Cloudflare Logpush Transformers Bring In-Pipeline SQL Processing to All Users
Cloudflare has made Logpush Transformers generally available across all self-serve plans, enabling developers to filter, redact, and reshape log data using SQL before it leaves the edge network. Announced during the company’s 2026 Birthday Week, this update eliminates the need for external ETL pipelines, directly reducing downstream storage costs and operational overhead for observability teams.
How Cloudflare Logpush Transformers Process Data at the Edge
Cloudflare announced that Transformers run directly inside the Logpush delivery pipeline, applying a SQL query to each batch of records before export. According to SysDesAi, the system “leverages Apache DataFusion and Apache Arrow” to execute these transformations efficiently, handling over a billion events per second with predictable resource usage.
Developers write a SQL query against a specific Logpush dataset. The WHERE clause filters out unwanted records, while the SELECT statement reshapes the remaining data. As Cloudflare explains, teams use this capability to "filter records, redact sensitive data, and reshape the output by adding, renaming, removing, or nesting fields". The final output is delivered in NDJSON format to destinations like security information and event management (SIEM) systems or object storage. In edge environments where there is no persistent host to inspect during an incident, capturing the right evidence through precisely shaped logs is critical for post-incident diagnosis.
Why Cloudflare Moved Logpush from Enterprise to Self-Serve Plans
Historically, forwarding Cloudflare logs to non-Cloudflare destinations was restricted to Enterprise accounts. Smaller teams often had to rely on workarounds, such as using Cloudflare Workers to route logs, as noted in Profound’s integration documentation.
This release fulfills a one-year progress update on Cloudflare’s pledge to "eliminate two-tier Enterprise-only features." By making Logpush and Transformers available on Free, Pro, and Business plans via self-serve, pay-as-you-go pricing, the company is providing broader access to enterprise-grade observability tools without requiring custom infrastructure.
How Cloudflare Transformers Reduce SIEM and Analytics Ingestion Costs
The most immediate impact of in-pipeline transformation is financial. Analytics platforms and SIEMs, such as Axiom, typically charge based on data ingest and storage volumes. When organizations export raw logs, they pay to transfer, ingest, and store records that are ultimately discarded upon arrival.
By filtering out high-volume, low-value traffic like automated health checks at the edge, teams can significantly reduce their downstream data footprint. Furthermore, removing the need to deploy, scale, and maintain a separate middleware processing service cuts both compute costs and engineering hours, shifting log normalization from a post-ingestion burden to a pre-export configuration.
How Developers Build and Manage Transformer Queries in Cloudflare
Teams can create and manage Transformers through the Transformer Studio in the Cloudflare dashboard or programmatically via the API. Once saved, a Transformer attaches to a compatible NDJSON Logpush job using the same dataset.
The system includes version control for queries; every update creates a new version, allowing engineers to track how a transformation schema has evolved over time. A practical use case involves normalizing data across multiple content delivery networks, where a query can redact sensitive IP addresses, add a static provider field, and nest request paths into a unified schema before the data reaches a centralized dashboard.
Related articles
