pcon/sfdc-eventMonitoring

def totimestamp(td): td[:19] + "Z" | fromdate * 1000;
def fixurl(url): url | ltrimstr("\"") | rtrimstr("\"");
def getusername(id): $usermap[0][id];
def tonumbercustom: try tonumber catch null;

[.[] | {
    eventType: .EVENT_TYPE,
    timestamp: totimestamp(.TIMESTAMP_DERIVED),
    requestId: .REQUEST_ID,
    sessionId: .SESSION_KEY,
    userId: .USER_ID,
    username: getusername(.USER_ID),
    success: .SUCCESS,
    url: fixurl(.URL),
    uri: .URI,
    type: .TYPE,
    method: .METHOD,
    time: .TIME | tonumbercustom,
    requestSize: .REQUEST_SIZE | tonumbercustom,
    responseSize: .RESPONSE_SIZE | tonumbercustom
} | select(.timestamp > ($lasttimestamp | tonumber))]