I'm having trouble extracting values of the unmapped field in an athena query.
SELECT time, identity.user.uuid, identity.user.name, api.operation,
JSON_EXTRACT_SCALAR(JSON_EXTRACT(unmapped['responseElements'], '$.accessKey'), '$.userName') AS user_name,
JSON_EXTRACT_SCALAR(JSON_EXTRACT(unmapped['responseElements'], '$.accessKey'), '$.accessKeyId') AS access_key
FROM "amazon_security_lake_glue_db_us_east_1"."amazon_security_lake_table_us_east_1_cloud_trail"
WHERE api.operation = 'CreateAccessKey'
AND api.response.error IS NULL
AND eventhour >= '2022110100'
AND eventhour <= '2022110700'
AND accountid = '111122223333'
AND region in ('us-east-1','us-east-2','us-west-2', 'us-west-2')
ORDER BY accountid, time