Amazon CloudWatch Cloudwatch Transformer API

openapi: 3.1.0
info:
  title: Amazon CloudWatch Transformer API
  version: '2010-08-01'
  description: Generated from AWS's published Smithy model for Amazon CloudWatch. 4 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://logs.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
paths:
  /#DeleteTransformer:
    post:
      operationId: DeleteTransformer
      summary: Delete Transformer
      description: Deletes the log transformer for the specified log group. As soon as you do this, the transformation of
        incoming log events according to that transformer stops. If this account has an account-level transformer that applies
        to this log group, the log group begins using that account-level transformer when this log-group level transformer
        is deleted. After you delete a transformer, be sure to edit any metric filters or subscription filters that relied
        on the transformed versions of the log events.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                type: string
        '400':
          description: InvalidOperationException; InvalidParameterException; OperationAbortedException; ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidOperationException'
        '500':
          description: ServiceUnavailableException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ServiceUnavailableException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - Logs_20140328.DeleteTransformer
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/DeleteTransformerRequest'
      tags:
      - Transformer
  /#GetTransformer:
    post:
      operationId: GetTransformer
      summary: Get Transformer
      description: Returns the information about the log transformer associated with this log group. This operation returns
        data only for transformers created at the log group level. To get information for an account-level transformer, use
        DescribeAccountPolicies.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/GetTransformerResponse'
        '400':
          description: InvalidOperationException; InvalidParameterException; ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidOperationException'
        '500':
          description: ServiceUnavailableException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ServiceUnavailableException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - Logs_20140328.GetTransformer
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/GetTransformerRequest'
      tags:
      - Transformer
  /#PutTransformer:
    post:
      operationId: PutTransformer
      summary: Put Transformer
      description: Creates or updates a log transformer for a single log group. You use log transformers to transform log
        events into a different format, making them easier for you to process and analyze. You can also transform logs from
        different sources into standardized formats that contains relevant, source-specific information. After you have created
        a transformer, CloudWatch Logs performs the transformations at the time of log ingestion. You can then refer to the
        transformed versions of the logs during operations such as querying with CloudWatch Logs Insights or creating metric
        filters or subscription filers. You can also use a transformer to copy metadata from metadata keys into the log events
        themselves. This metadata can include log group name, log stream name, account ID and Region. A transformer for a
        log group is a series of processors, where each processor applies one type of transformation to the log events ingested
        into this log group. The processors work one after another, in the order that you list them, like a pipeline. For
        more information about the available processors to use in a transformer, see Processors that you can use. Having log
        events in standardized format enables visibi
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                type: string
        '400':
          description: InvalidOperationException; InvalidParameterException; LimitExceededException; OperationAbortedException;
            ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidOperationException'
        '500':
          description: ServiceUnavailableException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ServiceUnavailableException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - Logs_20140328.PutTransformer
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/PutTransformerRequest'
      tags:
      - Transformer
  /#TestTransformer:
    post:
      operationId: TestTransformer
      summary: Test Transformer
      description: Use this operation to test a log transformer. You enter the transformer configuration and a set of log
        events to test with. The operation responds with an array that includes the original log events and the transformed
        versions.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/TestTransformerResponse'
        '400':
          description: InvalidOperationException; InvalidParameterException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidOperationException'
        '500':
          description: ServiceUnavailableException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ServiceUnavailableException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - Logs_20140328.TestTransformer
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/TestTransformerRequest'
      tags:
      - Transformer
components:
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical
        request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: logs
  schemas:
    AddKeyEntry:
      type: object
      properties:
        key:
          type: string
          description: The key of the new entry to be added to the log event
        value:
          type: string
          description: The value of the new entry to be added to the log event
        overwriteIfExists:
          type: boolean
          description: Specifies whether to overwrite the value if the key already exists in the log event. If you omit this,
            the default is false.
      required:
      - key
      - value
    AddKeys:
      type: object
      properties:
        entries:
          type: array
          items:
            $ref: '#/components/schemas/AddKeyEntry'
          description: An array of objects, where each object contains the information about one key to add to the log event.
      required:
      - entries
    CSV:
      type: object
      properties:
        quoteCharacter:
          type: string
          description: The character used used as a text qualifier for a single column of data. If you omit this, the double
            quotation mark " character is used.
        delimiter:
          type: string
          description: The character used to separate each column in the original comma-separated value log event. If you
            omit this, the processor looks for the comma , character as the delimiter.
        columns:
          type: array
          items:
            type: string
          description: An array of names to use for the columns in the transformed log event. If you omit this, default column
            names ([column_1, column_2 ...]) are used.
        source:
          type: string
          description: The path to the field in the log event that has the comma separated values to be parsed. If you omit
            this value, the whole log message is processed.
        destination:
          type: string
          description: The path to the parent field to put transformed key value pairs under. If you omit this value, the
            key value pairs will be placed under the root node.
