--- description: Find Cloudflare tools for observability data and workflows. title: Cloudflare Observability image: https://developers.cloudflare.com/observability/og.png?v=b5017507340d020f --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/observability/llms.txt > Use this file to discover all available pages before exploring further. # Cloudflare Observability Last updated Oct 15, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/observability/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Cloudflare provides observability tools across its network and developer products. Use this page to find the documentation for your task. ## Explore observability tools [Investigate logs](https://developers.cloudflare.com/observability/logs/) Store and investigate Workers and Cloudflare service logs. Explore logs [Trace a request](https://developers.cloudflare.com/observability/traces/) See how a request moves through Cloudflare and your Workers, and where time is spent. Explore traces [Monitor errors](https://developers.cloudflare.com/workers/observability/issues/) Group recurring Workers failures into issues and route them to your team. Explore Workers Issues [Analyze trends](https://developers.cloudflare.com/analytics/) Analyze traffic, security, performance, and product data. Explore analytics [Create alerts](https://developers.cloudflare.com/notifications/) Configure alerts and where they are delivered. Explore alerts [Export telemetry](https://developers.cloudflare.com/observability/export/) Send logs and Workers telemetry to external destinations. Explore export options [Build dashboards](https://developers.cloudflare.com/analytics/custom-dashboards/) Build charts from supported Analytics datasets and Log Explorer datasets. Explore dashboards ## Pricing and availability ### [Observability pricing](https://developers.cloudflare.com/observability/pricing/) Review ingestion and storage pricing for logs and traces. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"WebPage","@id":"https://developers.cloudflare.com/observability/#page","headline":"Cloudflare Observability","description":"Find Cloudflare tools for observability data and workflows.","url":"https://developers.cloudflare.com/observability/","inLanguage":"en","image":"https://developers.cloudflare.com/observability/og.png?v=b5017507340d020f","dateModified":"2026-10-15","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Query and visualize logs from supported Cloudflare products. title: Logs image: https://developers.cloudflare.com/observability/logs/og.png?v=4631949cc5d8bb0c --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/observability/llms.txt > Use this file to discover all available pages before exploring further. # Logs Last updated Oct 2, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/observability/logs/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Use Logs to query structured events from supported Cloudflare products and services. Filter by time range and field values, then chart or inspect matching events. You can use Logs to: - Inspect HTTP requests and security actions - Debug errors in [Workers](https://developers.cloudflare.com/workers/) and [Containers](https://developers.cloudflare.com/containers/) - Audit [R2](https://developers.cloudflare.com/r2/) bucket access and operations - Investigate [AI Gateway](https://developers.cloudflare.com/ai-gateway/) errors, latency, token usage, and costs - Query [Zero Trust](https://developers.cloudflare.com/cloudflare-one/) and network events ![Logs showing Worker query controls, outcome and duration visualizations, and a table of structured events.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2536,height=1298,format=webp/_astro/logs-workers-dashboard-overview.D6sJpjzt.png) ## Choose a dataset Open the dataset selector to search available datasets, including HTTP requests, security events, Workers, Containers, R2, AI Gateway, and Issues. For domain-scoped datasets, select one domain or all domains. Available fields and retention periods vary by dataset, and some datasets must be turned on in their source product. ![Dataset selector showing HTTP requests, Workers, Containers, R2, and Issues.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1200,height=365,format=webp/_astro/logs-dataset-selector.DicR71jE.png) ## Narrow the results Use the field browser to search field names or browse categories. To create a filter, select a field, operator, and value. You can also enter a query directly, either in the filter query language or as SQL against the selected dataset. The built-in reference covers field queries, comparison operators, functions, Boolean logic, examples, and keyboard shortcuts. To inspect one request, filter on its Ray ID. Select a preset time range, enter a relative range, or select calendar dates. Results show the returned row count and query duration. ![Logs filter builder matching requests where Path equals /.env, with the generated query and filtered chart.