This is the new *CloudFormation Template Reference Guide*. Please update your bookmarks and links. For help getting started with CloudFormation, see the [AWS CloudFormation User Guide](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html).

# AWS::Logs::Transformer
<a name="aws-resource-logs-transformer"></a>

Creates or updates a *log transformer* for a single log group. You use log transformers to transform log events into a different format, making them easier for you to process and analyze. You can also transform logs from different sources into standardized formats that contains relevant, source-specific information.

After you have created a transformer, CloudWatch Logs performs the transformations at the time of log ingestion. You can then refer to the transformed versions of the logs during operations such as querying with CloudWatch Logs Insights or creating metric filters or subscription filers.

You can also use a transformer to copy metadata from metadata keys into the log events themselves. This metadata can include log group name, log stream name, account ID and Region.

A transformer for a log group is a series of processors, where each processor applies one type of transformation to the log events ingested into this log group. The processors work one after another, in the order that you list them, like a pipeline. For more information about the available processors to use in a transformer, see [ Processors that you can use](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-Processors).

Having log events in standardized format enables visibility across your applications for your log analysis, reporting, and alarming needs. CloudWatch Logs provides transformation for common log types with out-of-the-box transformation templates for major AWS log sources such as VPC flow logs, Lambda, and Amazon RDS. You can use pre-built transformation templates or create custom transformation policies.

You can create transformers only for the log groups in the Standard log class.

You can also set up a transformer at the account level. For more information, see [PutAccountPolicy](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutAccountPolicy.html). If there is both a log-group level transformer created with `PutTransformer` and an account-level transformer that could apply to the same log group, the log group uses only the log-group level transformer. It ignores the account-level transformer.

## Syntax
<a name="aws-resource-logs-transformer-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-resource-logs-transformer-syntax.json"></a>

```
{
  "Type" : "AWS::Logs::Transformer",
  "Properties" : {
      "[LogGroupIdentifier](#cfn-logs-transformer-loggroupidentifier)" : String,
      "[TransformerConfig](#cfn-logs-transformer-transformerconfig)" : [ Processor, ... ]
    }
}
```

### YAML
<a name="aws-resource-logs-transformer-syntax.yaml"></a>

```
Type: AWS::Logs::Transformer
Properties:
  [LogGroupIdentifier](#cfn-logs-transformer-loggroupidentifier): String
  [TransformerConfig](#cfn-logs-transformer-transformerconfig): 
    - Processor
```

## Properties
<a name="aws-resource-logs-transformer-properties"></a>

`LogGroupIdentifier`  <a name="cfn-logs-transformer-loggroupidentifier"></a>
Specify either the name or ARN of the log group to create the transformer for.   
*Required*: Yes  
*Type*: String  
*Pattern*: `[\w#+=/:,.@-]*`  
*Minimum*: `1`  
*Maximum*: `2048`  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`TransformerConfig`  <a name="cfn-logs-transformer-transformerconfig"></a>
This structure is an array that contains the configuration of this log transformer. A log transformer is an array of processors, where each processor applies one type of transformation to the log events that are ingested.  
*Required*: Yes  
*Type*: Array of [Processor](aws-properties-logs-transformer-processor.md)  
*Minimum*: `1`  
*Maximum*: `20`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

## Return values
<a name="aws-resource-logs-transformer-return-values"></a>

### Ref
<a name="aws-resource-logs-transformer-return-values-ref"></a>

# AWS::Logs::Transformer AddKeyEntry
<a name="aws-properties-logs-transformer-addkeyentry"></a>

This object defines one key that will be added with the [ addKeys](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-addKey) processor.

## Syntax
<a name="aws-properties-logs-transformer-addkeyentry-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-addkeyentry-syntax.json"></a>

```
{
  "[Key](#cfn-logs-transformer-addkeyentry-key)" : String,
  "[OverwriteIfExists](#cfn-logs-transformer-addkeyentry-overwriteifexists)" : Boolean,
  "[Value](#cfn-logs-transformer-addkeyentry-value)" : String
}
```

### YAML
<a name="aws-properties-logs-transformer-addkeyentry-syntax.yaml"></a>

```
  [Key](#cfn-logs-transformer-addkeyentry-key): String
  [OverwriteIfExists](#cfn-logs-transformer-addkeyentry-overwriteifexists): Boolean
  [Value](#cfn-logs-transformer-addkeyentry-value): String
```

## Properties
<a name="aws-properties-logs-transformer-addkeyentry-properties"></a>

`Key`  <a name="cfn-logs-transformer-addkeyentry-key"></a>
The key of the new entry to be added to the log event  
*Required*: Yes  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Maximum*: `128`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`OverwriteIfExists`  <a name="cfn-logs-transformer-addkeyentry-overwriteifexists"></a>
Specifies whether to overwrite the value if the key already exists in the log event. If you omit this, the default is `false`.  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Value`  <a name="cfn-logs-transformer-addkeyentry-value"></a>
The value of the new entry to be added to the log event  
*Required*: Yes  
*Type*: String  
*Minimum*: `1`  
*Maximum*: `256`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer AddKeys
<a name="aws-properties-logs-transformer-addkeys"></a>

This processor adds new key-value pairs to the log event. 

For more information about this processor including examples, see [ addKeys](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-addKeys) in the *CloudWatch Logs User Guide*.

## Syntax
<a name="aws-properties-logs-transformer-addkeys-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-addkeys-syntax.json"></a>

```
{
  "[Entries](#cfn-logs-transformer-addkeys-entries)" : [ AddKeyEntry, ... ]
}
```

### YAML
<a name="aws-properties-logs-transformer-addkeys-syntax.yaml"></a>

```
  [Entries](#cfn-logs-transformer-addkeys-entries): 
    - AddKeyEntry
```

## Properties
<a name="aws-properties-logs-transformer-addkeys-properties"></a>

`Entries`  <a name="cfn-logs-transformer-addkeys-entries"></a>
An array of objects, where each object contains the information about one key to add to the log event.   
*Required*: Yes  
*Type*: Array of [AddKeyEntry](aws-properties-logs-transformer-addkeyentry.md)  
*Minimum*: `1`  
*Maximum*: `5`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer CopyValue
<a name="aws-properties-logs-transformer-copyvalue"></a>

This processor copies values within a log event. You can also use this processor to add metadata to log events by copying the values of the following metadata keys into the log events: `@logGroupName`, `@logGroupStream`, `@accountId`, `@regionName`. 

For more information about this processor including examples, see [ copyValue](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-copyValue) in the *CloudWatch Logs User Guide*.

## Syntax
<a name="aws-properties-logs-transformer-copyvalue-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-copyvalue-syntax.json"></a>

```
{
  "[Entries](#cfn-logs-transformer-copyvalue-entries)" : [ CopyValueEntry, ... ]
}
```

### YAML
<a name="aws-properties-logs-transformer-copyvalue-syntax.yaml"></a>

```
  [Entries](#cfn-logs-transformer-copyvalue-entries): 
    - CopyValueEntry
```

## Properties
<a name="aws-properties-logs-transformer-copyvalue-properties"></a>

`Entries`  <a name="cfn-logs-transformer-copyvalue-entries"></a>
An array of `CopyValueEntry` objects, where each object contains the information about one field value to copy.   
*Required*: Yes  
*Type*: Array of [CopyValueEntry](aws-properties-logs-transformer-copyvalueentry.md)  
*Minimum*: `1`  
*Maximum*: `5`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer CopyValueEntry
<a name="aws-properties-logs-transformer-copyvalueentry"></a>

This object defines one value to be copied with the [ copyValue](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-copyValue) processor.