    CopyValue:
      type: object
      properties:
        entries:
          type: array
          items:
            $ref: '#/components/schemas/CopyValueEntry'
          description: An array of CopyValueEntry objects, where each object contains the information about one field value
            to copy.
      required:
      - entries
    CopyValueEntry:
      type: object
      properties:
        source:
          type: string
          description: The key to copy.
        target:
          type: string
          description: The key of the field to copy the value to.
        overwriteIfExists:
          type: boolean
          description: Specifies whether to overwrite the value if the destination key already exists. If you omit this, the
            default is false.
      required:
      - source
      - target
    DateTimeConverter:
      type: object
      properties:
        source:
          type: string
          description: The key to apply the date conversion to.
        target:
          type: string
          description: The JSON field to store the result in.
        targetFormat:
          type: string
          description: The datetime format to use for the converted data in the target field. If you omit this, the default
            of yyyy-MM-dd'T'HH:mm:ss.SSS'Z is used.
        matchPatterns:
          type: array
          items:
            type: string
          description: A list of patterns to match against the source field.
        sourceTimezone:
          type: string
          description: The time zone of the source field. If you omit this, the default used is the UTC zone.
        targetTimezone:
          type: string
          description: The time zone of the target field. If you omit this, the default used is the UTC zone.
        locale:
          type: string
          description: The locale of the source field. If you omit this, the default of locale.ROOT is used.
      required:
      - source
      - target
      - matchPatterns
    DeleteKeys:
      type: object
      properties:
        withKeys:
          type: array
          items:
            type: string
          description: The list of keys to delete.
      required:
      - withKeys
    DeleteTransformerRequest:
      type: object
      properties:
        logGroupIdentifier:
          type: string
          description: Specify either the name or ARN of the log group to delete the transformer for. If the log group is
            in a source account and you are using a monitoring account, you must use the log group ARN.
      required:
      - logGroupIdentifier
    GetTransformerRequest:
      type: object
      properties:
        logGroupIdentifier:
          type: string
          description: Specify either the name or ARN of the log group to return transformer information for. If the log group
            is in a source account and you are using a monitoring account, you must use the log group ARN.
      required:
      - logGroupIdentifier
    GetTransformerResponse:
      type: object
      properties:
        logGroupIdentifier:
          type: string
          description: The ARN of the log group that you specified in your request.
        creationTime:
          type: integer
          description: The creation time of the transformer, expressed as the number of milliseconds after Jan 1, 1970 00:00:00
            UTC.
        lastModifiedTime:
          type: integer
          description: The date and time when this transformer was most recently modified, expressed as the number of milliseconds
            after Jan 1, 1970 00:00:00 UTC.
        transformerConfig:
          type: array
          items:
            $ref: '#/components/schemas/Processor'
          description: This sructure contains the configuration of the requested transformer.
    Grok:
      type: object
      properties:
        source:
          type: string
          description: The path to the field in the log event that you want to parse. If you omit this value, the whole log
            message is parsed.
        match:
          type: string
          description: The grok pattern to match against the log event. For a list of supported grok patterns, see Supported
            grok patterns.
      required:
      - match
    InvalidOperationException:
      type: object
      properties:
        message:
          type: string
    ListToMap:
      type: object
      properties:
        source:
          type: string
          description: The key in the log event that has a list of objects that will be converted to a map.
        key:
          type: string
          description: The key of the field to be extracted as keys in the generated map
        valueKey:
          type: string
          description: If this is specified, the values that you specify in this parameter will be extracted from the source
            objects and put into the values of the generated map. Otherwise, original objects in the source list will be put
            into the values of the generated map.
        target:
          type: string
          description: The key of the field that will hold the generated map
        flatten:
          type: boolean
          description: A Boolean value to indicate whether the list will be flattened into single items. Specify true to flatten
            the list. The default is false
        flattenedElement:
          type: string
          enum:
          - first
          - last
          description: If you set flatten to true, use flattenedElement to specify which element, first or last, to keep.
