✄𐘗
text code block:
✄𐘗from logs-openai_chatgpt_enterprise.conversation_message-* metadata _id, _version, _index
| eval Esql.message_text = coalesce(message, "")
| where
    data_stream.dataset == "openai_chatgpt_enterprise.conversation_message" and
    Esql.message_text is not null and
    Esql.message_text != "" and
    not Esql.message_text like "*AKIAIOSFODNN7EXAMPLE*" and
    not Esql.message_text like "*ASIAIOSFODNN7EXAMPLE*" and
    not Esql.message_text like "*ghp_example*" and
    not Esql.message_text like "*sk-ant-api03-test*" and
    (
        Esql.message_text rlike """.*(AKIA|ASIA)[A-Z0-9]{16}.*""" or
        Esql.message_text rlike """.*gh[pousr]_[A-Za-z0-9]{36}.*""" or
        Esql.message_text rlike """.*github_pat_[A-Za-z0-9_]+.*""" or
        Esql.message_text rlike """.*-----BEGIN [A-Z ]*PRIVATE KEY-----.*""" or
        Esql.message_text rlike """.*xox[baprs]-[0-9]+-[0-9]+-[A-Za-z0-9]+.*""" or
        Esql.message_text rlike """.*sk_live_[A-Za-z0-9]+.*""" or
        Esql.message_text rlike """.*AIza[-A-Za-z0-9_]+.*""" or
        Esql.message_text rlike """.*npm_[A-Za-z0-9]{36}.*""" or
        Esql.message_text rlike """.*sk-ant-[A-Za-z0-9-]+.*""" or
        Esql.message_text rlike """.*sk-[A-Za-z0-9]{20,}.*""" or
        Esql.message_text rlike """.*hvs[.][A-Za-z0-9]+.*""" or
        Esql.message_text rlike """.*dckr_pat_[-A-Za-z0-9_]+.*""" or
        Esql.message_text rlike """.*SG[.][-A-Za-z0-9_]+[.][-A-Za-z0-9_]+.*""" or
        Esql.message_text rlike """.*(AccountKey=|SharedAccessKey=)[-A-Za-z0-9+/=]+.*""" or
        Esql.message_text rlike """.*eyJ[-A-Za-z0-9_]+[.]eyJ[-A-Za-z0-9_]+[.][-A-Za-z0-9_]+.*"""
    )
| keep
    _id, _version, _index, @timestamp, message, user.id, user.email,
    openai_chatgpt_enterprise.conversation_message.conversation.id,
    openai_chatgpt_enterprise.conversation_message.conversation.title,
    openai_chatgpt_enterprise.conversation_message.message.author.type,
    openai_chatgpt_enterprise.conversation_message.message.id,
    data_stream.*