## Syntax
<a name="aws-properties-logs-transformer-copyvalueentry-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-copyvalueentry-syntax.json"></a>

```
{
  "[OverwriteIfExists](#cfn-logs-transformer-copyvalueentry-overwriteifexists)" : Boolean,
  "[Source](#cfn-logs-transformer-copyvalueentry-source)" : String,
  "[Target](#cfn-logs-transformer-copyvalueentry-target)" : String
}
```

### YAML
<a name="aws-properties-logs-transformer-copyvalueentry-syntax.yaml"></a>

```
  [OverwriteIfExists](#cfn-logs-transformer-copyvalueentry-overwriteifexists): Boolean
  [Source](#cfn-logs-transformer-copyvalueentry-source): String
  [Target](#cfn-logs-transformer-copyvalueentry-target): String
```

## Properties
<a name="aws-properties-logs-transformer-copyvalueentry-properties"></a>

`OverwriteIfExists`  <a name="cfn-logs-transformer-copyvalueentry-overwriteifexists"></a>
Specifies whether to overwrite the value if the destination key already exists. If you omit this, the default is `false`.  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Source`  <a name="cfn-logs-transformer-copyvalueentry-source"></a>
The key to copy.  
*Required*: Yes  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Target`  <a name="cfn-logs-transformer-copyvalueentry-target"></a>
The key of the field to copy the value to.  
*Required*: Yes  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Maximum*: `128`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer Csv
<a name="aws-properties-logs-transformer-csv"></a>

The `CSV` processor parses comma-separated values (CSV) from the log events into columns.

For more information about this processor including examples, see [ csv](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-csv) in the *CloudWatch Logs User Guide*.

## Syntax
<a name="aws-properties-logs-transformer-csv-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-csv-syntax.json"></a>

```
{
  "[Columns](#cfn-logs-transformer-csv-columns)" : [ String, ... ],
  "[Delimiter](#cfn-logs-transformer-csv-delimiter)" : String,
  "[QuoteCharacter](#cfn-logs-transformer-csv-quotecharacter)" : String,
  "[Source](#cfn-logs-transformer-csv-source)" : String
}
```

### YAML
<a name="aws-properties-logs-transformer-csv-syntax.yaml"></a>

```
  [Columns](#cfn-logs-transformer-csv-columns): 
    - String
  [Delimiter](#cfn-logs-transformer-csv-delimiter): String
  [QuoteCharacter](#cfn-logs-transformer-csv-quotecharacter): String
  [Source](#cfn-logs-transformer-csv-source): String
```

## Properties
<a name="aws-properties-logs-transformer-csv-properties"></a>

`Columns`  <a name="cfn-logs-transformer-csv-columns"></a>
An array of names to use for the columns in the transformed log event.  
If you omit this, default column names (`[column_1, column_2 ...]`) are used.  
*Required*: No  
*Type*: Array of String  
*Minimum*: `1`  
*Maximum*: `100`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Delimiter`  <a name="cfn-logs-transformer-csv-delimiter"></a>
The character used to separate each column in the original comma-separated value log event. If you omit this, the processor looks for the comma `,` character as the delimiter.  
*Required*: No  
*Type*: String  
*Maximum*: `2`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`QuoteCharacter`  <a name="cfn-logs-transformer-csv-quotecharacter"></a>
The character used used as a text qualifier for a single column of data. If you omit this, the double quotation mark `"` character is used.  
*Required*: No  
*Type*: String  
*Maximum*: `1`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Source`  <a name="cfn-logs-transformer-csv-source"></a>
The path to the field in the log event that has the comma separated values to be parsed. If you omit this value, the whole log message is processed.  
*Required*: No  
*Type*: String  
*Minimum*: `1`  
*Maximum*: `128`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer DateTimeConverter
<a name="aws-properties-logs-transformer-datetimeconverter"></a>

This processor converts a datetime string into a format that you specify. 

For more information about this processor including examples, see [ datetimeConverter](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-datetimeConverter) in the *CloudWatch Logs User Guide*.

## Syntax
<a name="aws-properties-logs-transformer-datetimeconverter-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-datetimeconverter-syntax.json"></a>

```
{
  "[Locale](#cfn-logs-transformer-datetimeconverter-locale)" : String,
  "[MatchPatterns](#cfn-logs-transformer-datetimeconverter-matchpatterns)" : [ String, ... ],
  "[Source](#cfn-logs-transformer-datetimeconverter-source)" : String,
  "[SourceTimezone](#cfn-logs-transformer-datetimeconverter-sourcetimezone)" : String,
  "[Target](#cfn-logs-transformer-datetimeconverter-target)" : String,
  "[TargetFormat](#cfn-logs-transformer-datetimeconverter-targetformat)" : String,
  "[TargetTimezone](#cfn-logs-transformer-datetimeconverter-targettimezone)" : String
}
```

### YAML
<a name="aws-properties-logs-transformer-datetimeconverter-syntax.yaml"></a>

```
  [Locale](#cfn-logs-transformer-datetimeconverter-locale): String
  [MatchPatterns](#cfn-logs-transformer-datetimeconverter-matchpatterns): 
    - String
  [Source](#cfn-logs-transformer-datetimeconverter-source): String
  [SourceTimezone](#cfn-logs-transformer-datetimeconverter-sourcetimezone): String
  [Target](#cfn-logs-transformer-datetimeconverter-target): String
  [TargetFormat](#cfn-logs-transformer-datetimeconverter-targetformat): String
  [TargetTimezone](#cfn-logs-transformer-datetimeconverter-targettimezone): String
```

## Properties
<a name="aws-properties-logs-transformer-datetimeconverter-properties"></a>

`Locale`  <a name="cfn-logs-transformer-datetimeconverter-locale"></a>
The locale of the source field. If you omit this, the default of `locale.ROOT` is used.  
*Required*: No  
*Type*: String  
*Minimum*: `1`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`MatchPatterns`  <a name="cfn-logs-transformer-datetimeconverter-matchpatterns"></a>
A list of patterns to match against the `source` field.  
*Required*: Yes  
*Type*: Array of String  
*Minimum*: `1`  
*Maximum*: `5`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Source`  <a name="cfn-logs-transformer-datetimeconverter-source"></a>
The key to apply the date conversion to.  
*Required*: Yes  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`SourceTimezone`  <a name="cfn-logs-transformer-datetimeconverter-sourcetimezone"></a>
The time zone of the source field. If you omit this, the default used is the UTC zone.  
*Required*: No  
*Type*: String  
*Minimum*: `1`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Target`  <a name="cfn-logs-transformer-datetimeconverter-target"></a>
The JSON field to store the result in.  
*Required*: Yes  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Maximum*: `128`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`TargetFormat`  <a name="cfn-logs-transformer-datetimeconverter-targetformat"></a>
The datetime format to use for the converted data in the target field.  
If you omit this, the default of ` yyyy-MM-dd'T'HH:mm:ss.SSS'Z` is used.  
*Required*: No  
*Type*: String  
*Minimum*: `1`  
*Maximum*: `64`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`TargetTimezone`  <a name="cfn-logs-transformer-datetimeconverter-targettimezone"></a>
The time zone of the target field. If you omit this, the default used is the UTC zone.  
*Required*: No  
*Type*: String  
*Minimum*: `1`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer DeleteKeys
<a name="aws-properties-logs-transformer-deletekeys"></a>

This processor deletes entries from a log event. These entries are key-value pairs. 

For more information about this processor including examples, see [ deleteKeys](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-deleteKeys) in the *CloudWatch Logs User Guide*.

