Skip to content

CloudTrail  >  Structures  >  AdvancedFieldSelector

AdvancedFieldSelector

Structure Class

AdvancedFieldSelector dataclass

A single selector statement in an advanced event selector.

Attributes

ends_with class-attribute instance-attribute 
ends_with: list[str] | None = None

An operator that includes events that match the last few characters of the event record field specified as the value of Field.

equals class-attribute instance-attribute 
equals: list[str] | None = None

An operator that includes events that match the exact value of the event record field specified as the value of Field. This is the only valid operator that you can use with the readOnly, eventCategory, and resources.type fields.

field instance-attribute 
field: str

A field in a CloudTrail event record on which to filter events to be logged. For event data stores for CloudTrail Insights events, Config configuration items, Audit Manager evidence, or events outside of Amazon Web Services, the field is used only for selecting events as filtering is not supported.

For more information, see AdvancedFieldSelector in the CloudTrail API Reference.

Note

Selectors don't support the use of wildcards like * . To match multiple values with a single condition, you may use StartsWith, EndsWith, NotStartsWith, or NotEndsWith to explicitly match the beginning or end of the event field.

not_ends_with class-attribute instance-attribute 
not_ends_with: list[str] | None = None

An operator that excludes events that match the last few characters of the event record field specified as the value of Field.

not_equals class-attribute instance-attribute 
not_equals: list[str] | None = None

An operator that excludes events that match the exact value of the event record field specified as the value of Field.

not_starts_with class-attribute instance-attribute 
not_starts_with: list[str] | None = None

An operator that excludes events that match the first few characters of the event record field specified as the value of Field.

starts_with class-attribute instance-attribute 
starts_with: list[str] | None = None

An operator that includes events that match the first few characters of the event record field specified as the value of Field.