I am trying to get the Instance_ID source IP,source port ,security group ,destintion IP,destination port and its security group of the AWS data, but all of the fields are from different source types and sources like below
Search A
index=main sourcetype="aws:cloudwatchlogs:vpcflow" ---- src_ip,src_port,dest_ip,dest_port
Search B
index=main sourcetype ="aws:description" source="us-east-1:ec2_security_groups"---- instances{}.id,description(security group)
Search C
index=main sourcetype ="aws:description" source="us-east-1:ec2_instances"- private_ip_address(this is common with search A with src_ip pr dest_ip), id (this field is same as instances{}.id in search B)
Is there a way to combine all these to do a table command to get the folllowing or is there any other sourcetype which has all these logs from aws point of view
|table Instance_ID src_ip src_port sg_group dest_ip dest_port dest_sg_id
Thanks in Advance