## Syntax
<a name="aws-properties-logs-transformer-deletekeys-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-deletekeys-syntax.json"></a>

```
{
  "[WithKeys](#cfn-logs-transformer-deletekeys-withkeys)" : [ String, ... ]
}
```

### YAML
<a name="aws-properties-logs-transformer-deletekeys-syntax.yaml"></a>

```
  [WithKeys](#cfn-logs-transformer-deletekeys-withkeys): 
    - String
```

## Properties
<a name="aws-properties-logs-transformer-deletekeys-properties"></a>

`WithKeys`  <a name="cfn-logs-transformer-deletekeys-withkeys"></a>
The list of keys to delete.  
*Required*: Yes  
*Type*: Array of String  
*Minimum*: `1`  
*Maximum*: `5`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer Grok
<a name="aws-properties-logs-transformer-grok"></a>

This processor uses pattern matching to parse and structure unstructured data. This processor can also extract fields from log messages.

For more information about this processor including examples, see [ grok](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-Grok) in the *CloudWatch Logs User Guide*.

## Syntax
<a name="aws-properties-logs-transformer-grok-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-grok-syntax.json"></a>

```
{
  "[Match](#cfn-logs-transformer-grok-match)" : String,
  "[Source](#cfn-logs-transformer-grok-source)" : String
}
```

### YAML
<a name="aws-properties-logs-transformer-grok-syntax.yaml"></a>

```
  [Match](#cfn-logs-transformer-grok-match): String
  [Source](#cfn-logs-transformer-grok-source): String
```

## Properties
<a name="aws-properties-logs-transformer-grok-properties"></a>

`Match`  <a name="cfn-logs-transformer-grok-match"></a>
The grok pattern to match against the log event. For a list of supported grok patterns, see [Supported grok patterns](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#Grok-Patterns).  
*Required*: Yes  
*Type*: String  
*Maximum*: `512`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Source`  <a name="cfn-logs-transformer-grok-source"></a>
The path to the field in the log event that you want to parse. If you omit this value, the whole log message is parsed.  
*Required*: No  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer ListToMap
<a name="aws-properties-logs-transformer-listtomap"></a>

This processor takes a list of objects that contain key fields, and converts them into a map of target keys.

For more information about this processor including examples, see [ listToMap](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-listToMap) in the *CloudWatch Logs User Guide*.

## Syntax
<a name="aws-properties-logs-transformer-listtomap-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-listtomap-syntax.json"></a>

```
{
  "[Flatten](#cfn-logs-transformer-listtomap-flatten)" : Boolean,
  "[FlattenedElement](#cfn-logs-transformer-listtomap-flattenedelement)" : String,
  "[Key](#cfn-logs-transformer-listtomap-key)" : String,
  "[Source](#cfn-logs-transformer-listtomap-source)" : String,
  "[Target](#cfn-logs-transformer-listtomap-target)" : String,
  "[ValueKey](#cfn-logs-transformer-listtomap-valuekey)" : String
}
```

### YAML
<a name="aws-properties-logs-transformer-listtomap-syntax.yaml"></a>

```
  [Flatten](#cfn-logs-transformer-listtomap-flatten): Boolean
  [FlattenedElement](#cfn-logs-transformer-listtomap-flattenedelement): String
  [Key](#cfn-logs-transformer-listtomap-key): String
  [Source](#cfn-logs-transformer-listtomap-source): String
  [Target](#cfn-logs-transformer-listtomap-target): String
  [ValueKey](#cfn-logs-transformer-listtomap-valuekey): String
```

## Properties
<a name="aws-properties-logs-transformer-listtomap-properties"></a>

`Flatten`  <a name="cfn-logs-transformer-listtomap-flatten"></a>
A Boolean value to indicate whether the list will be flattened into single items. Specify `true` to flatten the list. The default is `false`  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`FlattenedElement`  <a name="cfn-logs-transformer-listtomap-flattenedelement"></a>
If you set `flatten` to `true`, use `flattenedElement` to specify which element, `first` or `last`, to keep.   
You must specify this parameter if `flatten` is `true`  
*Required*: No  
*Type*: String  
*Allowed values*: `first | last`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Key`  <a name="cfn-logs-transformer-listtomap-key"></a>
The key of the field to be extracted as keys in the generated map  
*Required*: Yes  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Source`  <a name="cfn-logs-transformer-listtomap-source"></a>
The key in the log event that has a list of objects that will be converted to a map.  
*Required*: Yes  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Target`  <a name="cfn-logs-transformer-listtomap-target"></a>
The key of the field that will hold the generated map   
*Required*: No  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Maximum*: `128`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ValueKey`  <a name="cfn-logs-transformer-listtomap-valuekey"></a>
If this is specified, the values that you specify in this parameter will be extracted from the `source` objects and put into the values of the generated map. Otherwise, original objects in the source list will be put into the values of the generated map.  
*Required*: No  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer LowerCaseString
<a name="aws-properties-logs-transformer-lowercasestring"></a>

This processor converts a string to lowercase.

For more information about this processor including examples, see [ lowerCaseString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-lowerCaseString) in the *CloudWatch Logs User Guide*.

## Syntax
<a name="aws-properties-logs-transformer-lowercasestring-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-lowercasestring-syntax.json"></a>

```
{
  "[WithKeys](#cfn-logs-transformer-lowercasestring-withkeys)" : [ String, ... ]
}
```

### YAML
<a name="aws-properties-logs-transformer-lowercasestring-syntax.yaml"></a>

```
  [WithKeys](#cfn-logs-transformer-lowercasestring-withkeys): 
    - String
```

## Properties
<a name="aws-properties-logs-transformer-lowercasestring-properties"></a>

`WithKeys`  <a name="cfn-logs-transformer-lowercasestring-withkeys"></a>
The array caontaining the keys of the fields to convert to lowercase.  
*Required*: Yes  
*Type*: Array of String  
*Minimum*: `1`  
*Maximum*: `10`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer MoveKeyEntry
<a name="aws-properties-logs-transformer-movekeyentry"></a>

This object defines one key that will be moved with the [ moveKey](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-moveKey) processor.

## Syntax
<a name="aws-properties-logs-transformer-movekeyentry-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-movekeyentry-syntax.json"></a>

```
{
  "[OverwriteIfExists](#cfn-logs-transformer-movekeyentry-overwriteifexists)" : Boolean,
  "[Source](#cfn-logs-transformer-movekeyentry-source)" : String,
  "[Target](#cfn-logs-transformer-movekeyentry-target)" : String
}
```

### YAML
<a name="aws-properties-logs-transformer-movekeyentry-syntax.yaml"></a>

```
  [OverwriteIfExists](#cfn-logs-transformer-movekeyentry-overwriteifexists): Boolean
  [Source](#cfn-logs-transformer-movekeyentry-source): String
  [Target](#cfn-logs-transformer-movekeyentry-target): String
```

## Properties
<a name="aws-properties-logs-transformer-movekeyentry-properties"></a>

`OverwriteIfExists`  <a name="cfn-logs-transformer-movekeyentry-overwriteifexists"></a>
Specifies whether to overwrite the value if the destination key already exists. If you omit this, the default is `false`.  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Source`  <a name="cfn-logs-transformer-movekeyentry-source"></a>
The key to move.  
*Required*: Yes  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Target`  <a name="cfn-logs-transformer-movekeyentry-target"></a>
The key to move to.  
*Required*: Yes  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer MoveKeys
<a name="aws-properties-logs-transformer-movekeys"></a>

This processor moves a key from one field to another. The original key is deleted.

For more information about this processor including examples, see [ moveKeys](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-moveKeys) in the *CloudWatch Logs User Guide*.

