Logs

Major impact. Resolved Oct 22, 2026, 22:00 UTC.

Cloudflare Logpush now supports HTTP request logs as an account-scoped dataset. Use one job to deliver logs for every zone in an account instead of maintaining a separate job for each zone. Create the job at the account level in the Cloudflare dashboard or through the Logpush API. The ZoneName field identifies the source zone in each log entry. Custom fields remain configured per zone. An account…

Log Explorer datasets are now queried from the Logs page under Observability in the Cloudflare dashboard. The Logs page brings Log Explorer and Workers Observability datasets together with a shared filter builder, SQL editor, and visualizations. As part of this change, the Log Explorer menu is no longer shown in the dashboard navigation. Your enabled datasets, saved queries, and SQL queries conti…

Cloudflare Logpush is now available on Free, Pro, Business, and Enterprise plans with usage-based pricing. Free, Pro, and Business customers can enable Logpush through self-service. Enterprise customers continue to work with their account team. Logpush Transformers are also now generally available. Each account receives included monthly usage before charges apply: Internal exports: 25 GB per mont…

Transformers are now generally available for supported Logpush datasets on Free, Pro, Business, and Enterprise plans. Use SQL to filter records, reshape fields, redact sensitive values, compute new fields, or add metadata before Logpush delivers each batch. Create and preview Transformers in Transformer Studio or through the Cloudflare API, then attach them to eligible account-scoped or zone-scop…

Logpush jobs can now exclude identified distributed denial-of-service (DDoS) attack traffic. This option reduces attack traffic in delivered logs. It supports the http_requests, firewall_events, and network_analytics_logs datasets. In the dashboard, select Exclude DDoS attack traffic under Advanced Options. With the API, add this field to a job request: { "filter_attack_traffic": true } For more…

Log Explorer has a refreshed dataset configuration experience in the Cloudflare dashboard. The new controls make it easier to choose which fields and events Log Explorer ingests. Grouped field selection organizes fields by category and shows the number selected in each group. Field details identify each field's data type and mark required or deprecated fields. Bulk controls let you select all fie…

Cloudflare Log Explorer customers can now permanently delete account and zone datasets from the Cloudflare dashboard or API. Deletion protection is enabled by default to prevent accidental data loss. In the dashboard, go to Manage datasets, disable deletion protection for the dataset, select Delete, and enter the dataset name to confirm. To delete a dataset through the API, first set deletion_pro…

Cloudflare Enterprise customers using the Azure Functions-based Microsoft Sentinel connector ↗︎ must migrate to the Cloudflare for Microsoft Sentinel Codeless Connector Framework (CCF) connector ↗︎ by 2026-09-14. Microsoft is deprecating the Azure Monitor HTTP Data Collector API. Support for the API ends on 2026-09-14. As a result, Cloudflare will no longer maintain the Azure Functions-based conn…

Cloudflare has updated Logpush datasets: New datasets Account Abuse Protection Events: A new dataset with fields including AuthenticationIdentityProvider, AuthenticationMethod, AuthenticationStatus, BotScore, ClientASN, ClientCity, ClientCountry, ClientIP, Email, EphemeralID, EventSource, EventType, FraudEmailRisk, Host, JA4, RayID, Timestamp, UserAgent, and UserID. Magic BGP Logs: A new dataset…

Cloudflare Radar ↗︎ publishes global statistics on post-quantum key agreement adoption across all Cloudflare traffic, but until now customers had no way to see the same measurement scoped to their own zones. This is now possible because the http_requests Logpush dataset — also queryable in Log Explorer — includes a new ClientTLSKeyExchangeGroup field. The field reports the TLS key exchange group…

Enterprise customers can now push per-connection WebSocket analytics to any Logpush destination using the new websocket_analytics dataset. Each log record is emitted when a WebSocket connection closes and includes fields that were previously only available to Cloudflare engineers via internal tooling. Key fields include: ConnectionCloseReason — why the connection ended: peerReset, peerNoError, ti…

Cloudflare has updated Logpush datasets: Updated fields in existing datasets Gateway DNS (added): AppliedMaxTTL and UpstreamRecordTTLs. Gateway HTTP (added): Warnings. HTTP requests (added): CacheLockWaitedMs. For the complete field definitions for each dataset, refer to Logpush datasets.

