Cloudwatch fail to parse certain strings

I'm sending cloudtrails logs (from S3) to cloudwatch via Lambda.

When in cloudwatch, I want to make the simple query as follow it works:

{($.eventName = "ConsoleLogin") && ($.additionalEventData.MFAUsed = "Yes")}

It returns me the following json:

  "eventVersion": "1.05",
  "eventID": "***********",
  "eventTime": "2017-06-17T18:53:11Z",
  "additionalEventData": {
    "MFAUsed": "Yes",
    "LoginTo": "",
    "MobileVersion": "No"
  "requestParameters": null,
  "eventType": "AwsConsoleSignIn",
  "@timestamp": "2017-06-17T18:53:11Z",
  "geoip.countryName": "France",
  "responseElements": {
    "ConsoleLogin": "Success"
  "awsRegion": "us-east-1",
  "eventName": "ConsoleLogin",
  "geoip.coordinates": [
  "userIdentity": {
    "userName": "******",
    "type": "IAMUser",
    "arn": "arn:aws:iam::********:user/*******",
    "principalId": "******",
    "accountId": "**********"
  "eventSource": "signin",
  "": "ACityInFrance",
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36",
  "sourceIPAddress": "********",
  "recipientAccountId": "**********"

All good, but notice the fields I added (geoip...) thanks to lambda and maxmind.

Now if i want to make the query :

{($.eventName = "ConsoleLogin") && ($.additionalEventData.MFAUsed = "Yes") && ($.geoip.countryName = "France")}

It doesn't work anymore despite that those fields are effectively present in the JSON, does anyone has an idea why?