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2170,height=1020,format=webp/_astro/logs-filter-builder.D4R0Ozg1.png) ## Visualize results Create a visualization from a field, describe the chart you want in plain language, or configure one from scratch. Group results by one or more fields, or add, remove, and reorder custom series with separate labels, metrics, and filters. When Logs detects an anomaly in a series, select it to narrow the results to the affected time range and investigate. Available chart types include: - **Single value:** Stat and Percentage - **Time series:** Timeseries, Bar Chart, and Stacked Area - **Categories:** Categorical Bar, Horizontal Bar, Vertical Bar, Doughnut Chart, and Top List - **Geospatial and flow:** Choropleth Country Map, Proportional Symbol Map, and Sankey Diagram - **Tabular data:** Table Use automatic interval selection or select an interval from one minute to one day. Resize the visualization area, duplicate or remove a chart, and add the chart to a [custom dashboard](https://developers.cloudflare.com/analytics/custom-dashboards/). ![Logs visualizations showing Worker invocation outcomes, error outcomes, latency, and an empty chart ready to configure.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2414,height=1402,format=webp/_astro/logs-visualization-builder.DigfiOXH.png) Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"WebPage","@id":"https://developers.cloudflare.com/observability/logs/#page","headline":"Logs","description":"Query and visualize logs from supported Cloudflare products.","url":"https://developers.cloudflare.com/observability/logs/","inLanguage":"en","image":"https://developers.cloudflare.com/observability/logs/og.png?v=4631949cc5d8bb0c","dateModified":"2026-10-02","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Review scope, size, and retention for supported Logs datasets. title: Datasets image: https://developers.cloudflare.com/observability/logs/datasets/og.png?v=d09fd91e35ee57db --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/observability/llms.txt > Use this file to discover all available pages before exploring further. # Datasets Last updated Oct 15, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/observability/logs/datasets/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Cloudflare Observability supports logs from the products listed in the table. Turn on each dataset in the location shown under **Enablement**. [Log Explorer (Legacy)](https://developers.cloudflare.com/observability/logs/log-explorer/) datasets appear in Logs once your account has the Log Explorer add-on and the dataset is turned on. Event sizes are estimates and vary by record. You can also query [sampled analytics datasets](#sampled-analytics-datasets) for your zones in Logs without turning anything on. ## Supported datasets | Dataset | Identifier | Enablement | Average event size | Default retention | | --- | --- | --- | --- | --- | | [Workers](https://developers.cloudflare.com/workers/observability/logs/workers-logs/) | `workers` | [On Worker](https://developers.cloudflare.com/workers/observability/logs/workers-logs/#enable-workers-logs) | 4.84 KB | 7 days | | [Containers](https://developers.cloudflare.com/containers/faq/#how-do-container-logs-work) | `containers` | [On Worker](https://developers.cloudflare.com/containers/faq/#how-do-container-logs-work) | 1.88 KB | 7 days | | [R2 Data Access Logs](https://developers.cloudflare.com/r2/buckets/data-access-logs/) | `r2` | [On Bucket](https://developers.cloudflare.com/r2/buckets/data-access-logs/#turn-on-data-access-logs) | 1.55 KB | 7 days | | [AI Gateway](https://developers.cloudflare.com/ai-gateway/observability/logging/) | `ai-gateway` | [On Gateway](https://developers.cloudflare.com/ai-gateway/observability/logging/) | 2 KB | 7 days | | [Issues](https://developers.cloudflare.com/workers/observability/issues/) | `real-time-issues` | [On Worker](https://developers.cloudflare.com/workers/observability/issues/) | 2.64 KB | 7 days | | [HTTP Requests](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/zone/http_requests/) | `http_requests` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 1.56 KB | 30 days | | [Firewall Events](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/zone/firewall_events/) | `firewall_events` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 1.36 KB | 30 days | | [Access Requests](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/access_requests/) | `access_requests` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 446 B | 30 days | | [Audit Logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/audit_logs/) | `audit_logs` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 2.69 KB | 30 days | | [Audit Logs v2](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/audit_logs_v2/) | `audit_logs_v2` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 1.73 KB | 30 days | | [Browser Isolation User Actions](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/biso_user_actions/) | `biso_user_actions` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | Not published | 30 days | | [CASB Findings](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/casb_findings/) | `casb_findings` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 2.67 KB | 30 days | | [DEX Application Tests](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/dex_application_tests/) | `dex_application_tests` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 3.29 KB | 30 days | | [DEX Device State Events](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/dex_device_state_events/) | `dex_device_state_events` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 1.98 KB | 30 days | | [Device Posture Results](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/device_posture_results/) | `device_posture_results` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 