amazon-web-services - 过滤 Cloudwatch 日志以获取用于登录工作区的客户端 IP (Powershell)

Question

我正在尝试在 cloudwatch 日志中搜索特定用户，以便提取他们登录的公共 IP。我在 PowerShell 中执行此操作。

        $params = @{
            logGroupName ="/aws/events/logons"
            logStreamName = $logStreamName
            StartTime = [int64](New-TimeSpan -Start (Get-Date "01/01/1970") -End (Get-Date)).TotalMilliseconds - (New-TimeSpan -Days $timeback).TotalMilliseconds
            endtime = [int64](New-TimeSpan -Start (Get-Date "01/01/1970") -End (Get-Date)).TotalMilliseconds
            filterpattern = $workspaceid

            }
       $events = Get-CWLFilteredLogEvent @params

但是，返回的事件不包含我过滤的工作区，只是一堆随机工作区：/