filter eventName="CreateUser"
    | fields awsRegion, requestParameters.userName, responseElements.user.arn