eventarc-workflows-integration/eventarc-auditlog-bigquery/workflow.yaml

main:
    params: [event]
    steps:
    - log_event:
        call: sys.log
        args:
            text: ${event}
            severity: INFO
    - extract_data:
        assign:
        - user: ${event.data.protoPayload.authenticationInfo.principalEmail}
        - query: ${event.data.protoPayload.serviceData.jobCompletedEvent.job.jobConfiguration.query.query}
    - return_data:
        return:
            user: ${user}
            query: ${query}