AWS AmazonCloudWatch documentation change
Summary
Removed parseToOCSF processor documentation and updated CSV processor examples/delimiter handling
Security assessment
The removal of OCSF (Open Cybersecurity Schema Framework) conversion documentation reduces security-related format guidance but doesn't indicate a security issue. The delimiter changes (adding \t and \s support) are syntax updates without security impact.
Diff
diff --git a/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.md b/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.md index 2c8feefdf..1ddd62e72 100644 --- a//AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.md +++ b//AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.md @@ -37,2 +36,0 @@ This section contains information about each processor that you can use in a log - * [parseToOCSF](./CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-parseToOCSF) - @@ -87,2 +84,0 @@ This section contains information about each processor that you can use in a log - * [Transformation metrics and errors](./Transformation-Errors-Metrics.html) - @@ -513,31 +508,0 @@ Output: -### parseToOCSF - -The **parseToOCSF** processor converts logs into [Open Cybersecurity Schema Framework (OCSF)](https://ocsf.io) format. - -The original `@message` content is not changed, the new keys are added to the message. - -Field | Description | Required? | Default | Limits ----|---|---|---|--- -eventSource | The service or process that produces the log events that will be converted with this processor. Valid values are the following: - - * `CloudTrail` for [ CloudTrail logging management events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-events-with-cloudtrail.html), [ Lambda data events in CloudTrail](https://docs.aws.amazon.com/lambda/latest/dg/logging-using-cloudtrail.html#cloudtrail-data-events), , or [ Amazon S3 data events in CloudTrail](https://docs.aws.amazon.com/waf/latest/developerguide/logging-examples.html). - * `Route53Resolver` for [ Route 53 Resolver query logs](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-query-logs.html). - * `VPCFlow` for [ Amazon VPC flow logs](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html). - * `EKSAudit` for [ Amazon EKS audit logs](https://docs.aws.amazon.com/eks/latest/best-practices/auditing-and-logging.html). - * `AWSWAF` for [AWS WAF logs](https://docs.aws.amazon.com/waf/latest/developerguide/logging.html). - -| Yes | - | - -ocsfVersion | The version of the OCSF schema to use for the transformed log events. Currently, the only supported value is `V1.1` | Yes | `V1.1` | - - -**Example** - -The following example transforms Amazon VPC flow logs to OCSF format. - - - [ - "parseToOCSF": { - eventSource: "VPCFlow", - version: "V1.1" - } - ] - @@ -551 +516 @@ source | Path to the field in the log event that will be parsed | No | `@messag -delimiter | The character used to separate each column in the original comma-separated value log event | No | `,` | Maximum length: 1 +delimiter | The character used to separate each column in the original comma-separated value log event | No | `,` | Maximum length: 1 unless the value is `\t` or `\s` @@ -554,0 +520,2 @@ columns | List of names to use for the columns in the transformed log event. | +Setting `delimiter` to `\t` will separate each column on a tab character, and `\t` will separate each column on a single space character. + @@ -560 +527 @@ Suppose part of an ingested log event looks like this: - 'Akua Mansa',28,'New York, USA' + 'Akua Mansa':28:'New York: USA' @@ -565,0 +533 @@ Suppose we use only the **csv** processor: + { @@ -567,2 +535,3 @@ Suppose we use only the **csv** processor: - "delimiter": ",", - "quoteCharacter": ":"" + "delimiter": ":", + "quoteCharacter": "'" + }