[awsfirehose] Add routing rules for metrics ingested from Firehose

packages/awsfirehose/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.1.0"
+  changes:
+    - description: Add routing rules for metrics from Firehose.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/9916
 - version: "1.0.0"
   changes:
     - description: Release package as GA.

packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-apigateway-log.json-expected.json

@@ -9,9 +9,6 @@
             "aws.firehose.subscription_filters": "[apigateway-to-firehose]",
             "aws.kinesis.name": "firehose-apigateway-logs-to-elastic",
             "aws.kinesis.type": "deliverystream",
-            "cloud": {
-                "provider": "aws"
-            },
             "cloud.account.id": "123456",
             "cloud.provider": "aws",
             "cloud.region": "us-east-1",
@@ -33,9 +30,6 @@
             "aws.firehose.subscription_filters": "[apigateway-to-firehose]",
             "aws.kinesis.name": "firehose-apigateway-logs-to-elastic",
             "aws.kinesis.type": "deliverystream",
-            "cloud": {
-                "provider": "aws"
-            },
             "cloud.account.id": "123456",
             "cloud.provider": "aws",
             "cloud.region": "us-east-1",
@@ -57,9 +51,6 @@
             "aws.firehose.subscription_filters": "[apigateway-to-firehose]",
             "aws.kinesis.name": "firehose-apigateway-logs-to-elastic",
             "aws.kinesis.type": "deliverystream",
-            "cloud": {
-                "provider": "aws"
-            },
             "cloud.account.id": "123456",
             "cloud.provider": "aws",
             "cloud.region": "us-east-1",

packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-cloudfront-log.json

@@ -1,19 +1,19 @@
 {
-  "events": [
-    {
-      "cloud.region": "us-east-1",
-      "aws.firehose.arn": "arn:aws:firehose:us-east-2:123456:deliverystream/firehose-cloudfront-logs-to-elastic",
-      "data_stream.namespace": "default",
-      "message": "2022-04-19 12:29:36 SEA19-C2 10157 81.2.69.143 POST d111111abcdef8.cloudfront.net /getApplications 200 https://test.com/global Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/100.0.4896.127%20Safari/537.36 source=global - Miss hrsHM5OM6sTIXUleC1G20YtDxMf5Cq0Jbz0pwhVpod2kgEn_W6akCQ== test.com https 1057 0.238 - TLSv1.3 TLS_AES_128_GCM_SHA256 Miss HTTP/2.0 - - 4203 0.238 Miss application/json;charset=UTF-8 - - -",
-      "aws.kinesis.type": "deliverystream",
-      "data_stream.type": "logs",
-      "aws.firehose.request_id": "971ae05f-a128-4a7f-b623-30f9bc513e55",
-      "cloud.provider": "aws",
-      "@timestamp": "2023-07-25T21:04:35Z",
-      "cloud.account.id": "123456",
-      "data_stream.dataset": "awsfirehose",
-      "aws.kinesis.name": "firehose-cloudfront-logs-to-elastic",
-      "event.id": "37670326805251200781477669690942747782212394134076063744"
-    }
-  ]
+    "events": [
+        {
+            "cloud.region": "us-east-1",
+            "aws.firehose.arn": "arn:aws:firehose:us-east-2:123456:deliverystream/firehose-cloudfront-logs-to-elastic",
+            "data_stream.namespace": "default",
+            "message": "2022-04-19 12:29:36 SEA19-C2 10157 81.2.69.143 POST d111111abcdef8.cloudfront.net /getApplications 200 https://test.com/global Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/100.0.4896.127%20Safari/537.36 source=global - Miss hrsHM5OM6sTIXUleC1G20YtDxMf5Cq0Jbz0pwhVpod2kgEn_W6akCQ== test.com https 1057 0.238 - TLSv1.3 TLS_AES_128_GCM_SHA256 Miss HTTP/2.0 - - 4203 0.238 Miss application/json;charset=UTF-8 - - -",
+            "aws.kinesis.type": "deliverystream",
+            "data_stream.type": "logs",
+            "aws.firehose.request_id": "971ae05f-a128-4a7f-b623-30f9bc513e55",
+            "cloud.provider": "aws",
+            "@timestamp": "2023-07-25T21:04:35Z",
+            "cloud.account.id": "123456",
+            "data_stream.dataset": "awsfirehose",
+            "aws.kinesis.name": "firehose-cloudfront-logs-to-elastic",
+            "event.id": "37670326805251200781477669690942747782212394134076063744"
+        }
+    ]
 }

packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-cloudfront-log.json-expected.json