Cloudflare Logpush now supports firewall events as an account-scoped dataset. Configure a single Logpush job at the account level to receive firewall events for every zone in the account, instead of creating and maintaining a separate job per zone. The dataset includes a new ZoneName field so you can identify which zone each event came from when consuming logs in your downstream pipeline. What's…

Cloudflare has updated Logpush datasets: New datasets WebSocket Analytics: A new dataset with fields including BytesReceivedClient, BytesReceivedOrigin, BytesSentClient, BytesSentOrigin, ClientASN, ClientIP, ClientRequestHost, ClientRequestPath, ClientRequestUserAgent, ColoCode, ConnectionCloseReason, ConnectionCloseSource, ConnectionID, ConnectionTransportCloseCode, EdgeEndTimestamp, EdgeStartTi…

Cloudflare has updated Logpush datasets: New datasets Turnstile Events: A new dataset with fields including ASN, Action, BrowserMajor, BrowserName, ClientIP, CountryCode, EventType, Hostname, OSMajor, OSName, Sitekey, Timestamp, and UserAgent. For the complete field definitions for each dataset, refer to Logpush datasets.

Cloudflare has updated Logpush datasets: Updated fields in existing datasets DEX Device State Events (added): DeviceRegistrationProfileID. Gateway HTTP (added): AddedHeaders, DeletedHeaders, and SetHeaders. HTTP requests (added): MatchedRules. For the complete field definitions for each dataset, refer to Logpush datasets.

Cloudflare has updated Logpush datasets: New datasets Email Security Post-Delivery Events: A new dataset with fields including AlertID, CompletedAt, Destination, FinalDisposition, Folder, From, FromName, MessageID, MessageTimestamp, MicrosoftTenantID, Operation, PostfixID, Reasons, Recipient, RequestedAt, RequestedBy, RequestedDisposition, Status, Subject, Success, and To. Magic Network Monitorin…

Custom Dashboards are now available to all Cloudflare customers. Build personalized views that highlight the metrics most critical to your infrastructure and security posture, moving beyond standard product dashboards. This update significantly expands the data available for visualization. Build charts based on any of the 100+ datasets available via the Cloudflare GraphQL API, covering everything…

When a Cloudflare Worker intercepts a visitor request, it can dispatch additional outbound fetch calls called subrequests. By default, each subrequest generates its own log entry in Logpush, resulting in multiple log lines per visitor request. With subrequest merging enabled, subrequest data is embedded as a nested array field on the parent log record instead. What's new New subrequest_merging fi…

Logpush has traditionally been great at delivering Cloudflare logs to a variety of destinations in JSON format. While JSON is flexible and easily readable, it can be inefficient to store and query at scale. With this release, you can now send your logs directly to Pipelines to ingest, transform, and store your logs in R2 as Parquet files or Apache Iceberg tables managed by R2 Data Catalog. This m…

Cloudflare has added new fields to multiple Logpush datasets: TenantID field The following Gateway and Zero Trust datasets now include a TenantID field: Gateway DNS: Identifies the tenant ID of the DNS request, if it exists. Gateway HTTP: Identifies the tenant ID of the HTTP request, if it exists. Gateway Network: Identifies the tenant ID of the network session, if it exists. Zero Trust Network S…

You can now configure Logpush jobs to Google BigQuery directly from the Cloudflare dashboard, in addition to the existing API-based setup. Previously, setting up a BigQuery Logpush destination required using the Logpush API. Now you can create and manage BigQuery Logpush jobs from the Logpush page in the Cloudflare dashboard by selecting Google BigQuery as the destination and entering your Google…

Cloudflare has added a new field to the Gateway DNS Logpush dataset: ResponseTimeMs: Total response time of the DNS request in milliseconds. For the complete field definitions, refer to Gateway DNS dataset.