## Syntax
<a name="aws-properties-logs-transformer-movekeys-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-movekeys-syntax.json"></a>

```
{
  "[Entries](#cfn-logs-transformer-movekeys-entries)" : [ MoveKeyEntry, ... ]
}
```

### YAML
<a name="aws-properties-logs-transformer-movekeys-syntax.yaml"></a>

```
  [Entries](#cfn-logs-transformer-movekeys-entries): 
    - MoveKeyEntry
```

## Properties
<a name="aws-properties-logs-transformer-movekeys-properties"></a>

`Entries`  <a name="cfn-logs-transformer-movekeys-entries"></a>
An array of objects, where each object contains the information about one key to move.   
*Required*: Yes  
*Type*: Array of [MoveKeyEntry](aws-properties-logs-transformer-movekeyentry.md)  
*Minimum*: `1`  
*Maximum*: `5`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer ParseCloudfront
<a name="aws-properties-logs-transformer-parsecloudfront"></a>

This processor parses CloudFront vended logs, extract fields, and convert them into JSON format. Encoded field values are decoded. Values that are integers and doubles are treated as such. For more information about this processor including examples, see [ parseCloudfront](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-parseCloudfront)

For more information about CloudFront log format, see [ Configure and use standard logs (access logs)](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html).

If you use this processor, it must be the first processor in your transformer.

## Syntax
<a name="aws-properties-logs-transformer-parsecloudfront-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-parsecloudfront-syntax.json"></a>

```
{
  "[Source](#cfn-logs-transformer-parsecloudfront-source)" : String
}
```

### YAML
<a name="aws-properties-logs-transformer-parsecloudfront-syntax.yaml"></a>

```
  [Source](#cfn-logs-transformer-parsecloudfront-source): String
```

## Properties
<a name="aws-properties-logs-transformer-parsecloudfront-properties"></a>

`Source`  <a name="cfn-logs-transformer-parsecloudfront-source"></a>
Omit this parameter and the whole log message will be processed by this processor. No other value than `@message` is allowed for `source`.  
*Required*: No  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer ParseJSON
<a name="aws-properties-logs-transformer-parsejson"></a>

This processor parses log events that are in JSON format. It can extract JSON key-value pairs and place them under a destination that you specify.

Additionally, because you must have at least one parse-type processor in a transformer, you can use `ParseJSON` as that processor for JSON-format logs, so that you can also apply other processors, such as mutate processors, to these logs.

For more information about this processor including examples, see [ parseJSON](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-parseJSON) in the *CloudWatch Logs User Guide*.

## Syntax
<a name="aws-properties-logs-transformer-parsejson-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-parsejson-syntax.json"></a>

```
{
  "[Destination](#cfn-logs-transformer-parsejson-destination)" : String,
  "[Source](#cfn-logs-transformer-parsejson-source)" : String
}
```

### YAML
<a name="aws-properties-logs-transformer-parsejson-syntax.yaml"></a>

```
  [Destination](#cfn-logs-transformer-parsejson-destination): String
  [Source](#cfn-logs-transformer-parsejson-source): String
```

## Properties
<a name="aws-properties-logs-transformer-parsejson-properties"></a>

`Destination`  <a name="cfn-logs-transformer-parsejson-destination"></a>
The location to put the parsed key value pair into. If you omit this parameter, it is placed under the root node.  
*Required*: No  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Maximum*: `128`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Source`  <a name="cfn-logs-transformer-parsejson-source"></a>
Path to the field in the log event that will be parsed. Use dot notation to access child fields. For example, `store.book`  
*Required*: No  
*Type*: String  
*Minimum*: `1`  
*Maximum*: `128`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer ParseKeyValue
<a name="aws-properties-logs-transformer-parsekeyvalue"></a>

This processor parses a specified field in the original log event into key-value pairs. 

For more information about this processor including examples, see [ parseKeyValue](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parseKeyValue) in the *CloudWatch Logs User Guide*.

## Syntax
<a name="aws-properties-logs-transformer-parsekeyvalue-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-parsekeyvalue-syntax.json"></a>

```
{
  "[Destination](#cfn-logs-transformer-parsekeyvalue-destination)" : String,
  "[FieldDelimiter](#cfn-logs-transformer-parsekeyvalue-fielddelimiter)" : String,
  "[KeyPrefix](#cfn-logs-transformer-parsekeyvalue-keyprefix)" : String,
  "[KeyValueDelimiter](#cfn-logs-transformer-parsekeyvalue-keyvaluedelimiter)" : String,
  "[NonMatchValue](#cfn-logs-transformer-parsekeyvalue-nonmatchvalue)" : String,
  "[OverwriteIfExists](#cfn-logs-transformer-parsekeyvalue-overwriteifexists)" : Boolean,
  "[Source](#cfn-logs-transformer-parsekeyvalue-source)" : String
}
```

### YAML
<a name="aws-properties-logs-transformer-parsekeyvalue-syntax.yaml"></a>

```
  [Destination](#cfn-logs-transformer-parsekeyvalue-destination): String
  [FieldDelimiter](#cfn-logs-transformer-parsekeyvalue-fielddelimiter): String
  [KeyPrefix](#cfn-logs-transformer-parsekeyvalue-keyprefix): String
  [KeyValueDelimiter](#cfn-logs-transformer-parsekeyvalue-keyvaluedelimiter): String
  [NonMatchValue](#cfn-logs-transformer-parsekeyvalue-nonmatchvalue): String
  [OverwriteIfExists](#cfn-logs-transformer-parsekeyvalue-overwriteifexists): Boolean
  [Source](#cfn-logs-transformer-parsekeyvalue-source): String
```

## Properties
<a name="aws-properties-logs-transformer-parsekeyvalue-properties"></a>

`Destination`  <a name="cfn-logs-transformer-parsekeyvalue-destination"></a>
The destination field to put the extracted key-value pairs into  
*Required*: No  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`FieldDelimiter`  <a name="cfn-logs-transformer-parsekeyvalue-fielddelimiter"></a>
The field delimiter string that is used between key-value pairs in the original log events. If you omit this, the ampersand `&` character is used.  
*Required*: No  
*Type*: String  
*Minimum*: `1`  
*Maximum*: `128`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`KeyPrefix`  <a name="cfn-logs-transformer-parsekeyvalue-keyprefix"></a>
If you want to add a prefix to all transformed keys, specify it here.  
*Required*: No  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`KeyValueDelimiter`  <a name="cfn-logs-transformer-parsekeyvalue-keyvaluedelimiter"></a>
The delimiter string to use between the key and value in each pair in the transformed log event.  
 If you omit this, the equal `=` character is used.  
*Required*: No  
*Type*: String  
*Minimum*: `1`  
*Maximum*: `128`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`NonMatchValue`  <a name="cfn-logs-transformer-parsekeyvalue-nonmatchvalue"></a>
A value to insert into the value field in the result, when a key-value pair is not successfully split.  
*Required*: No  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`OverwriteIfExists`  <a name="cfn-logs-transformer-parsekeyvalue-overwriteifexists"></a>
Specifies whether to overwrite the value if the destination key already exists. If you omit this, the default is `false`.  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Source`  <a name="cfn-logs-transformer-parsekeyvalue-source"></a>
Path to the field in the log event that will be parsed. Use dot notation to access child fields. For example, `store.book`  
*Required*: No  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer ParsePostgres
<a name="aws-properties-logs-transformer-parsepostgres"></a>

Use this processor to parse RDS for PostgreSQL vended logs, extract fields, and and convert them into a JSON format. This processor always processes the entire log event message. For more information about this processor including examples, see [ parsePostGres](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-parsePostGres).

For more information about RDS for PostgreSQL log format, see [ RDS for PostgreSQL database log filesTCP flag sequence](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_LogAccess.Concepts.PostgreSQL.html#USER_LogAccess.Concepts.PostgreSQL.Log_Format.log-line-prefix).