@@ -6,9 +6,6 @@
             "aws.firehose.request_id": "971ae05f-a128-4a7f-b623-30f9bc513e55",
             "aws.kinesis.name": "firehose-cloudfront-logs-to-elastic",
             "aws.kinesis.type": "deliverystream",
-            "cloud": {
-                "provider": "aws"
-            },
             "cloud.account.id": "123456",
             "cloud.provider": "aws",
             "cloud.region": "us-east-1",

packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-cloudtrail-log.json-expected.json

@@ -9,9 +9,6 @@
             "aws.firehose.subscription_filters": "[cloudtrail-to-firehose]",
             "aws.kinesis.name": "firehose-cloudtrail-logs-to-elastic",
             "aws.kinesis.type": "deliverystream",
-            "cloud": {
-                "provider": "aws"
-            },
             "cloud.account.id": "123456",
             "cloud.provider": "aws",
             "cloud.region": "us-east-2",

packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-elb-log.json

@@ -1,49 +1,49 @@
 {
-  "events": [
-    {
-      "cloud.region": "us-east-1",
-      "aws.firehose.arn": "arn:aws:firehose:us-east-2:123456:deliverystream/firehose-classic-load-balancer-logs-to-elastic",
-      "data_stream.namespace": "default",
-      "message": "2015-05-13T23:39:43.945958Z my-loadbalancer 192.168.131.39:2817 10.0.0.1:80 0.000073 0.001048 0.000057 200 200 0 29 \"GET http://www.example.com:80/ HTTP/1.1\" \"curl/7.38.0\" - -",
-      "aws.kinesis.type": "deliverystream",
-      "data_stream.type": "logs",
-      "aws.firehose.request_id": "971ae05f-a128-4a7f-b623-30f9bc513e55",
-      "cloud.provider": "aws",
-      "@timestamp": "2023-07-25T21:04:35Z",
-      "cloud.account.id": "123456",
-      "data_stream.dataset": "awsfirehose",
-      "aws.kinesis.name": "firehose-classic-load-balancer-logs-to-elastic",
-      "event.id": "37670326805251200781477669690942747782212394134076063744"
-    },
-    {
-      "cloud.region": "us-east-1",
-      "aws.firehose.arn": "arn:aws:firehose:us-east-2:123456:deliverystream/firehose-application-load-balancer-logs-to-elastic",
-      "data_stream.namespace": "default",
-      "message": "http 2018-07-02T22:23:00.186641Z app/my-loadbalancer/50dc6c495c0c9188 192.168.131.39:2817 10.0.0.1:80 0.000 0.001 0.000 200 200 34 366 \"GET http://www.example.com:80/ HTTP/1.1\" \"curl/7.46.0\" - - arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067 \"Root=1-58337262-36d228ad5d99923122bbe354\" \"-\" \"-\" 0 2018-07-02T22:22:48.364000Z \"forward\" \"-\" \"-\" \"10.0.0.1:80\" \"200\" \"-\" \"-\"",
-      "aws.kinesis.type": "deliverystream",
-      "data_stream.type": "logs",
-      "aws.firehose.request_id": "971ae05f-a128-4a7f-b623-30f9bc513e55",
-      "cloud.provider": "aws",
-      "@timestamp": "2023-07-25T21:04:35Z",
-      "cloud.account.id": "123456",
-      "data_stream.dataset": "awsfirehose",
-      "aws.kinesis.name": "firehose-application-load-balancer-logs-to-elastic",
-      "event.id": "37670326805251200781477669690942747782212394134076063744"
-    },
-    {
-      "cloud.region": "us-east-1",
-      "aws.firehose.arn": "arn:aws:firehose:us-east-2:123456:deliverystream/firehose-network-load-balancer-logs-to-elastic",
-      "data_stream.namespace": "default",
-      "message": "tls 2.0 2018-12-20T02:59:40 net/my-network-loadbalancer/c6e77e28c25b2234 g3d4b5e8bb8464cd 72.21.218.154:51341 172.100.100.185:443 5 2 98 246 - arn:aws:acm:us-east-2:671290407336:certificate/2a108f19-aded-46b0-8493-c63eb1ef4a99 - ECDHE-RSA-AES128-SHA tlsv12 - my-network-loadbalancer-c6e77e28c25b2234.elb.us-east-2.amazonaws.com - - - 2018-12-20T02:59:30",
-      "aws.kinesis.type": "deliverystream",
-      "data_stream.type": "logs",
