CloudWatch pipelines processors
CloudWatch pipelines processors transform, parse, and enrich log data as it flows through the pipeline. Log pipelines support up to 20 processors that are applied sequentially in the order they are defined. Metrics pipelines support up to 20 processors, applied sequentially in the order you define them. For metrics pipeline processors, see Metrics pipeline processors.
Transformation metadata
When a pipeline processes log events, CloudWatch pipelines automatically adds transformation metadata to each processed log entry. This metadata indicates that the log has been transformed, making it easy to distinguish between original and processed data. If you enable the Keep original log option during pipeline creation, you can compare the original log with the transformed version at any time.
| Category | Description |
|---|---|
| Parsers | Convert raw log data into structured formats, such as Open Cybersecurity Schema Framework (OCSF), CSV, JSON, and so on |
| Transformers | Modify log data structure; add, copy, move, or delete fields |
| String Processors | Manipulate string values; case conversion, trimming, substitution |
| Metrics processors | Add, delete, rename attributes and metrics on OTel metric datapoints |
Topics
