Cloudflare Now Filters and Redacts Logs Natively

Cloudflare now lets you natively filter, reshape, and redact sensitive data from logs before they are sent to other services.

Cloudflare has announced a significant update to its observability platform with the general availability of Transformers, a new feature for its Logpush service. According to a post on the Cloudflare Blog, this tool allows developers, security professionals, and IT teams to natively manipulate log data before it is exported from Cloudflare’s network. The core capabilities include filtering unwanted log entries, reshaping the data structure to fit specific schemas, and redacting sensitive information. This update, which was part of a series of enhancements to Cloudflare Observability, is now available on all self-serve plans, making advanced log management accessible to a wider range of users. The feature aims to give customers granular control over their data at the source, streamlining a critical part of the data management lifecycle.

At its core, the Transformers feature functions as an inline processing engine within the Logpush data pipeline. When logs are generated by various Cloudflare services, such as the WAF or CDN, they can be routed through a Transformer before being batched for delivery. This allows users to apply custom rules to modify the data stream in near real-time. For example, a team could use a filter to drop noisy or irrelevant logs, such as routine health checks, thereby reducing the volume of data sent to downstream storage and analysis systems. The reshaping capability allows for standardizing log formats, such as renaming fields or nesting data, to ensure compatibility with a SIEM or data warehouse without requiring an external parsing tool. Most critically, the redaction function can automatically remove or mask personally identifiable information (PII), API keys, or other confidential data, ensuring it never leaves the security of Cloudflare’s edge network.

This development fits into a broader industry trend of shifting data processing and security controls closer to the point of data creation. Traditionally, managing raw logs has been a cumbersome, multi-step process. Companies would export vast amounts of unstructured data from a service provider and then use a separate, often complex, set of tools like Logstash or Fluentd to clean, parse, and secure the data. This approach not only adds operational overhead and potential latency but also creates a significant security vulnerability, as sensitive information exists in its raw form as it traverses multiple systems. By integrating these transformation capabilities directly into its platform, Cloudflare is effectively absorbing a layer of the observability stack. This move positions the company to compete not just with other edge network providers but also with specialized data pipeline and observability tools, offering a more consolidated and secure solution.

For businesses and technical teams, the practical implications of Cloudflare Transformers are immediate and substantial. The most direct benefit is the potential for significant cost savings. By filtering out unnecessary logs and reducing data volume, companies can lower their bills for data ingestion and storage from third-party observability platforms. Furthermore, by eliminating the need for a separate, self-hosted log processing service, organizations can reduce infrastructure costs and the engineering effort required to maintain it. From a security and compliance perspective, the ability to redact sensitive data at the source is a major advantage. It drastically minimizes the risk of data leaks and simplifies adherence to privacy regulations like GDPR and CCPA. Looking ahead, the key thing to watch will be how Cloudflare expands on this functionality. The introduction of more advanced features, such as data enrichment, could further solidify its platform as a central hub for managing the entire observability data lifecycle.

For developers and security teams, this native log processing eliminates a common, complex step in observability pipelines. It reduces attack surfaces by redacting sensitive data at the edge, ensuring PII never leaves the network, which simplifies compliance and enhances data security posture.

This feature can significantly lower costs by reducing the volume of logs sent to third-party services and eliminating the need for intermediary processing tools. It also strengthens security and compliance, reducing the risk of data leaks and associated fines by handling sensitive information within Cloudflare's network.