**Important**  
If you use this processor, it must be the first processor in your transformer.

## Syntax
<a name="aws-properties-logs-transformer-parsepostgres-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-parsepostgres-syntax.json"></a>

```
{
  "[Source](#cfn-logs-transformer-parsepostgres-source)" : String
}
```

### YAML
<a name="aws-properties-logs-transformer-parsepostgres-syntax.yaml"></a>

```
  [Source](#cfn-logs-transformer-parsepostgres-source): String
```

## Properties
<a name="aws-properties-logs-transformer-parsepostgres-properties"></a>

`Source`  <a name="cfn-logs-transformer-parsepostgres-source"></a>
Omit this parameter and the whole log message will be processed by this processor. No other value than `@message` is allowed for `source`.  
*Required*: No  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer ParseRoute53
<a name="aws-properties-logs-transformer-parseroute53"></a>

Use this processor to parse Route 53 vended logs, extract fields, and and convert them into a JSON format. This processor always processes the entire log event message. For more information about this processor including examples, see [ parseRoute53](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-parseRoute53).

**Important**  
If you use this processor, it must be the first processor in your transformer.

## Syntax
<a name="aws-properties-logs-transformer-parseroute53-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-parseroute53-syntax.json"></a>

```
{
  "[Source](#cfn-logs-transformer-parseroute53-source)" : String
}
```

### YAML
<a name="aws-properties-logs-transformer-parseroute53-syntax.yaml"></a>

```
  [Source](#cfn-logs-transformer-parseroute53-source): String
```

## Properties
<a name="aws-properties-logs-transformer-parseroute53-properties"></a>

`Source`  <a name="cfn-logs-transformer-parseroute53-source"></a>
Omit this parameter and the whole log message will be processed by this processor. No other value than `@message` is allowed for `source`.  
*Required*: No  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer ParseToOCSF
<a name="aws-properties-logs-transformer-parsetoocsf"></a>

This processor converts logs into [Open Cybersecurity Schema Framework (OCSF)](https://ocsf.io) events.

For more information about this processor including examples, see [parseToOCSF](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parseToOCSF) in the *CloudWatch Logs User Guide*.

## Syntax
<a name="aws-properties-logs-transformer-parsetoocsf-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-parsetoocsf-syntax.json"></a>

```
{
  "[EventSource](#cfn-logs-transformer-parsetoocsf-eventsource)" : String,
  "[MappingVersion](#cfn-logs-transformer-parsetoocsf-mappingversion)" : String,
  "[OcsfVersion](#cfn-logs-transformer-parsetoocsf-ocsfversion)" : String,
  "[Source](#cfn-logs-transformer-parsetoocsf-source)" : String
}
```

### YAML
<a name="aws-properties-logs-transformer-parsetoocsf-syntax.yaml"></a>

```
  [EventSource](#cfn-logs-transformer-parsetoocsf-eventsource): String
  [MappingVersion](#cfn-logs-transformer-parsetoocsf-mappingversion): String
  [OcsfVersion](#cfn-logs-transformer-parsetoocsf-ocsfversion): String
  [Source](#cfn-logs-transformer-parsetoocsf-source): String
```

## Properties
<a name="aws-properties-logs-transformer-parsetoocsf-properties"></a>

`EventSource`  <a name="cfn-logs-transformer-parsetoocsf-eventsource"></a>
Specify the service or process that produces the log events that will be converted with this processor.  
*Required*: Yes  
*Type*: String  
*Allowed values*: `CloudTrail | Route53Resolver | VPCFlow | EKSAudit | AWSWAF`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`MappingVersion`  <a name="cfn-logs-transformer-parsetoocsf-mappingversion"></a>
The version of the OCSF mapping to use for parsing log data.  
*Required*: No  
*Type*: String  
*Pattern*: `^v\d+\.\d+(\.\d+)?$`  
*Minimum*: `1`  
*Maximum*: `10`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`OcsfVersion`  <a name="cfn-logs-transformer-parsetoocsf-ocsfversion"></a>
Specify which version of the OCSF schema to use for the transformed log events.  
*Required*: Yes  
*Type*: String  
*Allowed values*: `V1.1 | V1.5`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Source`  <a name="cfn-logs-transformer-parsetoocsf-source"></a>
The path to the field in the log event that you want to parse. If you omit this value, the whole log message is parsed.  
*Required*: No  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer ParseVPC
<a name="aws-properties-logs-transformer-parsevpc"></a>

Use this processor to parse Amazon VPC vended logs, extract fields, and and convert them into a JSON format. This processor always processes the entire log event message.

This processor doesn't support custom log formats, such as NAT gateway logs. For more information about custom log formats in Amazon VPC, see [ parseVPC](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html#flow-log-example-tcp-flag) For more information about this processor including examples, see [ parseVPC](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parseVPC).

**Important**  
If you use this processor, it must be the first processor in your transformer.

## Syntax
<a name="aws-properties-logs-transformer-parsevpc-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-parsevpc-syntax.json"></a>

```
{
  "[Source](#cfn-logs-transformer-parsevpc-source)" : String
}
```

### YAML
<a name="aws-properties-logs-transformer-parsevpc-syntax.yaml"></a>

```
  [Source](#cfn-logs-transformer-parsevpc-source): String
```

## Properties
<a name="aws-properties-logs-transformer-parsevpc-properties"></a>

`Source`  <a name="cfn-logs-transformer-parsevpc-source"></a>
Omit this parameter and the whole log message will be processed by this processor. No other value than `@message` is allowed for `source`.  
*Required*: No  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer ParseWAF
<a name="aws-properties-logs-transformer-parsewaf"></a>

Use this processor to parse AWS WAF vended logs, extract fields, and and convert them into a JSON format. This processor always processes the entire log event message. For more information about this processor including examples, see [ parseWAF](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-parsePostGres).

For more information about AWS WAF log format, see [ Log examples for web ACL traffic](https://docs.aws.amazon.com/waf/latest/developerguide/logging-examples.html).

**Important**  
If you use this processor, it must be the first processor in your transformer.

## Syntax
<a name="aws-properties-logs-transformer-parsewaf-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-parsewaf-syntax.json"></a>

```
{
  "[Source](#cfn-logs-transformer-parsewaf-source)" : String
}
```

### YAML
<a name="aws-properties-logs-transformer-parsewaf-syntax.yaml"></a>

```
  [Source](#cfn-logs-transformer-parsewaf-source): String
```

## Properties
<a name="aws-properties-logs-transformer-parsewaf-properties"></a>

`Source`  <a name="cfn-logs-transformer-parsewaf-source"></a>
Omit this parameter and the whole log message will be processed by this processor. No other value than `@message` is allowed for `source`.  
*Required*: No  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer Processor
<a name="aws-properties-logs-transformer-processor"></a>

This structure contains the information about one processor in a log transformer.

