How to create a cloudwatch event from an Auth0 log

I have installed the Export logs to CloudWatch extension. It works like a charm. I see the log group, I can run insight queries. No problems.

I am at a complete loss trying to figure out how to create a CloudWatch event rule. I have created many event rules for AWS services. But this is the first time I have created a rule for an external log.

What sort of event pattern do I use? I’m not sure what the sample event looks like when wrapped by AWS. I’m not even sure of which source to use.

I tried the following. Sadly, no errors, no data, and no events.

  "source": [
  "detail": {
    "type": [

Has anyone done this? Ideas? Suggestions?