Cloudwatch Filters

http://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html

{ $.mfaAuthenticated = "false" }

{ $.userIdentity.type != "AssumedRole" }

{ ( $.eventSource != "iam.amazonaws.com" ) && ( $.eventSource != "cloudtrail.amazonaws.com" ) && ( $.eventSource != "elasticfilesystem.amazonaws.com" )}

{ ( $.eventSource = "ec2.amazonaws.com" ) && ( $.eventName != "DescribeInstanceStatus" ) }

{ $.userIdentity.sessionContext.attributes.mfaAuthenticated != "true" }