eli-304 changing formatting of message for Splunk

Author: eddalmond1

infrastructure/stacks/api-layer/eventbridge.tf

@@ -74,15 +74,19 @@ resource "aws_cloudwatch_event_target" "firehose_target" {
     }
 
     input_template = jsonencode({
-      timestamp   = "<time>"
-      source      = "aws:cloudwatch:alarm"
-      account_id  = "<account>"
-      region      = "<region>"
-      alarm_name  = "<alarm_name>"
-      new_state   = "<new_state>"
-      old_state   = "<old_state>"
-      reason      = "<reason>"
-      severity    = "<new_state>" == "ALARM" ? "high" : "info"
+      time = "<time>"
+      host = "aws"
+      source = "aws:cloudwatch:alarm"
+      sourcetype = "aws:cloudwatch:alarm"
+      event = {
+        account_id  = "<account>"
+        region      = "<region>"
+        alarm_name  = "<alarm_name>"
+        new_state   = "<new_state>"
+        old_state   = "<old_state>"
+        reason      = "<reason>"
+        severity    = "<new_state>" == "ALARM" ? "high" : "info"
+      }
     })
   }
 }