Parse amazon cloudwatch RDS audit log for user

Question

I am working with RDS Audit logs and trying to parse out the username with a log query. The data in the audit for the @message column looks like this: 1234567890,rds-instance-name,rdsadmin,localhost,123,0,CONNECT,,,0

I would like to aggregate the counts for the various entries in the logs but I don't know how to parse the username out of the @message column. In the example above the username is rdsadmin.

Here is the query I have so far:

fields @timestamp, @message
| filter @message like /(?i)(connect)/
| parse @message /(?<@ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/
| stats count() AS counter by @user, @ip
| sort by @user desc, @counter desc
| limit 50

Would a regex be able to parse the third value in the comma separated string?

Answer 1

This appears to be working, maybe not the best way? :

fields @timestamp, @message
| filter @message like /(?i)(CONNECT)/
| parse @message ',*,*,' as @instance,@user
| parse @message /(?<@ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/
| stats count() AS counter by @user, @ip
| sort by @user desc, @counter desc
| limit 50