Cloudflare Logpush now supports BigQuery as a native destination. Logs from Cloudflare can be sent to Google Cloud BigQuery ↗︎ via Logpush. The destination can be configured through the Logpush UI in the Cloudflare dashboard or by using the Logpush API. For more information, refer to the Destination Configuration documentation.

Logpush now supports higher-precision timestamp formats for log output. You can configure jobs to output timestamps at millisecond or nanosecond precision. This is available in both the Logpush UI in the Cloudflare dashboard and the Logpush API. To use the new formats, set timestamp_format in your Logpush job's output_options: rfc3339ms — 2024-02-17T23:52:01.123Z rfc3339ns — 2024-02-17T23:52:01.1…

Cloudflare Log Explorer now allows you to customize exactly which data fields are ingested and stored when enabling or managing log datasets. Previously, ingesting logs often meant taking an "all or nothing" approach to data fields. With Ingest Field Selection, you can now choose from a list of available and recommended fields for each dataset. This allows you to reduce noise, focus on the metric…

Cloudflare has added new fields across multiple Logpush datasets: New dataset MCP Portal Logs: A new dataset with fields including ClientCountry, ClientIP, ColoCode, Datetime, Error, Method, PortalAUD, PortalID, PromptGetName, ResourceReadURI, ServerAUD, ServerID, ServerResponseDurationMs, ServerURL, SessionID, Success, ToolCallName, UserEmail, and UserID. New fields in existing datasets DEX Appl…

Log Explorer now supports multiple concurrent queries with the new Tabs feature. Work with multiple queries simultaneously and pivot between datasets to investigate malicious activity more effectively. Key capabilities Multiple tabs: Open and switch between multiple query tabs to compare results across different datasets. Quick filtering: Select the filter button from query results to add a value…

Cloudflare Logpush now supports SentinelOne as a native destination. Logs from Cloudflare can be sent to SentinelOne AI SIEM ↗︎ via Logpush. The destination can be configured through the Logpush UI in the Cloudflare dashboard or by using the Logpush API. For more information, refer to the Destination Configuration documentation.

We've resolved a bug in Log Explorer that caused inconsistencies between the custom SQL date field filters and the date picker dropdown. Previously, users attempting to filter logs based on a custom date field via a SQL query sometimes encountered unexpected results or mismatching dates when using the interactive date picker. This fix ensures that the custom SQL date field filters now align corre…

We've significantly enhanced Log Explorer by adding support for 14 additional Cloudflare product datasets. This expansion enables Operations and Security Engineers to gain deeper visibility and telemetry across a wider range of Cloudflare services. By integrating these new datasets, users can now access full context to efficiently investigate security incidents, troubleshoot application performan…

We're excited to announce a quality-of-life improvement for Log Explorer users. You can now resize the custom SQL query window to accommodate longer and more complex queries. Previously, if you were writing a long custom SQL query, the fixed-size window required excessive scrolling to view the full query. This update allows you to easily drag the bottom edge of the query window to make it taller.…

We’re excited to introduce Logpush Health Dashboards, giving customers real-time visibility into the status, reliability, and performance of their Logpush jobs. Health dashboards make it easier to detect delivery issues, monitor job stability, and track performance across destinations. The dashboards are divided into two sections: Upload Health: See how much data was successfully uploaded, where…

Permissions for managing Logpush jobs related to Zero Trust datasets (Access, Gateway, and DEX) have been updated to improve data security and enforce appropriate access controls. To view, create, update, or delete Logpush jobs for Zero Trust datasets, users must now have both of the following permissions: Logs Edit Zero Trust: PII Read Note Update your UI, API or Terraform configurations to incl…

We're excited to announce that Log Explorer users can now cancel queries that are currently running. This new feature addresses a common pain point: waiting for a long, unintended, or misconfigured query to complete before you can submit a new, correct one. With query cancellation, you can immediately stop the execution of any undesirable query, allowing you to quickly craft and submit a new quer…

