filter eventName="CreateUser" | fields awsRegion, requestParameters.userName, responseElements.user.arn