ParserProcessorProps

class aws_cdk.aws_logs.ParserProcessorProps(*, type, csv_options=None, grok_options=None, json_options=None, key_value_options=None, parse_to_ocsf_options=None)

Bases: BaseProcessorProps

Properties for creating configurable parser processors.

Parameters:

• type (ParserProcessorType) – The type of parser processor.

• csv_options (Union[CsvProperty, Dict[str, Any], None]) – Options for CSV parser. Required when type is CSV. Default: - No CSV parser is created if props not set

• grok_options (Union[GrokProperty, Dict[str, Any], None]) – Options for Grok parser. Required when type is GROK. Default: - No Grok parser is created if props not set

• json_options (Union[ParseJSONProperty, Dict[str, Any], None]) – Options for JSON parser. Required when type is JSON. Default: - No JSON parser is created if props not set

• key_value_options (Union[ParseKeyValueProperty, Dict[str, Any], None]) – Options for key-value parser. Required when type is KEY_VALUE. Default: - No key-value parser is created if props not set

• parse_to_ocsf_options (Union[ParseToOCSFProperty, Dict[str, Any], None]) – Options for ParseToOCSF parser. Required when type is set to OCSF Default: - no OCSF parser is created.

ExampleMetadata:

infused

Example:

# Create a log group
log_group = logs.LogGroup(self, "MyLogGroup")

# Create a JSON parser processor
json_parser = logs.ParserProcessor(
    type=logs.ParserProcessorType.JSON
)

# Create a processor to add keys
add_keys_processor = logs.JsonMutatorProcessor(
    type=logs.JsonMutatorType.ADD_KEYS,
    add_keys_options=logs.AddKeysProperty(
        entries=[logs.AddKeyEntryProperty(
            key="metadata.transformed_in",
            value="CloudWatchLogs"
        )]
    )
)

# Create a transformer with these processors
logs.Transformer(self, "Transformer",
    transformer_name="MyTransformer",
    log_group=log_group,
    transformer_config=[json_parser, add_keys_processor]
)

Attributes

csv_options

Options for CSV parser.

Required when type is CSV.

Default:

• No CSV parser is created if props not set

grok_options

Options for Grok parser.

Required when type is GROK.

Default:

• No Grok parser is created if props not set

json_options

Options for JSON parser.

Required when type is JSON.

Default:

• No JSON parser is created if props not set

key_value_options

Options for key-value parser.

Required when type is KEY_VALUE.

Default:

• No key-value parser is created if props not set

parse_to_ocsf_options

Options for ParseToOCSF parser.

Required when type is set to OCSF

Default:

• no OCSF parser is created.

type

The type of parser processor.