ActionTrail adds a field named requestParameterJson to the event logs delivered to Log Service Logstores after 00:00:00 on July 6, 2021. This new field is in the JSON format and serves the same purpose as the requestParameters field. This change aims to improve analysis performance and does not affect the event logs that are delivered before this change.
The following table describes the field added to event logs.
|requestParameterJson||String||The parameters specified in the API request. This field is in the JSON format and serves the same purpose as the requestParameters field.||
Reasons for the change
The requestParameterJson field provides the settings of multiple parameters originally included in the requestParameters field in the JSON format. This improves analysis performance.
The following sample code shows you how to check whether you enable the deletion protection feature when you create Elastic Compute Service (ECS) instances:
event.serviceName: Ecs and event.eventName: RunInstances | SELECT json_extract("event.requestParameterJson", '$.DeletionProtection') as deletionProtection
The change does not affect the analysis of the event logs that are delivered before this change.
After the change takes effect, take note of the following impacts:
- For the event logs that are delivered to Log Service Logstores by using the existing trails or newly created trails, the requestParameterJson field is added. This change does not apply to the event logs that are delivered to OSS buckets.
- If you enable the advanced event query and event alerting features, the event logs that are delivered to Log Service Logstores contain the index for the requestParameterJson field.
- If the advanced event query and event alerting features are not enabled, the event
logs that are delivered to Log Service Logstores do not contain the index for the
requestParameterJson field. If you need to analyze events based on the requestParameterJson
field, we recommend that you perform the following operations to manually add the
index for the field:
- Log on to the Log Service console.
- On the Projects tab, click the name of the project that you specified when you created the trail.
- Click the name of the Logstore that you want to manage. In the upper-right corner, choose .
- In the Search & Analysis panel, click the plus icon (+) below the existing fields and add the requestParameterJson field.
- Click OK.