We're excited to announce a new feature in Log Explorer that significantly enhances how you analyze query results: the Query results distribution chart. This new chart provides a graphical distribution of your results over the time window of the query. Immediately after running a query, you will see the distribution chart above your result table. This visualization allows Log Explorer users to qu…

Logpush now supports integration with Microsoft Sentinel ↗︎.The new Azure Sentinel Connector built on Microsoft’s Codeless Connector Framework (CCF), is now available. This solution replaces the previous Azure Functions-based connector, offering significant improvements in security, data control, and ease of use for customers. Logpush customers can send logs to Azure Blob Storage and configure th…

Directly from Log Search results, customers can pivot to other parts of the Cloudflare dashboard to immediately take action as a result of their investigation. From the http_requests or fw_events dataset results, right click on an IP Address or JA3 Fingerprint to pivot to the Investigate portal to lookup the reputation of an IP address or JA3 fingerprint. Easily learn about error codes by linking…

The results table view of Log Search has been updated with additional functionality and a more streamlined user experience. Users can now easily: Remove/add columns. Resize columns. Sort columns. Copy values from any field.

Log Explorer now supports logging and filtering on header or cookie fields in the http_requests dataset. Create a custom field to log desired header or cookie values into the http_requests dataset and Log Explorer will import these as searchable fields. Once configured, use the custom SQL editor in Log Explorer to view or filter on these requests. For more details, refer to Headers and cookies.

Cloudflare Logpush can now deliver logs from using fixed, dedicated egress IPs. By routing Logpush traffic through a Cloudflare zone enabled with Aegis IP, your log destination only needs to allow Aegis IPs making setup more secure. Highlights: Fixed egress IPs ensure your destination only accepts traffic from known addresses. Works with any supported Logpush destination. Recommended to use a ded…

Customers can now rely on Log Explorer to meet their log retention compliance requirements. Contract customers can choose to store their logs in Log Explorer for up to two years, at an additional cost of $0.10 per GB per month. Customers interested in this feature can contact their account team to have it added to their contract.

Cloudflare Logpush now supports IBM Cloud Logs as a native destination. Logs from Cloudflare can be sent to IBM Cloud Logs ↗︎ via Logpush. The setup can be done through the Logpush UI in the Cloudflare Dashboard or by using the Logpush API. The integration requires IBM Cloud Logs HTTP Source Address and an IBM API Key. The feature also allows for filtering events and selecting specific log fields…

Log Explorer customers can now monitor their data ingestion volume to keep track of their billing. Monthly usage is displayed at the top of the Log Search and Manage Datasets screens in Log Explorer.

Log Explorer is now GA, providing native observability and forensics for traffic flowing through Cloudflare. Search and analyze your logs, natively in the Cloudflare dashboard. These logs are also stored in Cloudflare's network, eliminating many of the costs associated with other log providers. With Log Explorer, you can now: Monitor security and performance issues with custom dashboards – use na…

Custom Fields now support logging both raw and transformed values for request and response headers in the HTTP requests dataset. These fields are configured per zone and apply to all Logpush jobs in that zone that include request headers, response headers. Each header can be logged in only one format—either raw or transformed—not both. By default: Request headers are logged as raw values Response…

We’ve streamlined the Logpush setup process by integrating R2 bucket creation directly into the Logpush workflow! Now, you no longer need to navigate multiple pages to manually create an R2 bucket or copy credentials. With this update, you can seamlessly configure a Logpush job to R2 in just one click, reducing friction and making setup faster and easier. This enhancement makes it easier for cust…

Cloudflare has introduced new fields to two Gateway-related datasets in Cloudflare Logs: Gateway HTTP: ApplicationIDs, ApplicationNames, CategoryIDs, CategoryNames, DestinationIPContinentCode, DestinationIPCountryCode, ProxyEndpoint, SourceIPContinentCode, SourceIPCountryCode, VirtualNetworkID, and VirtualNetworkName. Gateway Network: ApplicationIDs, ApplicationNames, DestinationIPContinentCode,…