This is the new *CloudFormation Template Reference Guide*. Please update your bookmarks and links. For help getting started with CloudFormation, see the [AWS CloudFormation User Guide](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html).

# AWS::Logs::Transformer Processor
<a name="aws-properties-logs-transformer-processor"></a>

This structure contains the information about one processor in a log transformer.

## Syntax
<a name="aws-properties-logs-transformer-processor-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-transformer-processor-syntax.json"></a>

```
{
  "[AddKeys](#cfn-logs-transformer-processor-addkeys)" : AddKeys,
  "[CopyValue](#cfn-logs-transformer-processor-copyvalue)" : CopyValue,
  "[Csv](#cfn-logs-transformer-processor-csv)" : Csv,
  "[DateTimeConverter](#cfn-logs-transformer-processor-datetimeconverter)" : DateTimeConverter,
  "[DeleteKeys](#cfn-logs-transformer-processor-deletekeys)" : DeleteKeys,
  "[Grok](#cfn-logs-transformer-processor-grok)" : Grok,
  "[ListToMap](#cfn-logs-transformer-processor-listtomap)" : ListToMap,
  "[LowerCaseString](#cfn-logs-transformer-processor-lowercasestring)" : LowerCaseString,
  "[MoveKeys](#cfn-logs-transformer-processor-movekeys)" : MoveKeys,
  "[ParseCloudfront](#cfn-logs-transformer-processor-parsecloudfront)" : ParseCloudfront,
  "[ParseJSON](#cfn-logs-transformer-processor-parsejson)" : ParseJSON,
  "[ParseKeyValue](#cfn-logs-transformer-processor-parsekeyvalue)" : ParseKeyValue,
  "[ParsePostgres](#cfn-logs-transformer-processor-parsepostgres)" : ParsePostgres,
  "[ParseRoute53](#cfn-logs-transformer-processor-parseroute53)" : ParseRoute53,
  "[ParseToOCSF](#cfn-logs-transformer-processor-parsetoocsf)" : ParseToOCSF,
  "[ParseVPC](#cfn-logs-transformer-processor-parsevpc)" : ParseVPC,
  "[ParseWAF](#cfn-logs-transformer-processor-parsewaf)" : ParseWAF,
  "[RenameKeys](#cfn-logs-transformer-processor-renamekeys)" : RenameKeys,
  "[SplitString](#cfn-logs-transformer-processor-splitstring)" : SplitString,
  "[SubstituteString](#cfn-logs-transformer-processor-substitutestring)" : SubstituteString,
  "[TrimString](#cfn-logs-transformer-processor-trimstring)" : TrimString,
  "[TypeConverter](#cfn-logs-transformer-processor-typeconverter)" : TypeConverter,
  "[UpperCaseString](#cfn-logs-transformer-processor-uppercasestring)" : UpperCaseString
}
```

