CloudWatch pipelines processors
CloudWatch pipelines processors transform, parse, and enrich log data as it flows through the pipeline. A pipeline can have up to 20 processors that are applied sequentially in the order they are defined.
Transformation metadata
When a pipeline processes log events, CloudWatch pipelines automatically adds transformation metadata to each processed log entry. This metadata indicates that the log has been transformed, making it easy to distinguish between original and processed data. If you enable the Keep original log option during pipeline creation, you can compare the original log with the transformed version at any time.
| Category | Description |
|---|---|
| Parsers | Convert raw log data into structured formats, such as Open Cybersecurity Schema Framework (OCSF), CSV, JSON, and so on |
| Transformers | Modify log data structure; add, copy, move, or delete fields |
| String Processors | Manipulate string values; case conversion, trimming, substitution |
Topics
