Skip to content

CloudFlare LogPush

This document describes configuring and receiving LogPush logs to Guance. Currently supported data types are:

  • HTTP Requests
  • DNS Logs

When configuring the HTTP Destination, three request parameters must be provided: - source: Data source tag (supports http_requests or dns_logs) - service: Service tag (recommended: domain name, e.g., service=domain.com) - token: Authentication token.

HTTP Requests

HTTP request logs. Configure the target URL with source=http_requests.

Creating a Job

  1. Log in to Cloudflare Dashboard → Select target domain → Navigate to Analytics & Logs → Click Add Logpush Job.
  2. Select dataset: HTTP Requests.
  3. Configure destination: HTTP Destination.
  4. Enter URL: https://<endpoint>/v1/write/cf-logpush?source=http_requests&domain=<domain.com>&token=tkn_abcxxx
  5. Job name: Any valid format.
  6. Fields to send: Users can customize their choices, and any field that is not empty will be parsed into a field.
  7. Advanced options: Set timestamp format to unitnano.

Note:

  • The URL must include source, domain, and token for data filtering.
  • Timestamps must use unitnano.

Supported Fields(part of fields):

Cloudflare Field Target Field Description
ClientIP ClientIP client ip
EdgeResponseStatus EdgeResponseStatus HTTP status code returned by Cloudflare to the client.
- duration request duration,nano
- country country name
RayID RayID Identifier of the request
ClientCity ClientCity Approximate city of the client.
ClientCountry ClientCountry 2-letter ISO-3166 country code of the client IP address.
ClientRegionCode ClientRegionCode The ISO-3166-2 region code of the client IP address.
ClientRequestHost ClientRequestHost Host requested by the client.
ClientRequestMethod ClientRequestMethod HTTP method of client request.
ClientRequestURI ClientRequestURI URI requested by the client.
ClientDeviceType ClientDeviceType Client device type
ClientRequestBytes ClientRequestBytes Number of bytes in the client request.
ClientRequestPath ClientRequestPath URI path requested by the client.
ClientRequestProtocol ClientRequestProtocol HTTP protocol of client request.
ClientRequestScheme ClientRequestScheme The URL scheme requested by the visitor.
ClientRequestUserAgent ClientRequestUserAgent User agent reported by the client.
EdgeTimeToFirstByteMs EdgeTimeToFirstByteMs Total view of Time To First Byte as measured at Cloudflare's edge.
EdgeResponseBodyBytes EdgeResponseBodyBytes Size of the HTTP response body returned to clients.
EdgeResponseBytes EdgeResponseBytes Number of bytes returned by the edge to the client.
- message log json

DNS Logs

Similar steps to HTTP, but configure source=dns_logs in the target URL.

Creating a Job

  1. Log in to Cloudflare Dashboard → Select target domain → Navigate to Analytics & Logs → Click Add Logpush Job.
  2. Select dataset: DNS Logs.
  3. Configure destination: HTTP Destination.
  4. Enter URL:https://<endpoint>/v1/write/cf-logpush?source=dns_logs&domain=<domain.com>&token=tkn_abcxxx
  5. Job name: Any valid format.
  6. Fields to send: See supported fields below.
  7. Advanced options: Set timestamp format to nanosecond unit.

Note:

  • The URL must include source, domain, and token.
  • Timestamps must use nanosecond units.

Supported Fields:

Cloudflare Field Target Field Description
ColoCode ColoCode IATA airport code of the data center that received the request.
EDNSSubnet EDNSSubnet IPv4 or IPv6 address information corresponding to the EDNS Client Subnet (ECS) forwarded by recursive resolvers. Not all resolvers send this information.
EDNSSubnetLength EDNSSubnetLength Size of the EDNS Client Subnet (ECS) in bits. For example, if the last octet of an IPv4 address is omitted (192.0.2.x.), the subnet length will be 24.
QueryName QueryName Name of the query that was sent.
QueryType QueryType Integer value of query type. For more information refer to Query type
- query_type String value of query type:A,AAAA,NS,CNAME,SOA,PTR,MX,TXT,DNSKEY,HTTPS.other is "unknown"
ResponseCached ResponseCached Whether the response was cached or not.
ResponseCode ResponseCode Integer value of response code. For more information refer to Response code ↗.
SourceIP SourceIP IP address of the client (IPv4 or IPv6).
Timestamp time_ns Timestamp at which the query occurred.

Additional Notes

  1. Sampling recommended: Enable sampling to manage data volume.
  2. Field customization: Use pipelines to add/modify/remove fields.
  3. API configuration: Jobs can be created/modified: LogPush API

Feedback

Is this page helpful? ×