Filter, Reshape, and Redact Logs Before Export with Transformers

What Changed

Cloudflare made Transformers generally available inside Logpush, moving log processing directly into the export pipeline S1. Instead of running a separate service to filter, reshape, or redact logs, teams now define a SQL query that Logpush applies to each batch before delivery S1. The query can remove health checks, omit sensitive fields, add provider tags, or nest fields so each destination receives data in the form it needs S1.

What This Means for Business Teams in Egypt, Saudi Arabia, and the UAE

Regional teams that export Cloudflare logs to SIEMs, analytics platforms, or object storage can now reduce downstream data volume and cost by filtering records before they arrive S1. A team collecting logs from multiple CDNs can normalize records with a static provider field, and redact partial IP addresses to support compliance with local data protection rules S1. Because each update creates a new version, teams can review how a Transformer has changed over time and roll back if needed S1.

Practical Checklist

• Identify which log fields are sensitive or unnecessary for your destination.
• Write a SQL WHERE clause to exclude health checks and internal traffic.
• Use SELECT to rename, nest, or add fields matching your schema.
• Redact partial IP addresses with regexp_replace before export.
• Preview the Transformer in the dashboard before attaching it to a job.
• Review version history after each change and document the reason.

Conclusion

Transformers let teams shape logs at the source instead of maintaining extra processing infrastructure. For regional teams handling compliance and cost, this is a practical step toward cleaner, cheaper log pipelines.

Ready to automate your log workflow? Explore our automation services or contact us to discuss a pilot.