## Syntax
<a name="aws-properties-logs-transformer-processor-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-processor-syntax.json"></a>

```
{
  "[AddKeys](#cfn-logs-transformer-processor-addkeys)" : AddKeys,
  "[CopyValue](#cfn-logs-transformer-processor-copyvalue)" : CopyValue,
  "[Csv](#cfn-logs-transformer-processor-csv)" : Csv,
  "[DateTimeConverter](#cfn-logs-transformer-processor-datetimeconverter)" : DateTimeConverter,
  "[DeleteKeys](#cfn-logs-transformer-processor-deletekeys)" : DeleteKeys,
  "[Grok](#cfn-logs-transformer-processor-grok)" : Grok,
  "[ListToMap](#cfn-logs-transformer-processor-listtomap)" : ListToMap,
  "[LowerCaseString](#cfn-logs-transformer-processor-lowercasestring)" : LowerCaseString,
  "[MoveKeys](#cfn-logs-transformer-processor-movekeys)" : MoveKeys,
  "[ParseCloudfront](#cfn-logs-transformer-processor-parsecloudfront)" : ParseCloudfront,
  "[ParseJSON](#cfn-logs-transformer-processor-parsejson)" : ParseJSON,
  "[ParseKeyValue](#cfn-logs-transformer-processor-parsekeyvalue)" : ParseKeyValue,
  "[ParsePostgres](#cfn-logs-transformer-processor-parsepostgres)" : ParsePostgres,
  "[ParseRoute53](#cfn-logs-transformer-processor-parseroute53)" : ParseRoute53,
  "[ParseToOCSF](#cfn-logs-transformer-processor-parsetoocsf)" : ParseToOCSF,
  "[ParseVPC](#cfn-logs-transformer-processor-parsevpc)" : ParseVPC,
  "[ParseWAF](#cfn-logs-transformer-processor-parsewaf)" : ParseWAF,
  "[RenameKeys](#cfn-logs-transformer-processor-renamekeys)" : RenameKeys,
  "[SplitString](#cfn-logs-transformer-processor-splitstring)" : SplitString,
  "[SubstituteString](#cfn-logs-transformer-processor-substitutestring)" : SubstituteString,
  "[TrimString](#cfn-logs-transformer-processor-trimstring)" : TrimString,
  "[TypeConverter](#cfn-logs-transformer-processor-typeconverter)" : TypeConverter,
  "[UpperCaseString](#cfn-logs-transformer-processor-uppercasestring)" : UpperCaseString
}
```

### YAML
<a name="aws-properties-logs-transformer-processor-syntax.yaml"></a>

```
  [AddKeys](#cfn-logs-transformer-processor-addkeys): 
    AddKeys
  [CopyValue](#cfn-logs-transformer-processor-copyvalue): 
    CopyValue
  [Csv](#cfn-logs-transformer-processor-csv): 
    Csv
  [DateTimeConverter](#cfn-logs-transformer-processor-datetimeconverter): 
    DateTimeConverter
  [DeleteKeys](#cfn-logs-transformer-processor-deletekeys): 
    DeleteKeys
  [Grok](#cfn-logs-transformer-processor-grok): 
    Grok
  [ListToMap](#cfn-logs-transformer-processor-listtomap): 
    ListToMap
  [LowerCaseString](#cfn-logs-transformer-processor-lowercasestring): 
    LowerCaseString
  [MoveKeys](#cfn-logs-transformer-processor-movekeys): 
    MoveKeys
  [ParseCloudfront](#cfn-logs-transformer-processor-parsecloudfront): 
    ParseCloudfront
  [ParseJSON](#cfn-logs-transformer-processor-parsejson): 
    ParseJSON
  [ParseKeyValue](#cfn-logs-transformer-processor-parsekeyvalue): 
    ParseKeyValue
  [ParsePostgres](#cfn-logs-transformer-processor-parsepostgres): 
    ParsePostgres
  [ParseRoute53](#cfn-logs-transformer-processor-parseroute53): 
    ParseRoute53
  [ParseToOCSF](#cfn-logs-transformer-processor-parsetoocsf): 
    ParseToOCSF
  [ParseVPC](#cfn-logs-transformer-processor-parsevpc): 
    ParseVPC
  [ParseWAF](#cfn-logs-transformer-processor-parsewaf): 
    ParseWAF
  [RenameKeys](#cfn-logs-transformer-processor-renamekeys): 
    RenameKeys
  [SplitString](#cfn-logs-transformer-processor-splitstring): 
    SplitString
  [SubstituteString](#cfn-logs-transformer-processor-substitutestring): 
    SubstituteString
  [TrimString](#cfn-logs-transformer-processor-trimstring): 
    TrimString
  [TypeConverter](#cfn-logs-transformer-processor-typeconverter): 
    TypeConverter
  [UpperCaseString](#cfn-logs-transformer-processor-uppercasestring): 
    UpperCaseString
```

## Properties
<a name="aws-properties-logs-transformer-processor-properties"></a>

`AddKeys`  <a name="cfn-logs-transformer-processor-addkeys"></a>
Use this parameter to include the [ addKeys](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-addKeys) processor in your transformer.  
*Required*: No  
*Type*: [AddKeys](aws-properties-logs-transformer-addkeys.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`CopyValue`  <a name="cfn-logs-transformer-processor-copyvalue"></a>
Use this parameter to include the [ copyValue](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-copyValue) processor in your transformer.  
*Required*: No  
*Type*: [CopyValue](aws-properties-logs-transformer-copyvalue.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Csv`  <a name="cfn-logs-transformer-processor-csv"></a>
Use this parameter to include the [ CSV](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-CSV) processor in your transformer.  
*Required*: No  
*Type*: [Csv](aws-properties-logs-transformer-csv.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`DateTimeConverter`  <a name="cfn-logs-transformer-processor-datetimeconverter"></a>
Use this parameter to include the [ datetimeConverter](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-datetimeConverter) processor in your transformer.  
*Required*: No  
*Type*: [DateTimeConverter](aws-properties-logs-transformer-datetimeconverter.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`DeleteKeys`  <a name="cfn-logs-transformer-processor-deletekeys"></a>
Use this parameter to include the [ deleteKeys](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-deleteKeys) processor in your transformer.  
*Required*: No  
*Type*: [DeleteKeys](aws-properties-logs-transformer-deletekeys.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Grok`  <a name="cfn-logs-transformer-processor-grok"></a>
Use this parameter to include the [ grok](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-grok) processor in your transformer.  
*Required*: No  
*Type*: [Grok](aws-properties-logs-transformer-grok.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ListToMap`  <a name="cfn-logs-transformer-processor-listtomap"></a>
Use this parameter to include the [ listToMap](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-listToMap) processor in your transformer.  
*Required*: No  
*Type*: [ListToMap](aws-properties-logs-transformer-listtomap.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`LowerCaseString`  <a name="cfn-logs-transformer-processor-lowercasestring"></a>
Use this parameter to include the [ lowerCaseString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-lowerCaseString) processor in your transformer.  
*Required*: No  
*Type*: [LowerCaseString](aws-properties-logs-transformer-lowercasestring.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`MoveKeys`  <a name="cfn-logs-transformer-processor-movekeys"></a>
Use this parameter to include the [ moveKeys](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-moveKeys) processor in your transformer.  
*Required*: No  
*Type*: [MoveKeys](aws-properties-logs-transformer-movekeys.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ParseCloudfront`  <a name="cfn-logs-transformer-processor-parsecloudfront"></a>
Use this parameter to include the [ parseCloudfront](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-parseCloudfront) processor in your transformer.  
If you use this processor, it must be the first processor in your transformer.  
*Required*: No  
*Type*: [ParseCloudfront](aws-properties-logs-transformer-parsecloudfront.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ParseJSON`  <a name="cfn-logs-transformer-processor-parsejson"></a>
Use this parameter to include the [ parseJSON](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-parseJSON) processor in your transformer.  
*Required*: No  
*Type*: [ParseJSON](aws-properties-logs-transformer-parsejson.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ParseKeyValue`  <a name="cfn-logs-transformer-processor-parsekeyvalue"></a>
Use this parameter to include the [ parseKeyValue](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-parseKeyValue) processor in your transformer.  
*Required*: No  
*Type*: [ParseKeyValue](aws-properties-logs-transformer-parsekeyvalue.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ParsePostgres`  <a name="cfn-logs-transformer-processor-parsepostgres"></a>
Use this parameter to include the [ parsePostGres](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parsePostGres) processor in your transformer.  
If you use this processor, it must be the first processor in your transformer.  
*Required*: No  
*Type*: [ParsePostgres](aws-properties-logs-transformer-parsepostgres.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ParseRoute53`  <a name="cfn-logs-transformer-processor-parseroute53"></a>
Use this parameter to include the [ parseRoute53](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-parseRoute53) processor in your transformer.  
If you use this processor, it must be the first processor in your transformer.  
*Required*: No  
*Type*: [ParseRoute53](aws-properties-logs-transformer-parseroute53.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ParseToOCSF`  <a name="cfn-logs-transformer-processor-parsetoocsf"></a>
Use this parameter to convert logs into Open Cybersecurity Schema (OCSF) format.  
*Required*: No  
*Type*: [ParseToOCSF](aws-properties-logs-transformer-parsetoocsf.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ParseVPC`  <a name="cfn-logs-transformer-processor-parsevpc"></a>
Use this parameter to include the [ parseVPC](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-parseVPC) processor in your transformer.  
If you use this processor, it must be the first processor in your transformer.  
*Required*: No  
*Type*: [ParseVPC](aws-properties-logs-transformer-parsevpc.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ParseWAF`  <a name="cfn-logs-transformer-processor-parsewaf"></a>
Use this parameter to include the [ parseWAF](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parseWAF) processor in your transformer.  
If you use this processor, it must be the first processor in your transformer.  
*Required*: No  
*Type*: [ParseWAF](aws-properties-logs-transformer-parsewaf.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`RenameKeys`  <a name="cfn-logs-transformer-processor-renamekeys"></a>
Use this parameter to include the [ renameKeys](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-renameKeys) processor in your transformer.  
*Required*: No  
*Type*: [RenameKeys](aws-properties-logs-transformer-renamekeys.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`SplitString`  <a name="cfn-logs-transformer-processor-splitstring"></a>
Use this parameter to include the [ splitString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-splitString) processor in your transformer.  
*Required*: No  
*Type*: [SplitString](aws-properties-logs-transformer-splitstring.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`SubstituteString`  <a name="cfn-logs-transformer-processor-substitutestring"></a>
Use this parameter to include the [ substituteString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-substituteString) processor in your transformer.  
*Required*: No  
*Type*: [SubstituteString](aws-properties-logs-transformer-substitutestring.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`TrimString`  <a name="cfn-logs-transformer-processor-trimstring"></a>
Use this parameter to include the [ trimString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-trimString) processor in your transformer.  
*Required*: No  
*Type*: [TrimString](aws-properties-logs-transformer-trimstring.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`TypeConverter`  <a name="cfn-logs-transformer-processor-typeconverter"></a>
Use this parameter to include the [ typeConverter](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-typeConverter) processor in your transformer.  
*Required*: No  
*Type*: [TypeConverter](aws-properties-logs-transformer-typeconverter.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`UpperCaseString`  <a name="cfn-logs-transformer-processor-uppercasestring"></a>
Use this parameter to include the [ upperCaseString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-upperCaseString) processor in your transformer.  
*Required*: No  
*Type*: [UpperCaseString](aws-properties-logs-transformer-uppercasestring.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer RenameKeyEntry
<a name="aws-properties-logs-transformer-renamekeyentry"></a>

