title: Falco output aws instance metadata
body: <p>I run falco and falcosidekick with docker compose, <strong>without k8s</strong>.</p>
  <p>I need to retrive aws instance metadata to falco rules output.
  I've found the jevt field class but I encountered an error on falco container start</p>
  <pre><code>Invalid output format 'command=%jevt.value[/awsRegion': 'invalid formatting token jevt.value[/awsRegion']
  </code></pre>
  <p>Here my rules:</p>
  <pre><code>- rule: Terminal shell in container
    desc: A shell was used as the entrypoint/exec point into a container with an attached terminal.
    condition: &gt;
      spawned_process and container
      and shell_procs and proc.tty != 0
      and container_entrypoint
      and not user_expected_terminal_shell_in_container_conditions
    output: &gt;
      command=%jevt.value[&quot;/awsRegion&quot;]
    priority: NOTICE
    tags: [ container, shell, mitre_execution ]
  </code></pre>
  <p>How can I do?
  Thank you</p>