730 B | 30 days | | [DNS Firewall Logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/dns_firewall_logs/) | `dns_firewall_logs` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 387 B | 30 days | | [DNS Logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/zone/dns_logs/) | `dns_logs` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 199 B | 30 days | | [Email Security Alerts](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/email_security_alerts/) | `email_security_alerts` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 6.74 KB | 30 days | | [Gateway DNS](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/gateway_dns/) | `gateway_dns` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 1.44 KB | 30 days | | [Gateway HTTP](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/gateway_http/) | `gateway_http` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 1.47 KB | 30 days | | [Gateway Network](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/gateway_network/) | `gateway_network` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 877 B | 30 days | | [IPsec Logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/ipsec_logs/) | `ipsec_logs` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 207 B | 30 days | | [Magic BGP Logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/magic_bgp_logs/) | `magic_bgp_logs` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | Not published | 30 days | | [Magic IDS Detections](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/magic_ids_detections/) | `magic_ids_detections` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 334 B | 30 days | | [NEL Reports](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/zone/nel_reports/) | `nel_reports` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 204 B | 30 days | | [Network Analytics](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/network_analytics_logs/) | `network_analytics_logs` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 1.31 KB | 30 days | | [Page Shield Events](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/zone/page_shield_events/) | `page_shield_events` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 443 B | 30 days | | [Sinkhole HTTP Logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/sinkhole_http_logs/) | `sinkhole_http_logs` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 705 B | 30 days | | [Spectrum Events](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/zone/spectrum_events/) | `spectrum_events` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 685 B | 30 days | | [WARP Toggle Changes](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/warp_toggle_changes/) | `warp_toggle_changes` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 327 B | 30 days | | [Zaraz Events](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/zone/zaraz_events/) | `zaraz_events` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 7.30 KB | 30 days | | [Zero Trust Network Session Logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions/) | `zero_trust_network_sessions` | [On Account](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer) | 1.21 KB | 30 days | ## Sampled analytics datasets Logs also lists HTTP requests and firewall events from the [GraphQL Analytics API](https://developers.cloudflare.com/analytics/graphql-api/). These datasets need no enablement and have no additional charge. The following sampled analytics datasets are available: | Dataset | GraphQL dataset | Availability | Retention | | --- | --- | --- | --- | | HTTP requests | `httpRequestsAdaptive` | All plans | At least 31 days | | Firewall events | `firewallEventsAdaptive` | Pro, Business, and Enterprise | At least 31 days | These datasets use [adaptive sampling](https://developers.cloudflare.com/analytics/graphql-api/sampling/). Results can omit individual events, and counts can be estimates. Available fields, exact retention, and how far back charts reach depend on your plan. Refer to [GraphQL Analytics API limits](https://developers.cloudflare.com/analytics/graphql-api/limits/) for details. To query these datasets for a zone, you need the Zone Analytics Read permission for that zone. Account administrators can grant it on the **Members** page. [Go to **Members** ↗](https://dash.cloudflare.com/?to=/:account/members) For unsampled HTTP requests and firewall events, turn them on in [Log Explorer](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#enable-log-explorer). They need the paid Log Explorer add-on. Refer to [Pricing](#pricing) for the Log Explorer price. ## Pricing Beginning December 1, 2026, all Cloudflare logs and traces will use the same pricing model. Log Explorer datasets have a different price point of $1 per GB ingested and include 30-day retention. Queries, dashboards, alerts, and analytics do not incur additional charge. ### Included in the new Observability pricing The following logs and traces share account-level ingestion and storage allowances: - [Cloudflare Traces](https://developers.cloudflare.com/observability/traces/) - [Workers Logs](https://developers.cloudflare.com/workers/observability/logs/workers-logs/) - [Workers Traces](https://developers.cloudflare.com/workers/observability/traces/) - [Containers logs](https://developers.cloudflare.com/containers/faq/#how-do-container-logs-work) - [R2 