ActionTrail adds a field named requestParameterJson to the event logs delivered to Log Service Logstores after 00:00:00 on July 6, 2021. This new field is in the JSON format and serves the same purpose as the requestParameters field. This change aims to improve analysis performance and does not affect the event logs that are delivered before this change.

Description

The following table describes the field added to event logs.

Field Type Description Example
requestParameterJson String The parameters specified in the API request. This field is in the JSON format and serves the same purpose as the requestParameters field. "{"AcsHost":"actiontrail.cn-hangzhou.aliyuncs.com","AcsProduct":"Actiontrail","RequestId":"32B8BA8F-3738-46D3-BCCA-1B2257AEF9BB","AcceptLanguage":"zh-CN","Region":"cn-hangzhou","HostId":"actiontrail.cn-hangzhou.aliyuncs.com","Name":"create-service-tmp"}"

Reasons for the change

The requestParameterJson field provides the settings of multiple parameters originally included in the requestParameters field in the JSON format. This improves analysis performance.

The following sample code shows you how to check whether you enable the deletion protection feature when you create Elastic Compute Service (ECS) instances:

event.serviceName: Ecs and event.eventName: RunInstances | SELECT  
json_extract("event.requestParameterJson", '$.DeletionProtection') as deletionProtection

Impacts

The change does not affect the analysis of the event logs that are delivered before this change.

After the change takes effect, take note of the following impacts:

  • For the event logs that are delivered to Log Service Logstores by using the existing trails or newly created trails, the requestParameterJson field is added. This change does not apply to the event logs that are delivered to OSS buckets.
  • If you enable the advanced event query and event alerting features, the event logs that are delivered to Log Service Logstores contain the index for the requestParameterJson field.
  • If the advanced event query and event alerting features are not enabled, the event logs that are delivered to Log Service Logstores do not contain the index for the requestParameterJson field. If you need to analyze events based on the requestParameterJson field, we recommend that you perform the following operations to manually add the index for the field:
    1. Log on to the Log Service console.
    2. On the Projects tab, click the name of the project that you specified when you created the trail.
    3. Click the name of the Logstore that you want to manage. In the upper-right corner, choose Index Attributes > Attributes.
    4. In the Search & Analysis panel, click the plus icon (+) below the existing fields and add the requestParameterJson field.
    5. Click OK.