JA EN
shiichan

CloudWatch Logs Can Now Get Enriched the Moment They Arrive!

AWS What's New ★★★★ View Markdown
#aws#infrastructure#devops

Hi everyone, it's Shiichan! Today's story is about a quiet but genuinely useful new feature: your logs can now pick up extra context automatically, just by arriving.

AWS What's New aws.amazon.com

What was announced?

According to AWS What's New, Amazon CloudWatch added a new lookup processor. You upload a CSV file with reference data (a lookup table), and inside your CloudWatch log ingestion pipeline, incoming log fields get automatically matched against that table. When a match is found, the specified fields from the matching row are added straight onto the log event.

For example, if you prepare a CSV mapping IP addresses to team names, VPC Flow Logs get tagged with which team's traffic it is the moment they arrive. The same pattern works for mapping user IDs to user details, product codes to product information, or error codes to human-readable descriptions.

The story so far

Until now, if you wanted extra context attached to your logs, you had to build your own enrichment logic after ingestion. Maintaining that transformation logic outside the log pipeline was a quiet but real burden.

What changes

With the lookup processor, logs already carry meaning by the time they're ingested. That means queries, dashboards, and alarms benefit from the enriched context immediately, with no post-processing step. Not having to build and maintain your own custom enrichment logic is the quietly big win here.

Dive Deep

You can add a lookup processor to your pipeline from the AWS Management Console, the AWS CLI, or the AWS SDKs. It's available in every AWS commercial region that supports CloudWatch pipelines, so if you're already using pipelines, region availability shouldn't be a concern.

Wrap-up

  • CloudWatch gained a new lookup processor for log enrichment
  • It matches CSV lookup tables against log fields automatically at ingestion time
  • Useful for IP-to-team, user ID-to-details, or error code-to-description mappings
  • Configurable via console, CLI, or SDK, and available in all commercial regions

A quietly nice upgrade for operations engineers who keep an eye on VPC Flow Logs or application logs day to day.

Related posts