUSERID
  ,@message
  # | filter SESSIONUSERID like /(?i)elev/
  # | filter SESSIONUSERID not like /Dome9/
  # | filter SESSIONUSERID not like /CloudHealth/
  # | filter SESSIONUSERID not like /(?i)func/
  # | filter eventSource not like /config/
  # | filter eventSource not like /tagging/
  # | filter eventSource not like /sts/
  # | filter eventSource not like /lambda/
  # | filter eventSource not like /glue/
  # | filter requestParameters.logGroupName not like /(?i)lambda/
  # | filter Role like /developer/
  # | filter principalId not like /(?i)func/
  # | filter @message like /(?i)firehose/
  # | filter @message like /(?i)waf/
  # | filter @message like /(?i)newrelic/
  | filter errorCode like /^[a-zA-Z0-9].*$/
  | filter awsRegion not like /us-east-1/
  | sort eventTime desc
  | limit 200