-      "aws.firehose.request_id": "971ae05f-a128-4a7f-b623-30f9bc513e55",
-      "cloud.provider": "aws",
-      "@timestamp": "2023-07-25T21:04:35Z",
-      "cloud.account.id": "123456",
-      "data_stream.dataset": "awsfirehose",
-      "aws.kinesis.name": "firehose-network-load-balancer-logs-to-elastic",
-      "event.id": "37670326805251200781477669690942747782212394134076063744"
-    }
-  ]
+    "events": [
+        {
+            "cloud.region": "us-east-1",
+            "aws.firehose.arn": "arn:aws:firehose:us-east-2:123456:deliverystream/firehose-classic-load-balancer-logs-to-elastic",
+            "data_stream.namespace": "default",
+            "message": "2015-05-13T23:39:43.945958Z my-loadbalancer 192.168.131.39:2817 10.0.0.1:80 0.000073 0.001048 0.000057 200 200 0 29 \"GET http://www.example.com:80/ HTTP/1.1\" \"curl/7.38.0\" - -",
+            "aws.kinesis.type": "deliverystream",
+            "data_stream.type": "logs",
+            "aws.firehose.request_id": "971ae05f-a128-4a7f-b623-30f9bc513e55",
+            "cloud.provider": "aws",
+            "@timestamp": "2023-07-25T21:04:35Z",
+            "cloud.account.id": "123456",
+            "data_stream.dataset": "awsfirehose",
+            "aws.kinesis.name": "firehose-classic-load-balancer-logs-to-elastic",
+            "event.id": "37670326805251200781477669690942747782212394134076063744"
+        },
+        {
+            "cloud.region": "us-east-1",
+            "aws.firehose.arn": "arn:aws:firehose:us-east-2:123456:deliverystream/firehose-application-load-balancer-logs-to-elastic",
+            "data_stream.namespace": "default",
+            "message": "http 2018-07-02T22:23:00.186641Z app/my-loadbalancer/50dc6c495c0c9188 192.168.131.39:2817 10.0.0.1:80 0.000 0.001 0.000 200 200 34 366 \"GET http://www.example.com:80/ HTTP/1.1\" \"curl/7.46.0\" - - arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067 \"Root=1-58337262-36d228ad5d99923122bbe354\" \"-\" \"-\" 0 2018-07-02T22:22:48.364000Z \"forward\" \"-\" \"-\" \"10.0.0.1:80\" \"200\" \"-\" \"-\"",
+            "aws.kinesis.type": "deliverystream",
+            "data_stream.type": "logs",
+            "aws.firehose.request_id": "971ae05f-a128-4a7f-b623-30f9bc513e55",
+            "cloud.provider": "aws",
+            "@timestamp": "2023-07-25T21:04:35Z",
+            "cloud.account.id": "123456",
+            "data_stream.dataset": "awsfirehose",
+            "aws.kinesis.name": "firehose-application-load-balancer-logs-to-elastic",
+            "event.id": "37670326805251200781477669690942747782212394134076063744"
+        },
+        {
+            "cloud.region": "us-east-1",
+            "aws.firehose.arn": "arn:aws:firehose:us-east-2:123456:deliverystream/firehose-network-load-balancer-logs-to-elastic",
+            "data_stream.namespace": "default",
+            "message": "tls 2.0 2018-12-20T02:59:40 net/my-network-loadbalancer/c6e77e28c25b2234 g3d4b5e8bb8464cd 72.21.218.154:51341 172.100.100.185:443 5 2 98 246 - arn:aws:acm:us-east-2:671290407336:certificate/2a108f19-aded-46b0-8493-c63eb1ef4a99 - ECDHE-RSA-AES128-SHA tlsv12 - my-network-loadbalancer-c6e77e28c25b2234.elb.us-east-2.amazonaws.com - - - 2018-12-20T02:59:30",
+            "aws.kinesis.type": "deliverystream",
+            "data_stream.type": "logs",
+            "aws.firehose.request_id": "971ae05f-a128-4a7f-b623-30f9bc513e55",
+            "cloud.provider": "aws",
+            "@timestamp": "2023-07-25T21:04:35Z",
+            "cloud.account.id": "123456",
+            "data_stream.dataset": "awsfirehose",
+            "aws.kinesis.name": "firehose-network-load-balancer-logs-to-elastic",
+            "event.id": "37670326805251200781477669690942747782212394134076063744"
+        }
+    ]
 }

packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-elb-log.json-expected.json

@@ -6,9 +6,6 @@
             "aws.firehose.request_id": "971ae05f-a128-4a7f-b623-30f9bc513e55",
             "aws.kinesis.name": "firehose-classic-load-balancer-logs-to-elastic",
             "aws.kinesis.type": "deliverystream",
-            "cloud": {
-                "provider": "aws"
-            },
             "cloud.account.id": "123456",
             "cloud.provider": "aws",
             "cloud.region": "us-east-1",
@@ -27,9 +24,6 @@
             "aws.firehose.request_id": "971ae05f-a128-4a7f-b623-30f9bc513e55",
             "aws.kinesis.name": "firehose-application-load-balancer-logs-to-elastic",
             "aws.kinesis.type": "deliverystream",
-            "cloud": {
-                "provider": "aws"
-            },
             "cloud.account.id": "123456",
             "cloud.provider": "aws",
             "cloud.region": "us-east-1",
@@ -48,9 +42,6 @@
             "aws.firehose.request_id": "971ae05f-a128-4a7f-b623-30f9bc513e55",
             "aws.kinesis.name": "firehose-network-load-balancer-logs-to-elastic",
             "aws.kinesis.type": "deliverystream",
-            "cloud": {
-                "provider": "aws"
-            },
             "cloud.account.id": "123456",
             "cloud.provider": "aws",
             "cloud.region": "us-east-1",

packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-firewall-log.json-expected.json

@@ -7,9 +7,6 @@
             "aws.firehose.subscription_filters": "[test-firewall-logs-to-firehose]",
             "aws.kinesis.name": "test-firewall-logs",
             "aws.kinesis.type": "deliverystream",
-            "cloud": {
-                "provider": "aws"
-            },
             "cloud.account.id": "123456789",
             "cloud.provider": "aws",
             "cloud.region": "us-east-1",

packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-route53-public-log.json-expected.json

@@ -9,9 +9,6 @@
             "aws.firehose.subscription_filters": "[test-route53-public-logs-to-firehose]",
             "aws.kinesis.name": "test-route53-public-logs",
             "aws.kinesis.type": "deliverystream",
-            "cloud": {
-                "provider": "aws"
-            },
             "cloud.account.id": "123456789",
             "cloud.provider": "aws",
             "cloud.region": "us-east-1",

packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-route53-resolver-log.json-expected.json

