pcon/sfdc-eventMonitoring

def totimestamp(td): td[:19] + "Z" | fromdate * 1000;
def fixurl(url): url | ltrimstr("\"") | rtrimstr("\"");
def getusername(id): $usermap[0][id];
def tonumbercustom: try tonumber catch null;

[.[] | {
    eventType: .EVENT_TYPE,
    timestamp: totimestamp(.TIMESTAMP_DERIVED),
    requestId: .REQUEST_ID,
    organizationId: .ORGANIZATION_ID,
    userId: .USER_ID,
    username: getusername(.USER_ID),
    runTime: .RUN_TIME | tonumbercustom,
    cpuTime: .CPU_TIME | tonumbercustom,
    dbTime: .DB_TOTAL_TIME | tonumbercustom,
    uri: .URI,
    sessionKey: .SESSION_KEY,
    loginKey: .LOGIN_KEY,
    requestStatus: .REQUEST_STATUS,
    clientName: .CLIENT_NAME,
    className: .CLASS_NAME,
    methodName: .METHOD_NAME,
    limitPercent: .LIMIT_USAGE_PERCENT | tonumber,
    query: .QUERY,
    clientIP: .CLIENT_IP
} | select(.timestamp > ($lasttimestamp | tonumber))]