AWS AmazonCloudWatch documentation change
Summary
Added clarification about conditional processing limitations for parser processors and specific behavior notes for Grok processor when conditions
Security assessment
This change documents behavioral characteristics of parser processors, specifically that most parsers don't support conditional processing and Grok processor behavior when used as first processor. No security vulnerabilities, fixes, or security features are mentioned. This is documentation of existing functionality limitations.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/parser-processors.md b/AmazonCloudWatch/latest/monitoring/parser-processors.md index 643b1822b..921a79eda 100644 --- a//AmazonCloudWatch/latest/monitoring/parser-processors.md +++ b//AmazonCloudWatch/latest/monitoring/parser-processors.md @@ -10,0 +11,4 @@ Parser processors convert raw or semi-structured log data into structured format +###### Conditional processing not supported + +Parser processors (except Grok) do not support conditional processing with the `when` parameter. This includes OCSF, CSV, JSON, KeyValue, VPC, Route53, WAF, Postgres, and CloudFront parsers. For more information, see [Expression syntax for conditional processing](./conditional-processing.html). + @@ -140,0 +145,9 @@ Array with single Grok pattern. Maximum 512 characters per pattern. +`when` (optional) + + +Conditional expression that determines whether this processor executes. Maximum length is 256 characters. See [Expression syntax for conditional processing](./conditional-processing.html). + +###### Important + +If the Grok processor is used as the parser (first processor) in a pipeline and its `when` condition evaluates to false, the entire pipeline does not execute for that log event. Parsers must run for downstream processors to receive structured data. +