This object defines one key that will be renamed with the [ renameKey](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-renameKey) processor.

## Syntax
<a name="aws-properties-logs-transformer-renamekeyentry-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-renamekeyentry-syntax.json"></a>

```
{
  "[Key](#cfn-logs-transformer-renamekeyentry-key)" : String,
  "[OverwriteIfExists](#cfn-logs-transformer-renamekeyentry-overwriteifexists)" : Boolean,
  "[RenameTo](#cfn-logs-transformer-renamekeyentry-renameto)" : String
}
```

### YAML
<a name="aws-properties-logs-transformer-renamekeyentry-syntax.yaml"></a>

```
  [Key](#cfn-logs-transformer-renamekeyentry-key): String
  [OverwriteIfExists](#cfn-logs-transformer-renamekeyentry-overwriteifexists): Boolean
  [RenameTo](#cfn-logs-transformer-renamekeyentry-renameto): String
```

## Properties
<a name="aws-properties-logs-transformer-renamekeyentry-properties"></a>

`Key`  <a name="cfn-logs-transformer-renamekeyentry-key"></a>
The key to rename  
*Required*: Yes  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`OverwriteIfExists`  <a name="cfn-logs-transformer-renamekeyentry-overwriteifexists"></a>
Specifies whether to overwrite the existing value if the destination key already exists. The default is `false`  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`RenameTo`  <a name="cfn-logs-transformer-renamekeyentry-renameto"></a>
The string to use for the new key name  
*Required*: Yes  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer RenameKeys
<a name="aws-properties-logs-transformer-renamekeys"></a>

Use this processor to rename keys in a log event.

For more information about this processor including examples, see [ renameKeys](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-renameKeys) in the *CloudWatch Logs User Guide*.

## Syntax
<a name="aws-properties-logs-transformer-renamekeys-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-renamekeys-syntax.json"></a>

```
{
  "[Entries](#cfn-logs-transformer-renamekeys-entries)" : [ RenameKeyEntry, ... ]
}
```

### YAML
<a name="aws-properties-logs-transformer-renamekeys-syntax.yaml"></a>

```
  [Entries](#cfn-logs-transformer-renamekeys-entries): 
    - RenameKeyEntry
```

## Properties
<a name="aws-properties-logs-transformer-renamekeys-properties"></a>

`Entries`  <a name="cfn-logs-transformer-renamekeys-entries"></a>
An array of `RenameKeyEntry` objects, where each object contains the information about a single key to rename.   
*Required*: Yes  
*Type*: Array of [RenameKeyEntry](aws-properties-logs-transformer-renamekeyentry.md)  
*Minimum*: `1`  
*Maximum*: `5`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer SplitString
<a name="aws-properties-logs-transformer-splitstring"></a>

Use this processor to split a field into an array of strings using a delimiting character.

For more information about this processor including examples, see [ splitString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-splitString) in the *CloudWatch Logs User Guide*.

## Syntax
<a name="aws-properties-logs-transformer-splitstring-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-splitstring-syntax.json"></a>

```
{
  "[Entries](#cfn-logs-transformer-splitstring-entries)" : [ SplitStringEntry, ... ]
}
```

### YAML
<a name="aws-properties-logs-transformer-splitstring-syntax.yaml"></a>

```
  [Entries](#cfn-logs-transformer-splitstring-entries): 
    - SplitStringEntry
```

## Properties
<a name="aws-properties-logs-transformer-splitstring-properties"></a>

`Entries`  <a name="cfn-logs-transformer-splitstring-entries"></a>
An array of `SplitStringEntry` objects, where each object contains the information about one field to split.   
*Required*: Yes  
*Type*: Array of [SplitStringEntry](aws-properties-logs-transformer-splitstringentry.md)  
*Minimum*: `1`  
*Maximum*: `10`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer SplitStringEntry
<a name="aws-properties-logs-transformer-splitstringentry"></a>

This object defines one log field that will be split with the [ splitString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-splitString) processor.

## Syntax
<a name="aws-properties-logs-transformer-splitstringentry-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-splitstringentry-syntax.json"></a>

```
{
  "[Delimiter](#cfn-logs-transformer-splitstringentry-delimiter)" : String,
  "[Source](#cfn-logs-transformer-splitstringentry-source)" : String
}
```

### YAML
<a name="aws-properties-logs-transformer-splitstringentry-syntax.yaml"></a>

```
  [Delimiter](#cfn-logs-transformer-splitstringentry-delimiter): String
  [Source](#cfn-logs-transformer-splitstringentry-source): String
```

## Properties
<a name="aws-properties-logs-transformer-splitstringentry-properties"></a>

`Delimiter`  <a name="cfn-logs-transformer-splitstringentry-delimiter"></a>
The separator characters to split the string entry on.  
*Required*: Yes  
*Type*: String  
*Maximum*: `128`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Source`  <a name="cfn-logs-transformer-splitstringentry-source"></a>
The key of the field to split.  
*Required*: Yes  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer SubstituteString
<a name="aws-properties-logs-transformer-substitutestring"></a>

This processor matches a key’s value against a regular expression and replaces all matches with a replacement string.

