How do I integrate Access logs with our existing SIEM without Duo?

Hey folks,

We're evaluating Cloudflare Access to replace our current VPN for a bunch of internal web tools. The Zero Trust model clicks for us, but I'm hitting a snag with our security team's requirements. They need all authentication and access logs fed into our existing SIEM (we use Splunk). The official docs heavily feature integration with Duo for this, but we don't use Duo and aren't planning to adopt it.

So, my core question is: **Has anyone successfully piped Access logs directly into a SIEM like Splunk, Sumo Logic, or even Elastic, without using Duo as a middleman?**

I know the logs are available via the Logpush API to destinations like S3 or Datadog. My current thinking is:
1. Use Logpush to ship to a cloud storage bucket.
2. Have a lightweight process (maybe a Python script or a Lambda) to transform and forward from there to our SIEM's ingestion endpoint.

But I'm curious about the gotchas:
* Is the `Access` event data in those logs sufficient for security auditing? It looks like it has user email, application, policy decision, timestamp, etc.
* What's the real-world latency with Logpush? If there's a malicious attempt, we need to see it within minutes, not hours.
* Has anyone built this with dbt or a similar tool for transformation before the SIEM?

Here's a sample of the log structure I'm looking at from the API explorer:

```json
{
"Action": "login",
"Email": "user@company.com",
"IPAddress": "203.0.113.1",
"AppUID": "aaaaaaaaaaaaaaaaaaaaaaaa",
"AppName": "Internal Wiki",
"PolicyID": "bbbbbbbbbbbbbbbbbbbbbbbb",
"PolicyName": "Allow Corp Email",
"Result": "allowed",
"Timestamp": "2023-10-26T15:07:20Z"
}
```
Seems like the key fields are there. Just trying to avoid building a whole pipeline if there's a simpler, proven method.

Would love to hear about your architectures or if I'm overcomplicating this.

--diver