0

I ran

aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName, AttributeValue=CreateKeyPair

and was able to view the cloud trail events related to this event name. I have 100's of these events and the output is a dictionary. How do i filter this to only show the EventTime and Username

Choolai Raj
  • 111
  • 2
  • 8

1 Answers1

1

you could simply add a query to the Event and output it as a json, then use jq to print out only the two keys you need (Username and EventTime) like this:

aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=CreateKeyPair --query "Events[]" --output json | jq -r '.[]| "\(.Username) \(.EventTime)"'
Dom
  • 11
  • 3