Cloudflare Logpush launches Transformers for SQL-based filtering, masking, and reshaping of logs before export

Transformers are SQL queries bound to a specific Logpush dataset and executed before each batch is exported: records failing the WHERE clause are dropped, and the SELECT output becomes the exported record, allowing fields, nested structures, and masking to be added, removed, or changed, with results emitted as NDJSON. They run on an Apache DataFusion query engine embedded in the Bufstream export pipeline, passing batches across the Go/Rust boundary via Arrow IPC on the Apache Arrow columnar in-memory format; in benchmarks a single Go goroutine processes a 5,000-row http_requests batch in about 3 ms, roughly 1.6 million rows per second. Users can create, preview, and manage Transformers in the dashboard's Transformer Studio or via API, attaching them after saving to compatible NDJSON Logpush jobs using the same dataset, with each update producing a new version. Transforms are fail-closed: if a transform cannot execute, delivery offsets are not advanced and untransformed batches are not sent; instead the job retries with increasing delay, and persistently failing jobs are automatically disabled. For observability teams exporting Cloudflare logs to SIEMs, analytics platforms, or object storage, filtering, masking, and restructuring move from a separate post-export service into the export pipeline, reducing components to deploy, scale, and maintain while lowering export, ingestion, and storage costs for dropped records. The feature is available on Free, Pro, Business, and Enterprise plans.