The Transformers feature is now generally available within Cloudflare’s Logpush service, allowing teams to process their logs before exporting them to the final destination. Users can write SQL queries to filter logs, redact parts of sensitive data, and add, rename, delete, or organize fields within a nested structure.
The feature targets monitoring and security teams that export Cloudflare logs to security information and event management (SIEM) systems, analytics platforms, and object stores. Instead of running a separate service to process logs after they arrive, Logpush performs the transformation within the export path itself.
What changes in practice?
The user defines a custom Transformer for a specific Logpush dataset. A WHERE clause is applied to remove unwanted logs, while a SELECT clause specifies the fields that will appear in the exported log. The results are stored in NDJSON format, like the original logs, and the feature is not a tool for transforming the serialization format itself.
For example, users can exclude health-check requests and internal traffic, redact the final portion of an IP address, standardize field names across multiple CDN providers, and add fixed fields such as the provider name or an indicator identifying server errors. Filtering before export helps reduce the volume of data for which teams pay export, ingestion, and storage costs before discarding it later.
Execution within the export path
Cloudflare chose to run the queries inside the Bufstream delivery service rather than rely on an external network service. According to the company, running WebAssembly through Cloudflare Workers would add a network connection to the Logpush path, potentially causing timeouts and retries that would affect delivery time and throughput.
Transformers use the Apache DataFusion engine, written in Rust, together with Apache Arrow to represent data in typed columns in memory. In a Cloudflare test on a synthetic batch of 5,000 http_requests logs, executing a preconfigured Transformer took approximately 3 milliseconds on a single Go thread, equivalent to roughly 1.6 million records per second.
Bufstream receives compressed Logpush batches, converts eligible logs into an Arrow RecordBatch, and then passes them to DataFusion through Arrow IPC and the Go–Rust binding interface. After executing the query, the service converts the results back to NDJSON, then batches, compresses, and uploads them to the specified destination.
Failure controls and management
Transformers operate according to a fail-closed principle: if the transformation cannot be executed, Bufstream does not send the batch in its raw form or deliver it to the destination. Instead, it retries with progressive backoff, reports the error, and may disable jobs that remain failed for an extended period so they do not consume resources needed by healthy jobs.
Transformations can be created, previewed, and managed through Transformer Studio in the Cloudflare dashboard or through the API. Each update also creates a new version, and the Transformer Health screen provides metrics on successful and failed transformations, data volume before and after processing, and execution duration.
Why does this matter?
The primary value is not simply adding SQL to a logging service, but moving data-reduction, standardization, and redaction decisions to a point before export. This may reduce teams’ reliance on custom processing layers, but it does not eliminate the need to test queries and review data schemas, especially because a Transformer failure prevents the batch from being sent instead of passing through an unprocessed version.
Transformers are available on the Free, Pro, Business, and Enterprise plans. Configuration and pricing details remain subject to Cloudflare’s current documentation.