### YAML
<a name="aws-properties-logs-transformer-processor-syntax.yaml"></a>

```
  [AddKeys](#cfn-logs-transformer-processor-addkeys): 
    AddKeys
  [CopyValue](#cfn-logs-transformer-processor-copyvalue): 
    CopyValue
  [Csv](#cfn-logs-transformer-processor-csv): 
    Csv
  [DateTimeConverter](#cfn-logs-transformer-processor-datetimeconverter): 
    DateTimeConverter
  [DeleteKeys](#cfn-logs-transformer-processor-deletekeys): 
    DeleteKeys
  [Grok](#cfn-logs-transformer-processor-grok): 
    Grok
  [ListToMap](#cfn-logs-transformer-processor-listtomap): 
    ListToMap
  [LowerCaseString](#cfn-logs-transformer-processor-lowercasestring): 
    LowerCaseString
  [MoveKeys](#cfn-logs-transformer-processor-movekeys): 
    MoveKeys
  [ParseCloudfront](#cfn-logs-transformer-processor-parsecloudfront): 
    ParseCloudfront
  [ParseJSON](#cfn-logs-transformer-processor-parsejson): 
    ParseJSON
  [ParseKeyValue](#cfn-logs-transformer-processor-parsekeyvalue): 
    ParseKeyValue
  [ParsePostgres](#cfn-logs-transformer-processor-parsepostgres): 
    ParsePostgres
  [ParseRoute53](#cfn-logs-transformer-processor-parseroute53): 
    ParseRoute53
  [ParseToOCSF](#cfn-logs-transformer-processor-parsetoocsf): 
    ParseToOCSF
  [ParseVPC](#cfn-logs-transformer-processor-parsevpc): 
    ParseVPC
  [ParseWAF](#cfn-logs-transformer-processor-parsewaf): 
    ParseWAF
  [RenameKeys](#cfn-logs-transformer-processor-renamekeys): 
    RenameKeys
  [SplitString](#cfn-logs-transformer-processor-splitstring): 
    SplitString
  [SubstituteString](#cfn-logs-transformer-processor-substitutestring): 
    SubstituteString
  [TrimString](#cfn-logs-transformer-processor-trimstring): 
    TrimString
  [TypeConverter](#cfn-logs-transformer-processor-typeconverter): 
    TypeConverter
  [UpperCaseString](#cfn-logs-transformer-processor-uppercasestring): 
    UpperCaseString
```

