from * metadata _id, _index, _version | where type=="PATH" and ends_with(name, "/.ssh/authorized_keys") and (nametype in ("CREATE", "NORMAL"))
