/
← Voltar ao feed
low

Cloudflare makes Logpush Transformers generally available: SQL-based filtering and redaction of logs before export

1 fonte(s) · 1 atualização(ões) · publicado 12/10/2026 11:44 · coletado há 1 dia

Cloudflare announced general availability of Logpush Transformers, and made Logpush available on all self-serve plans. The feature lets teams filter, redact, and reshape logs with a SQL query before export to SIEMs, analytics platforms, or object storage. The article is a product and engineering post with no vulnerability, incident, or threat activity. Its main security relevance is data minimization: redacting sensitive fields such as client IP addresses and dropping unneeded records before they leave Cloudflare.

Technical Details

  • A Transformer is a SQL query written against a specific Logpush dataset (for example http_requests). WHERE removes non-matching records and SELECT defines the exported record. Output is NDJSON.
  • Execution is in-process in Cloudflare's Go-based delivery service Bufstream, using Apache DataFusion (Rust) and Apache Arrow. Batches cross the Go/Rust boundary through Arrow IPC, FFI, and cgo, with explicit ownership of buffers.
  • Cloudflare chose this design over an earlier prototype that ran WebAssembly Transformers in Workers, because a Worker call would add a network dependency to the export path.
  • Cloudflare's benchmark showed about 3 ms for a 5,000-row batch, roughly 1.6 million rows per second on a single goroutine.
  • Transformers fail closed. If a transform fails, Bufstream neither advances the delivery offset nor sends the untransformed batch. Retries are progressively delayed, and jobs that keep failing are automatically disabled.
  • Transformer Health in the Logpush Health tab shows successes and failures, data volume before and after, and transformation duration.
  • Transformers are managed through Transformer Studio or the API. Each update creates a new version.

Remediation

No remediation is required. Defenders can use Transformers to redact sensitive fields (for example by masking IP octets) and to drop health-check or internal traffic before logs reach downstream systems. Transformers are available on Free, Pro, Business, and Enterprise plans.

Linha do tempo

  1. blog.cloudflare.com ↗ · pub. 12/10/2026 11:44 · coletado 19/10 18:00 primeiro registro

    Cloudflare makes Logpush Transformers generally available: SQL-based filtering and redaction of logs before export

    ler a análise desta fonte

    Cloudflare announced general availability of Logpush Transformers, and made Logpush available on all self-serve plans. The feature lets teams filter, redact, and reshape logs with a SQL query before export to SIEMs, analytics platforms, or object storage. The article is a product and engineering post with no vulnerability, incident, or threat activity. Its main security relevance is data minimization: redacting sensitive fields such as client IP addresses and dropping unneeded records before they leave Cloudflare.

    Technical Details

    • A Transformer is a SQL query written against a specific Logpush dataset (for example http_requests). WHERE removes non-matching records and SELECT defines the exported record. Output is NDJSON.
    • Execution is in-process in Cloudflare's Go-based delivery service Bufstream, using Apache DataFusion (Rust) and Apache Arrow. Batches cross the Go/Rust boundary through Arrow IPC, FFI, and cgo, with explicit ownership of buffers.
    • Cloudflare chose this design over an earlier prototype that ran WebAssembly Transformers in Workers, because a Worker call would add a network dependency to the export path.
    • Cloudflare's benchmark showed about 3 ms for a 5,000-row batch, roughly 1.6 million rows per second on a single goroutine.
    • Transformers fail closed. If a transform fails, Bufstream neither advances the delivery offset nor sends the untransformed batch. Retries are progressively delayed, and jobs that keep failing are automatically disabled.
    • Transformer Health in the Logpush Health tab shows successes and failures, data volume before and after, and transformation duration.
    • Transformers are managed through Transformer Studio or the API. Each update creates a new version.

    Remediation

    No remediation is required. Defenders can use Transformers to redact sensitive fields (for example by masking IP octets) and to drop health-check or internal traffic before logs reach downstream systems. Transformers are available on Free, Pro, Business, and Enterprise plans.