This is the new AWS CloudFormation Template Reference Guide. Please update your bookmarks and links. For help getting started with CloudFormation, see the AWS CloudFormation User Guide.
AWS::Logs::Transformer Processor
This structure contains the information about one processor in a log transformer.
Syntax
To declare this entity in your AWS CloudFormation template, use the following syntax:
JSON
{ "AddKeys" :AddKeys, "CopyValue" :CopyValue, "Csv" :Csv, "DateTimeConverter" :DateTimeConverter, "DeleteKeys" :DeleteKeys, "Grok" :Grok, "ListToMap" :ListToMap, "LowerCaseString" :LowerCaseString, "MoveKeys" :MoveKeys, "ParseCloudfront" :ParseCloudfront, "ParseJSON" :ParseJSON, "ParseKeyValue" :ParseKeyValue, "ParsePostgres" :ParsePostgres, "ParseRoute53" :ParseRoute53, "ParseToOCSF" :ParseToOCSF, "ParseVPC" :ParseVPC, "ParseWAF" :ParseWAF, "RenameKeys" :RenameKeys, "SplitString" :SplitString, "SubstituteString" :SubstituteString, "TrimString" :TrimString, "TypeConverter" :TypeConverter, "UpperCaseString" :UpperCaseString}
YAML
AddKeys:AddKeysCopyValue:CopyValueCsv:CsvDateTimeConverter:DateTimeConverterDeleteKeys:DeleteKeysGrok:GrokListToMap:ListToMapLowerCaseString:LowerCaseStringMoveKeys:MoveKeysParseCloudfront:ParseCloudfrontParseJSON:ParseJSONParseKeyValue:ParseKeyValueParsePostgres:ParsePostgresParseRoute53:ParseRoute53ParseToOCSF:ParseToOCSFParseVPC:ParseVPCParseWAF:ParseWAFRenameKeys:RenameKeysSplitString:SplitStringSubstituteString:SubstituteStringTrimString:TrimStringTypeConverter:TypeConverterUpperCaseString:UpperCaseString
Properties
AddKeys-
Use this parameter to include the addKeys processor in your transformer.
Required: No
Type: AddKeys
Update requires: No interruption
CopyValue-
Use this parameter to include the copyValue processor in your transformer.
Required: No
Type: CopyValue
Update requires: No interruption
Csv-
Use this parameter to include the CSV processor in your transformer.
Required: No
Type: Csv
Update requires: No interruption
DateTimeConverter-
Use this parameter to include the datetimeConverter processor in your transformer.
Required: No
Type: DateTimeConverter
Update requires: No interruption
DeleteKeys-
Use this parameter to include the deleteKeys processor in your transformer.
Required: No
Type: DeleteKeys
Update requires: No interruption
Grok-
Use this parameter to include the grok processor in your transformer.
Required: No
Type: Grok
Update requires: No interruption
ListToMap-
Use this parameter to include the listToMap processor in your transformer.
Required: No
Type: ListToMap
Update requires: No interruption
LowerCaseString-
Use this parameter to include the lowerCaseString processor in your transformer.
Required: No
Type: LowerCaseString
Update requires: No interruption
MoveKeys-
Use this parameter to include the moveKeys processor in your transformer.
Required: No
Type: MoveKeys
Update requires: No interruption
ParseCloudfront-
Use this parameter to include the parseCloudfront processor in your transformer.
If you use this processor, it must be the first processor in your transformer.
Required: No
Type: ParseCloudfront
Update requires: No interruption
ParseJSON-
Use this parameter to include the parseJSON processor in your transformer.
Required: No
Type: ParseJSON
Update requires: No interruption
ParseKeyValue-
Use this parameter to include the parseKeyValue processor in your transformer.
Required: No
Type: ParseKeyValue
Update requires: No interruption
ParsePostgres-
Use this parameter to include the parsePostGres processor in your transformer.
If you use this processor, it must be the first processor in your transformer.
Required: No
Type: ParsePostgres
Update requires: No interruption
ParseRoute53-
Use this parameter to include the parseRoute53 processor in your transformer.
If you use this processor, it must be the first processor in your transformer.
Required: No
Type: ParseRoute53
Update requires: No interruption
ParseToOCSF-
Use this parameter to convert logs into Open Cybersecurity Schema (OCSF) format.
Required: No
Type: ParseToOCSF
Update requires: No interruption
ParseVPC-
Use this parameter to include the parseVPC processor in your transformer.
If you use this processor, it must be the first processor in your transformer.
Required: No
Type: ParseVPC
Update requires: No interruption
ParseWAF-
Use this parameter to include the parseWAF processor in your transformer.
If you use this processor, it must be the first processor in your transformer.
Required: No
Type: ParseWAF
Update requires: No interruption
RenameKeys-
Use this parameter to include the renameKeys processor in your transformer.
Required: No
Type: RenameKeys
Update requires: No interruption
SplitString-
Use this parameter to include the splitString processor in your transformer.
Required: No
Type: SplitString
Update requires: No interruption
SubstituteString-
Use this parameter to include the substituteString processor in your transformer.
Required: No
Type: SubstituteString
Update requires: No interruption
TrimString-
Use this parameter to include the trimString processor in your transformer.
Required: No
Type: TrimString
Update requires: No interruption
TypeConverter-
Use this parameter to include the typeConverter processor in your transformer.
Required: No
Type: TypeConverter
Update requires: No interruption
UpperCaseString-
Use this parameter to include the upperCaseString processor in your transformer.
Required: No
Type: UpperCaseString
Update requires: No interruption