## Properties
<a name="aws-properties-logs-transformer-processor-properties"></a>

`AddKeys`  <a name="cfn-logs-transformer-processor-addkeys"></a>
Use this parameter to include the [ addKeys](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-addKeys) processor in your transformer.  
*Required*: No  
*Type*: [AddKeys](aws-properties-logs-transformer-addkeys.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`CopyValue`  <a name="cfn-logs-transformer-processor-copyvalue"></a>
Use this parameter to include the [ copyValue](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-copyValue) processor in your transformer.  
*Required*: No  
*Type*: [CopyValue](aws-properties-logs-transformer-copyvalue.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Csv`  <a name="cfn-logs-transformer-processor-csv"></a>
Use this parameter to include the [ CSV](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-CSV) processor in your transformer.  
*Required*: No  
*Type*: [Csv](aws-properties-logs-transformer-csv.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`DateTimeConverter`  <a name="cfn-logs-transformer-processor-datetimeconverter"></a>
Use this parameter to include the [ datetimeConverter](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-datetimeConverter) processor in your transformer.  
*Required*: No  
*Type*: [DateTimeConverter](aws-properties-logs-transformer-datetimeconverter.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`DeleteKeys`  <a name="cfn-logs-transformer-processor-deletekeys"></a>
Use this parameter to include the [ deleteKeys](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-deleteKeys) processor in your transformer.  
*Required*: No  
*Type*: [DeleteKeys](aws-properties-logs-transformer-deletekeys.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Grok`  <a name="cfn-logs-transformer-processor-grok"></a>
Use this parameter to include the [ grok](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-grok) processor in your transformer.  
*Required*: No  
*Type*: [Grok](aws-properties-logs-transformer-grok.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ListToMap`  <a name="cfn-logs-transformer-processor-listtomap"></a>
Use this parameter to include the [ listToMap](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-listToMap) processor in your transformer.  
*Required*: No  
*Type*: [ListToMap](aws-properties-logs-transformer-listtomap.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`LowerCaseString`  <a name="cfn-logs-transformer-processor-lowercasestring"></a>
Use this parameter to include the [ lowerCaseString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-lowerCaseString) processor in your transformer.  
*Required*: No  
*Type*: [LowerCaseString](aws-properties-logs-transformer-lowercasestring.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`MoveKeys`  <a name="cfn-logs-transformer-processor-movekeys"></a>
Use this parameter to include the [ moveKeys](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-moveKeys) processor in your transformer.  
*Required*: No  
*Type*: [MoveKeys](aws-properties-logs-transformer-movekeys.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ParseCloudfront`  <a name="cfn-logs-transformer-processor-parsecloudfront"></a>
Use this parameter to include the [ parseCloudfront](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-parseCloudfront) processor in your transformer.  
If you use this processor, it must be the first processor in your transformer.  
*Required*: No  
*Type*: [ParseCloudfront](aws-properties-logs-transformer-parsecloudfront.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ParseJSON`  <a name="cfn-logs-transformer-processor-parsejson"></a>
Use this parameter to include the [ parseJSON](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-parseJSON) processor in your transformer.  
*Required*: No  
*Type*: [ParseJSON](aws-properties-logs-transformer-parsejson.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ParseKeyValue`  <a name="cfn-logs-transformer-processor-parsekeyvalue"></a>
Use this parameter to include the [ parseKeyValue](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-parseKeyValue) processor in your transformer.  
*Required*: No  
*Type*: [ParseKeyValue](aws-properties-logs-transformer-parsekeyvalue.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ParsePostgres`  <a name="cfn-logs-transformer-processor-parsepostgres"></a>
Use this parameter to include the [ parsePostGres](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parsePostGres) processor in your transformer.  
If you use this processor, it must be the first processor in your transformer.  
*Required*: No  
*Type*: [ParsePostgres](aws-properties-logs-transformer-parsepostgres.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ParseRoute53`  <a name="cfn-logs-transformer-processor-parseroute53"></a>
Use this parameter to include the [ parseRoute53](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-parseRoute53) processor in your transformer.  
If you use this processor, it must be the first processor in your transformer.  
*Required*: No  
*Type*: [ParseRoute53](aws-properties-logs-transformer-parseroute53.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ParseToOCSF`  <a name="cfn-logs-transformer-processor-parsetoocsf"></a>
Use this parameter to convert logs into Open Cybersecurity Schema (OCSF) format.  
*Required*: No  
*Type*: [ParseToOCSF](aws-properties-logs-transformer-parsetoocsf.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ParseVPC`  <a name="cfn-logs-transformer-processor-parsevpc"></a>
Use this parameter to include the [ parseVPC](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-parseVPC) processor in your transformer.  
If you use this processor, it must be the first processor in your transformer.  
*Required*: No  
*Type*: [ParseVPC](aws-properties-logs-transformer-parsevpc.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ParseWAF`  <a name="cfn-logs-transformer-processor-parsewaf"></a>
Use this parameter to include the [ parseWAF](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parseWAF) processor in your transformer.  
If you use this processor, it must be the first processor in your transformer.  
*Required*: No  
*Type*: [ParseWAF](aws-properties-logs-transformer-parsewaf.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`RenameKeys`  <a name="cfn-logs-transformer-processor-renamekeys"></a>
Use this parameter to include the [ renameKeys](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-renameKeys) processor in your transformer.  
*Required*: No  
*Type*: [RenameKeys](aws-properties-logs-transformer-renamekeys.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`SplitString`  <a name="cfn-logs-transformer-processor-splitstring"></a>
Use this parameter to include the [ splitString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-splitString) processor in your transformer.  
*Required*: No  
*Type*: [SplitString](aws-properties-logs-transformer-splitstring.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`SubstituteString`  <a name="cfn-logs-transformer-processor-substitutestring"></a>
Use this parameter to include the [ substituteString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-substituteString) processor in your transformer.  
*Required*: No  
*Type*: [SubstituteString](aws-properties-logs-transformer-substitutestring.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`TrimString`  <a name="cfn-logs-transformer-processor-trimstring"></a>
Use this parameter to include the [ trimString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-trimString) processor in your transformer.  
*Required*: No  
*Type*: [TrimString](aws-properties-logs-transformer-trimstring.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`TypeConverter`  <a name="cfn-logs-transformer-processor-typeconverter"></a>
Use this parameter to include the [ typeConverter](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-typeConverter) processor in your transformer.  
*Required*: No  
*Type*: [TypeConverter](aws-properties-logs-transformer-typeconverter.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`UpperCaseString`  <a name="cfn-logs-transformer-processor-uppercasestring"></a>
Use this parameter to include the [ upperCaseString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-upperCaseString) processor in your transformer.  
*Required*: No  
*Type*: [UpperCaseString](aws-properties-logs-transformer-uppercasestring.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)