Frank - Arg, sorry I didn't give you the _raw log. Here is the _raw log below, would what you gave me work for the _raw log? Attached is an image of the _raw log tabled out which is what I gave you in the first post. (I manually changed the data (i.e. IP's, acct #'s, etc, to hide secure info)
{"account_id": "2345625234", "vpc_id": "vpc-xxxxxx", "id": "sg-xxxxxx", "rules": [{"from_port": null, "groups": "\n ", "to_port": null, "grants": [{"owner_id": "323256661429", "group_id": "sg-xxxxx", "cidr_ip": null, "name": null}, {"owner_id": "253452345", "group_id": "sg-xxxxxx", "cidr_ip": null, "name": null}], "ipRanges": "", "ip_protocol": "-1"}, {"from_port": "22", "groups": "", "to_port": "22", "grants": [{"owner_id": null, "group_id": null, "cidr_ip": "11.233.34.0/24", "name": null}], "ipRanges": "\n ", "ip_protocol": "tcp"}, {"from_port": "443", "groups": "\n ", "to_port": "443", "grants": [{"owner_id": "2345432223", "group_id": "sg-770f1213", "cidr_ip": null, "name": null}, {"owner_id": null, "group_id": null, "cidr_ip": "12.45.50.0/24", "name": null}, {"owner_id": null, "group_id": null, "cidr_ip": "0.0.0.0/0", "name": null}], "ipRanges": "\n ", "ip_protocol": "tcp"}], "tags": {"aws:cloudformation:stack-id": "arn:aws-us:cloudformation:xxxx", "aws:cloudformation:stack-name": "xxx", "aws:cloudformation:logical-xx": "rSecurityGroup"}, "instances": [{"id": "i-0fqjwoi34f"}], "name": "SG-seccenter", "rules_egress": [{"from_port": null, "groups": "", "to_port": null, "grants": [{"owner_id": null, "group_id": null, "cidr_ip": "0.0.0.0/0", "name": null}], "ipRanges": "\n ", "ip_protocol": "-1"}], "region": "us-gov-west-1", "owner_id": "3234635623", "description": "SG for seccenter"}
... View more