@@ -9,9 +9,6 @@
             "aws.firehose.subscription_filters": "[test-route53-resolver-logs-to-firehose]",
             "aws.kinesis.name": "test-route53-resolver-logs",
             "aws.kinesis.type": "deliverystream",
-            "cloud": {
-                "provider": "aws"
-            },
             "cloud.account.id": "123456789",
             "cloud.provider": "aws",
             "cloud.region": "us-east-1",

packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-s3access-log.json

@@ -1,34 +1,34 @@
 {
-  "events": [
-    {
-      "cloud.region": "us-east-1",
-      "aws.firehose.arn": "arn:aws:firehose:us-east-2:123456:deliverystream/firehose-s3access-logs-to-elastic",
-      "data_stream.namespace": "default",
-      "message": "36c1f05b76016b78528454e6e0c60e2b7ff7aa20c0a5e4c748276e5b0a2debd2 test-s3-ks [01/Aug/2019:00:24:41 +0000] 89.160.20.156 arn:aws:sts::123456:assumed-role/AWSServiceRoleForTrustedAdvisor/TrustedAdvisor_627959692251_784ab70b-8cc9-4d37-a2ec-2ff4d0c08af9 44EE8651683CB4DA REST.GET.LOCATION - \"GET /test-s3-ks/?location&aws-account=627959692251 HTTP/1.1\" 200 - 142 - 17 - \"-\" \"AWS-Support-TrustedAdvisor, aws-internal/3 aws-sdk-java/1.11.590 Linux/4.9.137-0.1.ac.218.74.329.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.212-b03 java/1.8.0_212 vendor/Oracle_Corporation\" - BsCfJedfuSnds2QFoxi+E/O7M6OEWzJnw4dUaes/2hyA363sONRJKzB7EOY+Bt9DTHYUn+HoHxI= SigV4 ECDHE-RSA-AES128-SHA AuthHeader s3.ap-southeast-1.amazonaws.com TLSv1.2",
-      "aws.kinesis.type": "deliverystream",
-      "data_stream.type": "logs",
-      "aws.firehose.request_id": "971ae05f-a128-4a7f-b623-30f9bc513e55",
-      "cloud.provider": "aws",
-      "@timestamp": "2023-07-25T21:04:35Z",
-      "cloud.account.id": "123456",
-      "data_stream.dataset": "awsfirehose",
-      "aws.kinesis.name": "firehose-s3access-logs-to-elastic",
-      "event.id": "37670326805251200781477669690942747782212394134076063744"
-    },
-    {
-      "cloud.region": "us-east-1",
-      "aws.firehose.arn": "arn:aws:firehose:us-east-2:123456:deliverystream/firehose-s3access-logs-to-elastic",
-      "data_stream.namespace": "default",
-      "message": "36c1f05b76016b78528454e6e0c60e2b7ff7aa20c0a5e4c748276e5b0a2debd2 test-s3-ks [01/Aug/2019:00:24:41 +0000] 89.160.20.156 arn:aws:sts::123456:assumed-role/AWSServiceRoleForTrustedAdvisor/TrustedAdvisor_627959692251_784ab70b-8cc9-4d37-a2ec-2ff4d0c08af9 44EE8651683CB4DA REST.GET.LOCATION - \"GET /test-s3-ks/?location&aws-account=627959692251 HTTP/1.1\" 200 - 142 - 17 - \"-\" \"AWS-Support-TrustedAdvisor, aws-internal/3 aws-sdk-java/1.11.590 Linux/4.9.137-0.1.ac.218.74.329.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.212-b03 java/1.8.0_212 vendor/Oracle_Corporation\" - BsCfJedfuSnds2QFoxi+E/O7M6OEWzJnw4dUaes/2hyA363sONRJKzB7EOY+Bt9DTHYUn+HoHxI= SigV4 ECDHE-RSA-AES128-SHA AuthHeader - TLSv1.2",
-      "aws.kinesis.type": "deliverystream",
-      "data_stream.type": "logs",
-      "aws.firehose.request_id": "971ae05f-a128-4a7f-b623-30f9bc513e55",
-      "cloud.provider": "aws",
-      "@timestamp": "2023-07-25T21:04:35Z",
-      "cloud.account.id": "123456",
-      "data_stream.dataset": "awsfirehose",
