Signal / 026 — Cloudflare moves log redaction into the export pipe

Fresh signal: The cheapest sensitive log is the one you never export. Cloudflare now lets teams decide what leaves the pipeline before storage and ingestion bills begin.

Cloudflare said on October 12 that Transformers for Logpush are generally available. A Transformer is a SQL query attached to a Logpush dataset. Its WHERE clause filters records; its SELECT output can add, rename, remove, redact, or nest fields before the remaining records are exported as NDJSON.

Less plumbing between edge and archive

Without this step, observability teams often run a separate processor between Cloudflare and a SIEM, analytics platform, or object store. That service must be deployed, scaled, monitored, and paid for. Moving transformations into Logpush can remove health checks and other noise early, normalize records from multiple providers, and omit data that should not reach a downstream destination.

Cloudflare says the transformation engine runs inside its high-throughput export workflow. The announcement also states that Logpush is now available across self-serve plans. Those are Cloudflare’s claims; this article does not benchmark throughput or cost savings.

Redaction is also deletion

Opinion: Pre-export filtering is useful privacy and cost control, but every rule becomes part of the incident-response boundary. A field removed today may be the clue an investigator needs tomorrow. Teams should version transformation queries, review them like code, test them on sampled traffic, and document which destination retains the least-altered record.

The feature replaces infrastructure, not judgment. Escape the default pipeline—but keep an auditable route back to what happened.

AI-assisted summary: Drafted with AI assistance and reviewed against Cloudflare’s official October 12 engineering post. No independent performance testing is claimed.