Amazon CloudWatch pipelines adds GeoIP, RDS, and XML processors
AWS added three new processors to CloudWatch pipelines to parse RDS logs, XML payloads, and enrich IP addresses with geographic data, improving log queryability without extra cost.
Amazon CloudWatch pipelines has introduced three new processors to parse and enrich log data during ingestion: an Amazon RDS log parser, an XML parser, and a GeoIP enrichment processor. CloudWatch pipelines is a managed service that ingests, transforms, and routes telemetry to CloudWatch without requiring infrastructure management. The new processors address common log format challenges, such as unstructured Aurora logs, embedded XML in application logs, and IP addresses lacking geographic context.
The Amazon RDS processor converts Aurora audit and error logs into structured fields, enabling easier compliance reporting and analysis. The XML parser extracts XML strings from fields and converts them into JSON, making embedded payloads queryable. The GeoIP processor adds geographic context—such as city, country, and coordinates—to IP address fields, supporting security and operational use cases like identifying log source origins.
These processors can be used independently or combined within a single pipeline to address specific data processing needs. For example, an Aurora audit log can be parsed for compliance, while a Windows Event Log’s XML payload can be extracted and its source IP resolved to a location for security analysis. The processors are available at no additional cost in all AWS Regions where CloudWatch pipelines is supported.
To implement these processors, users can configure them via the AWS Management Console, AWS CLI, or AWS SDKs. The processors integrate with existing CloudWatch pipelines workflows, and their usage is subject to standard CloudWatch logs ingestion and storage rates. Documentation is available to guide users through setup and configuration.