✄𐘗
text code block:
✄𐘗FROM logs-aws.cloudtrail-*
| WHERE event.provider == "bedrock.amazonaws.com"
    AND event.action IN (
      "InvokeModel",
      "Converse",
      "ConverseStream",
      "InvokeModelWithResponseStream"
    )
    AND event.outcome == "success"
    AND aws.cloudtrail.user_identity.arn IS NOT NULL
    AND aws.cloudtrail.request_parameters IS NOT NULL
| GROK aws.cloudtrail.request_parameters """modelId=(?<Esql.model_id>[^,}\]]+)"""
| WHERE Esql.model_id IS NOT NULL
| STATS
    Esql.inference_call_count = COUNT(*),
    Esql.timestamp_min = MIN(@timestamp),
    Esql.timestamp_max = MAX(@timestamp),
    Esql.event_ingested_min = MIN(event.ingested),
    Esql.event_ingested_max = MAX(event.ingested),
    Esql.event_action_values = VALUES(event.action),
    Esql.source_ip_values = VALUES(source.ip),
    Esql.source_as_organization_name_values =
      VALUES(source.as.organization.name),
    Esql.source_geo_country_iso_code_values =
      VALUES(source.geo.country_iso_code),
    Esql.source_geo_city_name_values =
      VALUES(source.geo.city_name),
    Esql.user_name_values = VALUES(user.name),
    Esql.user_agent_original_values = VALUES(user_agent.original),
    Esql.aws_cloudtrail_user_identity_type_values =
      VALUES(aws.cloudtrail.user_identity.type),
    Esql.aws_cloudtrail_user_identity_access_key_id_values =
      VALUES(aws.cloudtrail.user_identity.access_key_id),
    Esql.session_issuer_arn_values =
      VALUES(aws.cloudtrail.user_identity.session_context.session_issuer.arn),
    Esql.cloud_region_values = VALUES(cloud.region),
    Esql.data_stream_namespace_values = VALUES(data_stream.namespace)
  BY aws.cloudtrail.user_identity.arn,
     cloud.account.id,
     Esql.model_id
| WHERE Esql.inference_call_count >= 500
| KEEP
    aws.cloudtrail.user_identity.arn,
    cloud.account.id,
    Esql.*
| sort Esql.inference_call_count desc