[MODEL: dataset = google_workspace_drive_raw]
alter type = json_extract_scalar(events, "$.0.type"),
    operation = json_extract_scalar(events ,"$.0.name"),
    event_parameters = json_extract(events ,"$.0.parameters"),
    actor_email = json_extract_scalar(actor ,"$.email"),
    actor_profileId = json_extract_scalar(actor ,"$.profileId")
// change parameters type
| alter event_parameters = to_json_string(event_parameters )
| alter event_parameters = replace(event_parameters ,"\\"","\"")
//
| alter doc_type = arrayindex( regextract(event_parameters, "\"name\":\"doc_type\",\"value\"\:\"([^\"]+)\"") ,0),
    doc_title = arrayindex( regextract(event_parameters, "\"name\":\"doc_title\",\"value\"\:\"([^\"]+)\"") ,0),
    owner = arrayindex( regextract(event_parameters, "\"name\":\"owner\",\"value\"\:\"([^\"]+)\"") ,0)
| alter xdm.source.ipv4 = ipAddress,
    xdm.event.operation = operation,
    xdm.event.type = type,
    xdm.target.file.file_type = doc_type,
    xdm.target.file.filename = doc_title,
    xdm.source.user.username = actor_email,
    xdm.source.identity.username = actor_email,
    xdm.target.user.username = owner,
    xdm.target.identity.username = owner,
    xdm.source.user.identifier = actor_profileId,
    xdm.source.identity.identifier = actor_profileId,
    xdm.target.resource.type = kind;