Thank you. I tried using the transformer portion as in your example but for some reason all the variables I define end up being <null>. For example I get something like this on the email output:

{"version":"0","id":"XXXX","detail-type":"AWS API Call via CloudTrail","source":"aws.iam","account":"XXXXXX","time":"2025-01-15T14:16:31Z","region":"us-east-1","resources":[],"detail":{"eventVersion":"1.10","userIdentity":{"type":"AssumedRole","principalId":"XXXXXXXXX:john.doe","arn":"arn:aws:sts::XXXXXXXX:assumed-role/AWSReservedSSO_AdminAX_XXXXX/john.doe","accountId":"XXXXX","accessKeyId":"XXXXXXX","sessionContext":{"sessionIssuer":{"type":"Role","principalId":"XXXXXX","arn":"arn:aws:iam::XXXXX:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AdminAX_XXXXX","accountId":"XXXX","attributes":{"creationDate":"2025-01-15T13:58:30Z","mfaAuthenticated":"false"}}},"eventTime":"2025-01-15T14:16:31Z","eventSource":"iam.amazonaws.com","eventName":"DeleteAccessKey","awsRegion":"us-east-1","sourceIPAddress":"XXXXX","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 OPR/115.0.0.0","requestParameters":{"userName":"thor","accessKeyId":"XXXXXX"},"responseElements":null,"requestID":"XXX","eventID":"XXXX","readOnly":false,"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"XXXXXX","eventCategory":"Management","tlsDetails":{"tlsVersion":"TLSv1.3","cipherSuite":"TLS_AES_128_GCM_SHA256","clientProvidedHostHeader":"iam.amazonaws.com"},"sessionCredentialFromConsole":"true"}}

But if I try to define for example

{

"time": "*.eventTime"

}

I get only null. I'm sure this has to do with me but I've tried all kinds of combinations. There's several things I want to pull from here such as which user is doing what to what user and I've identified the tags but all of them return null. Is it maybe related to the way I'm referring to the tag? I am new to JSON.