CloudWatch pipelines add conditional log routing and chained parsers
Serguey Asael Shinder1 min readAWS announced on 14 October 2026 two additions to Amazon CloudWatch pipelines, the fully managed AWS service that takes in telemetry, reshapes it and delivers it to CloudWatch: conditional log routing and chained log parsers.
Routing by content. AWS describes the problem as pipelines that carry a mix of event types which belong in different places. With conditional routing, each event can land in its own CloudWatch log group: a pipeline sets up routes, and each route has conditions that are checked against the fields produced by processing. The examples AWS gives are separating events by severity, source or type — so that each group can carry its own retention and access controls.
Parsers in sequence. Individual events can also nest one log format inside another. Chained parsers let a pipeline apply several parser processors one after another, with later parsers working on fields produced by earlier ones. AWS's example: parse a JSON envelope first, then run a Grok parser on a field extracted from it.
Together, AWS says, the two features let a single pipeline structure diverse log formats and route them to the right log groups.
Availability. Both capabilities are available in all commercial AWS Regions where CloudWatch pipelines is generally available, and can be configured from the AWS Management Console, the AWS CLI or the SDKs. The announcement points to the CloudWatch pipelines documentation for setup; it does not mention pricing changes.
Source: AWS, "Amazon CloudWatch announces log routing and chained log parsers" — https://aws.amazon.com/about-aws/whats-new/2026/10/cloudwatch-pipelines-log-routing/