pcon/sfdc-eventMonitoring

def totimestamp(td): td[:19] + "Z" | fromdate * 1000;
def fixurl(url): url | ltrimstr("\"") | rtrimstr("\"");
def getusername(id): $usermap[0][id];
def tonumbercustom: try tonumber catch null;

[.[] | {
    eventType: .EVENT_TYPE,
    timestamp: totimestamp(.TIMESTAMP_DERIVED),
    requestId: .REQUEST_ID,
    organizationId: .ORGANIZATION_ID,
    userId: .USER_ID,
    username: getusername(.USER_ID),
    runTime: .RUN_TIME | tonumbercustom,
    cpuTime: .CPU_TIME | tonumbercustom,
    dbTime: .DB_TOTAL_TIME | tonumbercustom,
    uri: .URI,
    sessionKey: .SESSION_KEY,
    loginKey: .LOGIN_KEY,
    requestStatus: .REQUEST_STATUS,
    method: .METHOD,
    mediaType: .MEDIA_TYPE,
    statusCode: .STATUS_CODE | tonumbercustom,
    userAgent: .USER_AGENT,
    rowsProcessed: .ROWS_PROCESSED | tonumbercustom,
    numberFields: .NUMBER_FIELDS | tonumbercustom,
    dbBlocks: .DB_BLOCKS | tonumbercustom,
    dbCPUTime: .DB_CPU_TIME | tonumbercustom,
    requestSize: .REQUEST_SIZE | tonumbercustom,
    responseSize: .RESPONSE_SIZE | tonumbercustom,
    entityName: .ENTITY_NAME,
    clientIP: .CLIENT_IP
} | select(.timestamp > ($lasttimestamp | tonumber))]