Use this operation to test a log transformer. You enter the transformer configuration and a set of log events to test with. The operation responds with an array that includes the original log events and the transformed versions.
Request Syntax
{
"logEventMessages": [ "string" ],
"transformerConfig": [
{
"addKeys": {
"entries": [
{
"key": "string",
"overwriteIfExists": boolean,
"value": "string"
}
]
},
"copyValue": {
"entries": [
{
"overwriteIfExists": boolean,
"source": "string",
"target": "string"
}
]
},
"csv": {
"columns": [ "string" ],
"delimiter": "string",
"quoteCharacter": "string",
"source": "string"
},
"dateTimeConverter": {
"locale": "string",
"matchPatterns": [ "string" ],
"source": "string",
"sourceTimezone": "string",
"target": "string",
"targetFormat": "string",
"targetTimezone": "string"
},
"deleteKeys": {
"withKeys": [ "string" ]
},
"grok": {
"match": "string",
"source": "string"
},
"listToMap": {
"flatten": boolean,
"flattenedElement": "string",
"key": "string",
"source": "string",
"target": "string",
"valueKey": "string"
},
"lowerCaseString": {
"withKeys": [ "string" ]
},
"moveKeys": {
"entries": [
{
"overwriteIfExists": boolean,
"source": "string",
"target": "string"
}
]
},
"parseCloudfront": {
"source": "string"
},
"parseJSON": {
"destination": "string",
"source": "string"
},
"parseKeyValue": {
"destination": "string",
"fieldDelimiter": "string",
"keyPrefix": "string",
"keyValueDelimiter": "string",
"nonMatchValue": "string",
"overwriteIfExists": boolean,
"source": "string"
},
"parsePostgres": {
"source": "string"
},
"parseRoute53": {
"source": "string"
},
"parseVPC": {
"source": "string"
},
"parseWAF": {
"source": "string"
},
"renameKeys": {
"entries": [
{
"key": "string",
"overwriteIfExists": boolean,
"renameTo": "string"
}
]
},
"splitString": {
"entries": [
{
"delimiter": "string",
"source": "string"
}
]
},
"substituteString": {
"entries": [
{
"from": "string",
"source": "string",
"to": "string"
}
]
},
"trimString": {
"withKeys": [ "string" ]
},
"typeConverter": {
"entries": [
{
"key": "string",
"type": "string"
}
]
},
"upperCaseString": {
"withKeys": [ "string" ]
}
}
]
}Request Parameters
For information about the parameters that are common to all actions, see Common Parameters.
The request accepts the following data in JSON format.
- logEventMessages
-
An array of the raw log events that you want to use to test this transformer.
Type: Array of strings
Array Members: Minimum number of 1 item. Maximum number of 50 items.
Length Constraints: Minimum length of 1.
Required: Yes
- transformerConfig
-
This structure contains the configuration of this log transformer that you want to test. A log transformer is an array of processors, where each processor applies one type of transformation to the log events that are ingested.
Type: Array of Processor objects
Array Members: Minimum number of 1 item. Maximum number of 20 items.
Required: Yes
Response Syntax
{
"transformedLogs": [
{
"eventMessage": "string",
"eventNumber": number,
"transformedEventMessage": "string"
}
]
}Response Elements
If the action is successful, the service sends back an HTTP 200 response.
The following data is returned in JSON format by the service.
- transformedLogs
-
An array where each member of the array includes both the original version and the transformed version of one of the log events that you input.
Type: Array of TransformedLogRecord objects
Errors
For information about the errors that are common to all actions, see Common Errors.
- InvalidOperationException
-
The operation is not valid on the specified resource.
HTTP Status Code: 400
- InvalidParameterException
-
A parameter is specified incorrectly.
HTTP Status Code: 400
- ServiceUnavailableException
-
The service cannot complete the request.
HTTP Status Code: 500
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
