New fields added to ActionTrail events - ActionTrail - Alibaba Cloud Documentation Center

Effective 00:00:00 on December 16, 2020, ActionTrail will add three new fields to events: eventRW, resourceName, and resourceType. This change will help you better analyze subsequent events without affecting your analysis of existing events.

Change details

ActionTrail will add the following fields to events:

Name	Type	Description	Example
eventRW	String	Indicates whether the event is a read or write operation. Valid values: `Write`: A write operation. `Read`: A read operation.	Read
resourceName	String	The name or ID of the resource that is associated with the event. This field provides the unique resource identifier, which is extracted from the existing `referenceResources` field. You can use `resourceName` as an index in Log Service to query events by resource name.	For an event that involves a single resource of a single type: `i-bp1example1`. For an event that involves multiple resources of the same type: `i-bp1example1,i-bp1example2`. For an event that involves multiple resources of different types: `i-bp1example1,i-bp1example2;v-bp1example1`. Note Use commas (,) to separate identifiers of the same resource type, and semicolons (;) to separate identifiers of different types.
resourceType	String	The type of the resource that is associated with the event. This field is extracted from the existing `referenceResources` field. You can use `resourceType` as an index in Log Service to query events by resource type.	For an event that involves a single resource of a single type: `ACS::ECS::Instance`. For an event that involves multiple resources of the same type: `ACS::ECS::Instance`. For an event that involves multiple resources of different types: `ACS::ECS::Instance;ACS::VPC::VPC`. Note Use a semicolon (;) to separate multiple resource types.

The following examples show the event structure before and after the change:

Before

{
  "referenceResources": {
    "ACS::ECS::Instance": [
      "i-bp1fadfuy****",
      "i-bp1fadfad****"
    ]
  }
}

After

{
  "eventRW": "Read",
  "referenceResources": {
    "ACS::ECS::Instance": [
      "i-bp1fadfuy****",
      "i-bp1fadfad****"
    ]
  },
    "resourceName": "i-bp1fadfuy****,i-bp1fadfad****",
    "resourceType": "ACS::ECS::Instance"
}

Impact

This change does not affect the analysis of events delivered by existing trails.

After the change takes effect:

For both existing and new trails, events delivered to a Log Service Logstore or an OSS bucket will include the new fields.
For new trails, Log Service automatically creates an index in the Logstore for the new fields.
For existing trails, Log Service does not automatically create an index for the new fields. To query and analyze these fields, you must add the index manually.
- Add indexes for the new fields in the Log Service console
  1. Log on to the Log Service console.
  2. In the Projects section, click the Project name for your trail.
  3. Click the Logstore name. In the upper-right corner of the page, choose Index Attributes > Attributes.
  4. Click the plus sign (+) below the field list to add the eventRW, resourceName, and resourceType fields.
  5. Click Confirm.
- Add indexes for the new fields in Cloud Shell
  
  Run the following command in Cloud Shell:
```
actiontrail-update-index [project] [logstore] [regionId]
```
  Replace the project, logstore, and regionId parameters with the Project, Logstore, and region ID of your trail. For example:
```
actiontrail-update-index actiontrail-ev****  actiontrail-test**** cn-hangzhou
```