For more information about this processor including examples, see [ substituteString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-substituteString) in the *CloudWatch Logs User Guide*.

## Syntax
<a name="aws-properties-logs-transformer-substitutestring-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-substitutestring-syntax.json"></a>

```
{
  "[Entries](#cfn-logs-transformer-substitutestring-entries)" : [ SubstituteStringEntry, ... ]
}
```

### YAML
<a name="aws-properties-logs-transformer-substitutestring-syntax.yaml"></a>

```
  [Entries](#cfn-logs-transformer-substitutestring-entries): 
    - SubstituteStringEntry
```

## Properties
<a name="aws-properties-logs-transformer-substitutestring-properties"></a>

`Entries`  <a name="cfn-logs-transformer-substitutestring-entries"></a>
An array of objects, where each object contains the information about one key to match and replace.   
*Required*: Yes  
*Type*: Array of [SubstituteStringEntry](aws-properties-logs-transformer-substitutestringentry.md)  
*Minimum*: `1`  
*Maximum*: `10`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer SubstituteStringEntry
<a name="aws-properties-logs-transformer-substitutestringentry"></a>

This object defines one log field key that will be replaced using the [ substituteString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-substituteString) processor.

## Syntax
<a name="aws-properties-logs-transformer-substitutestringentry-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-substitutestringentry-syntax.json"></a>

```
{
  "[From](#cfn-logs-transformer-substitutestringentry-from)" : String,
  "[Source](#cfn-logs-transformer-substitutestringentry-source)" : String,
  "[To](#cfn-logs-transformer-substitutestringentry-to)" : String
}
```

### YAML
<a name="aws-properties-logs-transformer-substitutestringentry-syntax.yaml"></a>

```
  [From](#cfn-logs-transformer-substitutestringentry-from): String
  [Source](#cfn-logs-transformer-substitutestringentry-source): String
  [To](#cfn-logs-transformer-substitutestringentry-to): String
```

## Properties
<a name="aws-properties-logs-transformer-substitutestringentry-properties"></a>

`From`  <a name="cfn-logs-transformer-substitutestringentry-from"></a>
The regular expression string to be replaced. Special regex characters such as [ and ] must be escaped using \$1\$1 when using double quotes and with \$1 when using single quotes. For more information, see [ Class Pattern](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/regex/Pattern.html) on the Oracle web site.  
*Required*: Yes  
*Type*: String  
*Maximum*: `128`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Source`  <a name="cfn-logs-transformer-substitutestringentry-source"></a>
The key to modify  
*Required*: Yes  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`To`  <a name="cfn-logs-transformer-substitutestringentry-to"></a>
The string to be substituted for each match of `from`  
*Required*: Yes  
*Type*: String  
*Maximum*: `128`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer TrimString
<a name="aws-properties-logs-transformer-trimstring"></a>

Use this processor to remove leading and trailing whitespace.

For more information about this processor including examples, see [ trimString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-trimString) in the *CloudWatch Logs User Guide*.

## Syntax
<a name="aws-properties-logs-transformer-trimstring-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-trimstring-syntax.json"></a>

```
{
  "[WithKeys](#cfn-logs-transformer-trimstring-withkeys)" : [ String, ... ]
}
```

### YAML
<a name="aws-properties-logs-transformer-trimstring-syntax.yaml"></a>

```
  [WithKeys](#cfn-logs-transformer-trimstring-withkeys): 
    - String
```

## Properties
<a name="aws-properties-logs-transformer-trimstring-properties"></a>

`WithKeys`  <a name="cfn-logs-transformer-trimstring-withkeys"></a>
The array containing the keys of the fields to trim.  
*Required*: Yes  
*Type*: Array of String  
*Minimum*: `1`  
*Maximum*: `10`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer TypeConverter
<a name="aws-properties-logs-transformer-typeconverter"></a>

Use this processor to convert a value type associated with the specified key to the specified type. It's a casting processor that changes the types of the specified fields. Values can be converted into one of the following datatypes: `integer`, `double`, `string` and `boolean`. 

For more information about this processor including examples, see [ trimString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-trimString) in the *CloudWatch Logs User Guide*.

## Syntax
<a name="aws-properties-logs-transformer-typeconverter-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-typeconverter-syntax.json"></a>

```
{
  "[Entries](#cfn-logs-transformer-typeconverter-entries)" : [ TypeConverterEntry, ... ]
}
```

### YAML
<a name="aws-properties-logs-transformer-typeconverter-syntax.yaml"></a>

```
  [Entries](#cfn-logs-transformer-typeconverter-entries): 
    - TypeConverterEntry
```

## Properties
<a name="aws-properties-logs-transformer-typeconverter-properties"></a>

`Entries`  <a name="cfn-logs-transformer-typeconverter-entries"></a>
An array of `TypeConverterEntry` objects, where each object contains the information about one field to change the type of.   
*Required*: Yes  
*Type*: Array of [TypeConverterEntry](aws-properties-logs-transformer-typeconverterentry.md)  
*Minimum*: `1`  
*Maximum*: `5`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer TypeConverterEntry
<a name="aws-properties-logs-transformer-typeconverterentry"></a>

This object defines one value type that will be converted using the [ typeConverter](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-typeConverter) processor.

## Syntax
<a name="aws-properties-logs-transformer-typeconverterentry-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-typeconverterentry-syntax.json"></a>

```
{
  "[Key](#cfn-logs-transformer-typeconverterentry-key)" : String,
  "[Type](#cfn-logs-transformer-typeconverterentry-type)" : String
}
```

### YAML
<a name="aws-properties-logs-transformer-typeconverterentry-syntax.yaml"></a>

```
  [Key](#cfn-logs-transformer-typeconverterentry-key): String
  [Type](#cfn-logs-transformer-typeconverterentry-type): String
```

## Properties
<a name="aws-properties-logs-transformer-typeconverterentry-properties"></a>

`Key`  <a name="cfn-logs-transformer-typeconverterentry-key"></a>
The key with the value that is to be converted to a different type.  
*Required*: Yes  
*Type*: String  
*Pattern*: `^.*[a-zA-Z0-9]+.*$`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Type`  <a name="cfn-logs-transformer-typeconverterentry-type"></a>
The type to convert the field value to. Valid values are `integer`, `double`, `string` and `boolean`.  
*Required*: Yes  
*Type*: String  
*Allowed values*: `boolean | integer | double | string`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::Logs::Transformer UpperCaseString
<a name="aws-properties-logs-transformer-uppercasestring"></a>

This processor converts a string field to uppercase.

For more information about this processor including examples, see [ upperCaseString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-upperCaseString) in the *CloudWatch Logs User Guide*.

## Syntax
<a name="aws-properties-logs-transformer-uppercasestring-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-uppercasestring-syntax.json"></a>

```
{
  "[WithKeys](#cfn-logs-transformer-uppercasestring-withkeys)" : [ String, ... ]
}
```

### YAML
<a name="aws-properties-logs-transformer-uppercasestring-syntax.yaml"></a>

```
  [WithKeys](#cfn-logs-transformer-uppercasestring-withkeys): 
    - String
```

## Properties
<a name="aws-properties-logs-transformer-uppercasestring-properties"></a>

`WithKeys`  <a name="cfn-logs-transformer-uppercasestring-withkeys"></a>
The array of containing the keys of the field to convert to uppercase.  
*Required*: Yes  
*Type*: Array of String  
*Minimum*: `1`  
*Maximum*: `10`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)