Cloudflare Observability

Beginning December 1, 2026, all Cloudflare logs and traces will use the same pricing model. Log Explorer datasets have a different price point of $1 per GB ingested and include 30-day retention. Queries, dashboards, alerts, and analytics do not incur additional charge.

Refer to Datasets to review the price point and retention for each dataset.

Included in the new Observability pricing

The following logs and traces share account-level ingestion and storage allowances:

• Cloudflare Traces
• Workers Logs
• Workers Traces
• Containers logs
• R2 Data Access Logs
• AI Gateway logs
• Issues

Plans

Plan	Included ingestion	Included storage	Additional ingestion	Additional storage
Free	0.5 GB per day	Seven-day retention included	Not available	Not separately metered
Paid	50 GB per billing cycle	10 GB-month per billing cycle	$0.25 per GB	$0.10 per GB-month

Enterprise accounts move to this pricing when their contract renews. Until then, existing contract terms apply.

Paid usage continues automatically after an allowance is exhausted. Ingestion and storage are separate meters, so unused ingestion allowance cannot be applied to storage or the reverse. Allowances do not roll over between billing cycles.

You will be able to view your current ingestion and storage usage, remaining allowances, and estimated charges in Billable Usage.

On Free, Cloudflare stops ingesting new data when the account reaches its daily limit. Ingestion resumes when the allowance resets at 00:00 UTC. Stored data remains queryable for its seven-day retention period.

How usage is measured

Ingestion

Ingestion includes the event body, the default enriched attributes, and custom attributes. Ingestion is pre-compression and does not include dropped events. Sampling data before storage reduces both ingestion and storage usage.

Storage

Storage is measured in GB-month using the maximum amount of queryable data stored each day:

GB-month = sum of each day's maximum queryable GB / 30

For example, 1 GB that remains queryable for 30 days contributes 1 GB-month. Data stops contributing to storage usage when it is no longer queryable.

Example

Suppose a Paid account uses 75 GB of ingestion and 20 GB-month of storage during one billing cycle:

Usage	Calculation	Additional charge
Ingestion	(75 GB - 50 GB included) x $0.25	$6.25
Storage	(20 GB-month - 10 GB-month included) x $0.10	$1.00
Total	$6.25 + $1.00	$7.25

Longer retention

Logs and traces in the shared allowance have a default seven-day retention. Log Explorer datasets include 30-day retention. Cloudflare plans to add configurable 30, 90, and 365-day retention periods in the future.

Existing customers

Existing Workers Observability customers on Free, Pro, and Business plans automatically move to this pricing on December 1, 2026. Ingestion charges apply only to data received on or after that date. Enterprise accounts move at contract renewal.

For Paid accounts, data retained on December 1 begins contributing to storage usage from that date. Usage before December 1 is not charged retroactively.

Log Explorer (Legacy)

Log Explorer datasets preserve complete event fidelity and use a different ingestion price point. Their usage does not consume the pooled allowances in Plans. For usage estimates, monitoring, and deactivation, refer to Pricing and managing usage.

Ingestion	Retention	Queries
$1 per GB ingested	30 days	No additional charge

Log Explorer (Legacy) is billed on the volume of logs ingested and stored, measured in gigabytes (GB). Your charges scale with the amount of log data you choose to retain.

Unlike query-based billing models, charges are not based on how often you search or scan your data. Once logs are ingested and stored, you can query them without additional cost.

Availability

Log Explorer is available as a paid add-on for any Application Services or Zero Trust purchase. There is no free version or trial available at this time.

Billable usage

Billing is strictly consumption-based, calculated by the GBs ingested and stored.

Attack traffic

Because these datasets are used for forensics, attack traffic is considered valuable data for analysis and is included in your billable usage.

Note

Logs generated from Layer 7 (L7) DDoS attack traffic are not ingested by default and do not count toward your usage.

Estimate usage

To estimate your usage, review your request volumes in Analytics for specific Cloudflare log datasets.

Record size by dataset

The following table provides average and maximum record sizes for each dataset to help you estimate potential storage needs:

Dataset	Average Record Size	Maximum Record Size
audit_logs	2.69 kB	172 kB
email_security_alerts	6.74 kB	74.9 kB
firewall_events	1.36 kB	47.2 kB
audit_logs_v2	1.73 kB	28.5 kB
zaraz_events	7.30 kB	11.7 kB
http_requests	1.56 kB	9.76 kB
gateway_dns	1.44 kB	6.23 kB
dex_application_tests	3.29 kB	5.67 kB
casb_findings	2.67 kB	3.80 kB
gateway_http	1.47 kB	2.60 kB
dex_device_state_events	1.98 kB	2.57 kB
page_shield_events	443 B	2.02 kB
network_analytics_logs	1.31 kB	1.87 kB
zero_trust_network_sessions	1.21 kB	1.52 kB
gateway_network	877 B	1.17 kB
device_posture_results	730 B	944 B
spectrum_events	685 B	925 B
sinkhole_http_logs	705 B	705 B
access_requests	446 B	541 B
dns_firewall_logs	387 B	469 B
dns_logs	199 B	409 B
magic_ids_detections	334 B	349 B
warp_toggle_changes	327 B	335 B
ipsec_logs	207 B	260 B
nel_reports	204 B	224 B

Monitor usage

Cloudflare provides three primary ways to track your consumption and maintain financial oversight:

• In-product quick indicator: View your current month's usage at the top of the Log Search and Manage Datasets sections.
• Account-level billing: Access a detailed view of current and previous months' cumulative usage under Manage Account > Billing.
• Usage alerts: Set up automated notifications to trigger when billable usage exceeds a defined threshold.

Configure a usage alert

1. Log in to the Cloudflare dashboard ↗︎ and select Manage account.
2. Go to Notifications > Add.
3. Select Usage-based Billing.
4. Define your threshold and the notification destination (email, PagerDuty, or webhooks).

Deactivate Log Explorer

To stop using Log Explorer and end associated charges, you must complete both of the following steps:

1. Stop log ingestion

Disabling datasets stops additional ingestion charges immediately.

1. Go to the Manage datasets ↗︎ page at the account level.
2. Use the toggle to turn off each dataset you no longer need.
3. Select Stop ingesting logs to confirm.

2. Cancel the subscription

This prevents the subscription from renewing at the next billing cycle.

1. Go to the Billing ↗︎ page.
2. In the Subscriptions tab, find the Log Explorer subscription and select Cancel.