fix(aws): Using JSON dump against dict-only payload (cloudtrail) to have consistent regex filtering (#1029)

Signed-off-by: Vincent Boutour <vincent.boutour@datadoghq.com>

Author: ViBiOh

aws/logs_monitoring/forwarder.py

@@ -92,19 +92,27 @@ def _forward_logs(self, logs, key=None):
                 log = add_retry_tag(log)
 
             evaluated_log = log
+            to_forward = None
 
             # apply scrubbing rules to inner log message
-            if isinstance(log, dict) and log.get("message"):
-                try:
-                    log["message"] = scrubber.scrub(log["message"])
-                    evaluated_log = log["message"]
-                except Exception as e:
-                    logger.error(
-                        f"Exception while scrubbing log message {log['message']}: {e}"
-                    )
+            if isinstance(log, dict):
+                if log.get("message"):
+                    try:
+                        log["message"] = scrubber.scrub(log["message"])
+                        evaluated_log = log["message"]
+                    except Exception as e:
+                        logger.error(
+                            f"Exception while scrubbing log message {log['message']}: {e}"
+                        )
+                else:
+                    to_forward = dump_event(log)
+                    evaluated_log = to_forward
 
             if matcher.match(evaluated_log):
-                logs_to_forward.append(json.dumps(log, ensure_ascii=False))
+                if to_forward is None:
+                    logs_to_forward.append(dump_event(log))
+                else:
+                    logs_to_forward.append(to_forward)
 
         batcher = DatadogBatcher(512 * 1000, 4 * 1000 * 1000, 400)
         cli = DatadogHTTPClient(
@@ -186,3 +194,7 @@ def _forward_traces(self, traces, key=None):
             if key:
                 self.storage.delete_data(key)
             send_event_metric("traces_forwarded", len(traces))
+
+
+def dump_event(event):
+    return json.dumps(event, ensure_ascii=False)