-      "aws.kinesis.name": "firehose-s3access-logs-to-elastic",
-      "event.id": "37670326805251200781477669690942747782212394134076063744"
-    }
-  ]
+    "events": [
+        {
+            "cloud.region": "us-east-1",
+            "aws.firehose.arn": "arn:aws:firehose:us-east-2:123456:deliverystream/firehose-s3access-logs-to-elastic",
+            "data_stream.namespace": "default",
+            "message": "36c1f05b76016b78528454e6e0c60e2b7ff7aa20c0a5e4c748276e5b0a2debd2 test-s3-ks [01/Aug/2019:00:24:41 +0000] 89.160.20.156 arn:aws:sts::123456:assumed-role/AWSServiceRoleForTrustedAdvisor/TrustedAdvisor_627959692251_784ab70b-8cc9-4d37-a2ec-2ff4d0c08af9 44EE8651683CB4DA REST.GET.LOCATION - \"GET /test-s3-ks/?location&aws-account=627959692251 HTTP/1.1\" 200 - 142 - 17 - \"-\" \"AWS-Support-TrustedAdvisor, aws-internal/3 aws-sdk-java/1.11.590 Linux/4.9.137-0.1.ac.218.74.329.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.212-b03 java/1.8.0_212 vendor/Oracle_Corporation\" - BsCfJedfuSnds2QFoxi+E/O7M6OEWzJnw4dUaes/2hyA363sONRJKzB7EOY+Bt9DTHYUn+HoHxI= SigV4 ECDHE-RSA-AES128-SHA AuthHeader s3.ap-southeast-1.amazonaws.com TLSv1.2",
+            "aws.kinesis.type": "deliverystream",
+            "data_stream.type": "logs",
+            "aws.firehose.request_id": "971ae05f-a128-4a7f-b623-30f9bc513e55",
+            "cloud.provider": "aws",
+            "@timestamp": "2023-07-25T21:04:35Z",
+            "cloud.account.id": "123456",
+            "data_stream.dataset": "awsfirehose",
+            "aws.kinesis.name": "firehose-s3access-logs-to-elastic",
+            "event.id": "37670326805251200781477669690942747782212394134076063744"
+        },
+        {
+            "cloud.region": "us-east-1",
+            "aws.firehose.arn": "arn:aws:firehose:us-east-2:123456:deliverystream/firehose-s3access-logs-to-elastic",
+            "data_stream.namespace": "default",
+            "message": "36c1f05b76016b78528454e6e0c60e2b7ff7aa20c0a5e4c748276e5b0a2debd2 test-s3-ks [01/Aug/2019:00:24:41 +0000] 89.160.20.156 arn:aws:sts::123456:assumed-role/AWSServiceRoleForTrustedAdvisor/TrustedAdvisor_627959692251_784ab70b-8cc9-4d37-a2ec-2ff4d0c08af9 44EE8651683CB4DA REST.GET.LOCATION - \"GET /test-s3-ks/?location&aws-account=627959692251 HTTP/1.1\" 200 - 142 - 17 - \"-\" \"AWS-Support-TrustedAdvisor, aws-internal/3 aws-sdk-java/1.11.590 Linux/4.9.137-0.1.ac.218.74.329.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.212-b03 java/1.8.0_212 vendor/Oracle_Corporation\" - BsCfJedfuSnds2QFoxi+E/O7M6OEWzJnw4dUaes/2hyA363sONRJKzB7EOY+Bt9DTHYUn+HoHxI= SigV4 ECDHE-RSA-AES128-SHA AuthHeader - TLSv1.2",
+            "aws.kinesis.type": "deliverystream",
+            "data_stream.type": "logs",
+            "aws.firehose.request_id": "971ae05f-a128-4a7f-b623-30f9bc513e55",
+            "cloud.provider": "aws",
+            "@timestamp": "2023-07-25T21:04:35Z",
+            "cloud.account.id": "123456",
+            "data_stream.dataset": "awsfirehose",
+            "aws.kinesis.name": "firehose-s3access-logs-to-elastic",
+            "event.id": "37670326805251200781477669690942747782212394134076063744"
+        }
+    ]
 }