AWS::Logs::Transformer ParseKeyValue - AWS CloudFormation
SyntaxProperties

AWS::Logs::Transformer ParseKeyValue

This processor parses a specified field in the original log event into key-value pairs.

For more information about this processor including examples, see parseKeyValue in the CloudWatch Logs User Guide.

Syntax

To declare this entity in your AWS CloudFormation template, use the following syntax:

JSON

{
  "Destination" : String,
  "FieldDelimiter" : String,
  "KeyPrefix" : String,
  "KeyValueDelimiter" : String,
  "NonMatchValue" : String,
  "OverwriteIfExists" : Boolean,
  "Source" : String
}

YAML

  Destination: String
  FieldDelimiter: String
  KeyPrefix: String
  KeyValueDelimiter: String
  NonMatchValue: String
  OverwriteIfExists: Boolean
  Source: String

Properties

Destination

The destination field to put the extracted key-value pairs into

Required: No

Type: String

Pattern: ^.*[a-zA-Z0-9]+.*$

Update requires: No interruption

FieldDelimiter

The field delimiter string that is used between key-value pairs in the original log events. If you omit this, the ampersand & character is used.

Required: No

Type: String

Minimum: 1

Maximum: 128

Update requires: No interruption

KeyPrefix

If you want to add a prefix to all transformed keys, specify it here.

Required: No

Type: String

Pattern: ^.*[a-zA-Z0-9]+.*$

Update requires: No interruption

KeyValueDelimiter

The delimiter string to use between the key and value in each pair in the transformed log event.

If you omit this, the equal = character is used.

Required: No

Type: String

Minimum: 1

Maximum: 128

Update requires: No interruption

NonMatchValue

A value to insert into the value field in the result, when a key-value pair is not successfully split.

Required: No

Type: String

Pattern: ^.*[a-zA-Z0-9]+.*$

Update requires: No interruption

OverwriteIfExists

Specifies whether to overwrite the value if the destination key already exists. If you omit this, the default is false.

Required: No

Type: Boolean

Update requires: No interruption

Source

Path to the field in the log event that will be parsed. Use dot notation to access child fields. For example, store.book

Required: No

Type: String

Pattern: ^.*[a-zA-Z0-9]+.*$

Update requires: No interruption