            You must specify this parameter if flatten is true
      required:
      - source
      - key
    LowerCaseString:
      type: object
      properties:
        withKeys:
          type: array
          items:
            type: string
          description: The array caontaining the keys of the fields to convert to lowercase.
      required:
      - withKeys
    MoveKeyEntry:
      type: object
      properties:
        source:
          type: string
          description: The key to move.
        target:
          type: string
          description: The key to move to.
        overwriteIfExists:
          type: boolean
          description: Specifies whether to overwrite the value if the destination key already exists. If you omit this, the
            default is false.
      required:
      - source
      - target
    MoveKeys:
      type: object
      properties:
        entries:
          type: array
          items:
            $ref: '#/components/schemas/MoveKeyEntry'
          description: An array of objects, where each object contains the information about one key to move.
      required:
      - entries
    ParseCloudfront:
      type: object
      properties:
        source:
          type: string
          description: Omit this parameter and the whole log message will be processed by this processor. No other value than
            @message is allowed for source.
    ParseJSON:
      type: object
      properties:
        source:
          type: string
          description: Path to the field in the log event that will be parsed. Use dot notation to access child fields. For
            example, store.book
        destination:
          type: string
          description: The location to put the parsed key value pair into. If you omit this parameter, it is placed under
            the root node.
    ParseKeyValue:
      type: object
      properties:
        source:
          type: string
          description: Path to the field in the log event that will be parsed. Use dot notation to access child fields. For
            example, store.book
        destination:
          type: string
          description: The destination field to put the extracted key-value pairs into
        fieldDelimiter:
          type: string
          description: The field delimiter string that is used between key-value pairs in the original log events. If you
            omit this, the ampersand & character is used.
        keyValueDelimiter:
          type: string
          description: The delimiter string to use between the key and value in each pair in the transformed log event. If
            you omit this, the equal = character is used.
        keyPrefix:
          type: string
          description: If you want to add a prefix to all transformed keys, specify it here.
        nonMatchValue:
          type: string
          description: A value to insert into the value field in the result, when a key-value pair is not successfully split.
        overwriteIfExists:
          type: boolean
          description: Specifies whether to overwrite the value if the destination key already exists. If you omit this, the
            default is false.
    ParsePostgres:
      type: object
      properties:
        source:
          type: string
          description: Omit this parameter and the whole log message will be processed by this processor. No other value than
            @message is allowed for source.
    ParseRoute53:
      type: object
      properties:
        source:
          type: string
          description: Omit this parameter and the whole log message will be processed by this processor. No other value than
            @message is allowed for source.
    ParseToOCSF:
      type: object
      properties:
        source:
          type: string
          description: The path to the field in the log event that you want to parse. If you omit this value, the whole log
            message is parsed.
        eventSource:
          type: string
          enum:
          - CloudTrail
          - Route53Resolver
          - VPCFlow
          - EKSAudit
          - AWSWAF
          description: Specify the service or process that produces the log events that will be converted with this processor.
        ocsfVersion:
          type: string
          enum:
          - V1.1
          - V1.5
          description: Specify which version of the OCSF schema to use for the transformed log events.
        mappingVersion:
          type: string
          description: The version of the OCSF mapping to use for parsing log data.
      required:
      - eventSource
      - ocsfVersion
    ParseVPC:
      type: object
      properties:
        source:
          type: string
          description: Omit this parameter and the whole log message will be processed by this processor. No other value than
            @message is allowed for source.
    ParseWAF:
      type: object
      properties:
        source:
          type: string
          description: Omit this parameter and the whole log message will be processed by this processor. No other value than
            @message is allowed for source.
    Processor:
      type: object
      properties:
        addKeys:
          $ref: '#/components/schemas/AddKeys'
        copyValue:
          $ref: '#/components/schemas/CopyValue'
        csv:
          $ref: '#/components/schemas/CSV'
        dateTimeConverter:
          $ref: '#/components/schemas/DateTimeConverter'
        deleteKeys:
          $ref: '#/components/schemas/DeleteKeys'
        grok:
          $ref: '#/components/schemas/Grok'
        listToMap:
          $ref: '#/components/schemas/ListToMap'
        lowerCaseString:
          $ref: '#/components/schemas/LowerCaseString'
        moveKeys:
          $ref: '#/components/schemas/MoveKeys'
        parseCloudfront:
          $ref: '#/components/schemas/ParseCloudfront'
        parseJSON:
          $ref: '#/components/schemas/ParseJSON'
        parseKeyValue:
          $ref: '#/components/schemas/ParseKeyValue'
        parseRoute53:
          $ref: '#/components/schemas/ParseRoute53'
        parseToOCSF:
          $ref: '#/components/schemas/ParseToOCSF'
        parsePostgres:
          $ref: '#/components/schemas/ParsePostgres'
        parseVPC:
          $ref: '#/components/schemas/ParseVPC'
        parseWAF:
          $ref: '#/components/schemas/ParseWAF'
        renameKeys:
          $ref: '#/components/schemas/RenameKeys'
        splitString:
          $ref: '#/components/schemas/SplitString'
        substituteString:
          $ref: '#/components/schemas/SubstituteString'
        trimString:
          $ref: '#/components/schemas/TrimString'
        typeConverter:
          $ref: '#/components/schemas/TypeConverter'
        upperCaseString:
          $ref: '#/components/schemas/UpperCaseString'
    PutTransformerRequest:
      type: object
      properties:
        logGroupIdentifier:
          type: string
          description: Specify either the name or ARN of the log group to create the transformer for.
