transformers

Creates, updates, deletes or gets a transformer resource or lists transformers in a region

Overview

Name	transformers
Type	Resource
Description	Specifies a transformer on the log group to transform logs into consistent structured and information rich format.
Id	awscc.logs.transformers

Fields

get (all properties)

Name	Datatype	Description
log_group_identifier	string	Existing log group that you want to associate with this transformer.
▶transformer_config	array	List of processors in a transformer
region	string	AWS region.

list (identifiers only)

Name	Datatype	Description
log_group_identifier	string	Existing log group that you want to associate with this transformer.
region	string	AWS region.

For more information, see AWS::Logs::Transformer.

Methods

Name	Resource	Accessible by	Required Params
create_resource	transformers	INSERT	LogGroupIdentifier, TransformerConfig, region
delete_resource	transformers	DELETE	Identifier, region
update_resource	transformers	UPDATE	Identifier, PatchDocument, region
list_resources	transformers_list_only	SELECT	region
get_resource	transformers	SELECT	Identifier, region

SELECT examples

get (all properties)

Gets all properties from an individual transformer.

SELECT
  region,
  log_group_identifier,
  transformer_config
FROM awscc.logs.transformers
WHERE
  region = 'us-east-1' AND
  Identifier = '{{ log_group_identifier }}';

list (identifiers only)

Lists all transformers in a region.

SELECT
  region,
  log_group_identifier
FROM awscc.logs.transformers_list_only
WHERE
  region = 'us-east-1';

INSERT example

Use the following StackQL query and manifest file to create a new transformer resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO awscc.logs.transformers (
  LogGroupIdentifier,
  TransformerConfig,
  region
)
SELECT
  '{{ log_group_identifier }}',
  '{{ transformer_config }}',
  '{{ region }}';

All Properties

/*+ create */
INSERT INTO awscc.logs.transformers (
  LogGroupIdentifier,
  TransformerConfig,
  region
)
SELECT
  '{{ log_group_identifier }}',
  '{{ transformer_config }}',
  '{{ region }}';

Manifest

version: 1
name: stack name
description: stack description
providers:
  - aws
globals:
  - name: region
    value: '{{ vars.AWS_REGION }}'
resources:
  - name: transformer
    props:
      - name: log_group_identifier
        value: '{{ log_group_identifier }}'
      - name: transformer_config
        value:
          - parse_cloudfront:
              source: '{{ source }}'
            parse_vpc:
              source: null
            parse_wa_f:
              source: null
            parse_js_on:
              source: '{{ source }}'
              destination: '{{ destination }}'
            parse_route53:
              source: null
            parse_postgres:
              source: null
            parse_to_oc_sf:
              source: null
              event_source: '{{ event_source }}'
              ocsf_version: '{{ ocsf_version }}'
            parse_key_value:
              source: null
              destination: null
              field_delimiter: '{{ field_delimiter }}'
              key_value_delimiter: '{{ key_value_delimiter }}'
              key_prefix: null
              non_match_value: null
              overwrite_if_exists: '{{ overwrite_if_exists }}'
            copy_value:
              entries:
                - source: null
                  target: null
                  overwrite_if_exists: '{{ overwrite_if_exists }}'
            csv:
              quote_character: '{{ quote_character }}'
              delimiter: '{{ delimiter }}'
              source: '{{ source }}'
              columns:
                - null
            date_time_converter:
              source: null
              target: null
              target_format: '{{ target_format }}'
              match_patterns:
                - null
              source_timezone: '{{ source_timezone }}'
              target_timezone: '{{ target_timezone }}'
              locale: '{{ locale }}'
            delete_keys:
              with_keys:
                - '{{ with_keys[0] }}'
            grok:
              source: null
              match: '{{ match }}'
            list_to_map:
              source: null
              key: null
              value_key: null
              target: null
              flatten: '{{ flatten }}'
              flattened_element: '{{ flattened_element }}'
            add_keys:
              entries:
                - key: null
                  value: '{{ value }}'
                  overwrite_if_exists: '{{ overwrite_if_exists }}'
            move_keys:
              entries:
                - source: null
                  target: null
                  overwrite_if_exists: '{{ overwrite_if_exists }}'
            rename_keys:
              entries:
                - key: null
                  rename_to: null
                  overwrite_if_exists: '{{ overwrite_if_exists }}'
            lower_case_string:
              with_keys:
                - null
            split_string:
              entries:
                - source: null
                  delimiter: '{{ delimiter }}'
            substitute_string:
              entries:
                - source: null
                  from: null
                  to: null
            trim_string:
              with_keys:
                - null
            upper_case_string:
              with_keys:
                - null
            type_converter:
              entries:
                - key: null
                  type: '{{ type }}'

UPDATE example

Use the following StackQL query and manifest file to update a transformer resource, using stack-deploy.

/*+ update */
UPDATE awscc.logs.transformers
SET PatchDocument = string('{{ {
    "TransformerConfig": transformer_config
} | generate_patch_document }}')
WHERE
  region = '{{ region }}' AND
  Identifier = '{{ log_group_identifier }}';

DELETE example

/*+ delete */
DELETE FROM awscc.logs.transformers
WHERE
  Identifier = '{{ log_group_identifier }}' AND
  region = 'us-east-1';

Permissions

To operate on the transformers resource, the following permissions are required:

Create

logs:PutTransformer,
logs:GetTransformer

Read

logs:GetTransformer

Update

logs:GetTransformer,
logs:PutTransformer

Delete

logs:DeleteTransformer

List

logs:DescribeLogGroups,
logs:GetTransformer