        transformerConfig:
          type: array
          items:
            $ref: '#/components/schemas/Processor'
          description: This structure contains the configuration of this log transformer. A log transformer is an array of
            processors, where each processor applies one type of transformation to the log events that are ingested.
      required:
      - logGroupIdentifier
      - transformerConfig
    RenameKeyEntry:
      type: object
      properties:
        key:
          type: string
          description: The key to rename
        renameTo:
          type: string
          description: The string to use for the new key name
        overwriteIfExists:
          type: boolean
          description: Specifies whether to overwrite the existing value if the destination key already exists. The default
            is false
      required:
      - key
      - renameTo
    RenameKeys:
      type: object
      properties:
        entries:
          type: array
          items:
            $ref: '#/components/schemas/RenameKeyEntry'
          description: An array of RenameKeyEntry objects, where each object contains the information about a single key to
            rename.
      required:
      - entries
    ServiceUnavailableException:
      type: object
      properties:
        message:
          type: string
    SplitString:
      type: object
      properties:
        entries:
          type: array
          items:
            $ref: '#/components/schemas/SplitStringEntry'
          description: An array of SplitStringEntry objects, where each object contains the information about one field to
            split.
      required:
      - entries
    SplitStringEntry:
      type: object
      properties:
        source:
          type: string
          description: The key of the field to split.
        delimiter:
          type: string
          description: The separator characters to split the string entry on.
      required:
      - source
      - delimiter
    SubstituteString:
      type: object
      properties:
        entries:
          type: array
          items:
            $ref: '#/components/schemas/SubstituteStringEntry'
          description: An array of objects, where each object contains the information about one key to match and replace.
      required:
      - entries
    SubstituteStringEntry:
      type: object
      properties:
        source:
          type: string
          description: The key to modify
        from:
          type: string
          description: The regular expression string to be replaced. Special regex characters such as [ and ] must be escaped
            using \\ when using double quotes and with \ when using single quotes. For more information, see Class Pattern
            on the Oracle web site.
        to:
          type: string
          description: The string to be substituted for each match of from
      required:
      - source
      - from
      - to
    TestTransformerRequest:
      type: object
      properties:
        transformerConfig:
          type: array
          items:
            $ref: '#/components/schemas/Processor'
          description: This structure contains the configuration of this log transformer that you want to test. A log transformer
            is an array of processors, where each processor applies one type of transformation to the log events that are
            ingested.
        logEventMessages:
          type: array
          items:
            type: string
          description: An array of the raw log events that you want to use to test this transformer.
      required:
      - transformerConfig
      - logEventMessages
    TestTransformerResponse:
      type: object
      properties:
        transformedLogs:
          type: array
          items:
            $ref: '#/components/schemas/TransformedLogRecord'
          description: An array where each member of the array includes both the original version and the transformed version
            of one of the log events that you input.
    TransformedLogRecord:
      type: object
      properties:
        eventNumber:
          type: integer
          description: The event number.
        eventMessage:
          type: string
          description: The original log event message before it was transformed.
        transformedEventMessage:
          type: string
          description: The log event message after being transformed.
    TrimString:
      type: object
      properties:
        withKeys:
          type: array
          items:
            type: string
          description: The array containing the keys of the fields to trim.
      required:
      - withKeys
    TypeConverter:
      type: object
      properties:
        entries:
          type: array
          items:
            $ref: '#/components/schemas/TypeConverterEntry'
          description: An array of TypeConverterEntry objects, where each object contains the information about one field
            to change the type of.
      required:
      - entries
    TypeConverterEntry:
      type: object
      properties:
        key:
          type: string
          description: The key with the value that is to be converted to a different type.
        type:
          type: string
          enum:
          - boolean
          - integer
          - double
          - string
          description: The type to convert the field value to. Valid values are integer, double, string and boolean.
      required:
      - key
      - type
    UpperCaseString:
      type: object
      properties:
        withKeys:
          type: array
          items:
            type: string
          description: The array of containing the keys of the field to convert to uppercase.
      required:
      - withKeys
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/3cd98287b471c106254abd89279cc87308d38bfd/models/cloudwatch-logs/service/2014-03-28/cloudwatch-logs-2014-03-28.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)