Data Access Logs](https://developers.cloudflare.com/r2/buckets/data-access-logs/) - [AI Gateway logs](https://developers.cloudflare.com/ai-gateway/observability/logging/) - [Issues](https://developers.cloudflare.com/workers/observability/issues/) Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/observability/logs/datasets/#page","headline":"Datasets","description":"Review scope, size, and retention for supported Logs datasets.","url":"https://developers.cloudflare.com/observability/logs/datasets/","inLanguage":"en","image":"https://developers.cloudflare.com/observability/logs/datasets/og.png?v=d09fd91e35ee57db","dateModified":"2026-10-15","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Store and explore Cloudflare logs in the dashboard. title: Log Explorer (Legacy) image: https://developers.cloudflare.com/observability/logs/log-explorer/og.png?v=7bb59558ed9b4b08 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/observability/llms.txt > Use this file to discover all available pages before exploring further. # Log Explorer (Legacy) Last updated Oct 15, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/observability/logs/log-explorer/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Store and explore your Cloudflare logs directly within the Cloudflare dashboard or API. Log Explorer (Legacy) lets security teams and developers analyze, investigate, and monitor issues directly from the Cloudflare dashboard, without the expense and complexity of forwarding logs to third-party tools. Log Explorer is labeled Legacy because it is being merged into [Observability Logs](https://developers.cloudflare.com/observability/logs/). Your datasets, subscription, and API access continue to work. Log Explorer provides access to Cloudflare logs with all the context available within the Cloudflare platform. You can monitor security and performance issues with custom dashboards or investigate and troubleshoot issues with log search. Benefits include: - **Reduced cost and complexity**: Drastically reduce the expense and operational overhead associated with forwarding, storing, and analyzing terabytes of log data in external tools. - **Faster detection and triage**: Access Cloudflare-native logs directly, eliminating cumbersome data pipelines and the ingest lags that delay critical security insights. - **Accelerated investigations with full context**: Investigate incidents with Cloudflare's unparalleled contextual data, accelerating your analysis and understanding of "What exactly happened?" and "How did it happen?" - **Minimal recovery time**: Seamlessly transition from investigation to action with direct mitigation capabilities via the Cloudflare platform. Contract customers can choose to store their logs in Log Explorer for up to two years, at an additional cost of $0.10 per GB per month. Customers interested in this feature can contact their account team to have it added to their contract. ## Permissions Access to Log Explorer depends on how you connect. Account members need a [member role](https://developers.cloudflare.com/fundamentals/manage-members/roles/), and API tokens need an [API token permission](https://developers.cloudflare.com/fundamentals/api/reference/permissions/). The token permissions are not member roles and do not appear in the role picker. | Feature | Member role | API token permission | Description | | --- | --- | --- | --- | | **Log Search** | Log Share Reader (Log Share and Administrator Read Only also work) | `Logs Read` | Query logs in the dashboard or via API. | | **Log Search (save query)** | Super Administrator or Administrator | `Logs Edit` | Save, edit, or delete log search queries. | | **Manage datasets** | Super Administrator or Administrator | `Logs Edit` | Add, enable, or disable datasets. | | **Custom dashboards** | Analytics | `Analytics Read` | Create and view custom dashboards. | The API lists `Logs Edit` as `Logs Write`. They are the same permission. Grant roles and permissions at the account level to query account-level datasets. A role assigned to specific zones only covers that zone's datasets. For zone-level datasets and saved queries, Log Share can also make changes. Some datasets need an additional member role: - Zero Trust datasets, such as Gateway and DEX, need Cloudflare Zero Trust PII. - Audit log datasets need Audit Logs Viewer. Authentication with the API can be done via an API token or API key with an email. Refer to [Create API token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/) for further instructions. ## Features [Log Search](https://developers.cloudflare.com/observability/logs/log-explorer/log-search/) Explore your Cloudflare logs from the [Logs](https://developers.cloudflare.com/observability/logs/) page under Observability in the Cloudflare dashboard, or via the [API](https://developers.cloudflare.com/observability/logs/log-explorer/api/). Use Log Search [Custom dashboards](https://developers.cloudflare.com/analytics/custom-dashboards/) Design customized views for tracking application security, performance, and usage metrics. Use Custom dashboards [Manage datasets](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/) Choose which datasets to store in Log Explorer. Use Manage datasets [API](https://developers.cloudflare.com/observability/logs/log-explorer/api/) Manage configuration and perform queries via the API. Use API ## Related products [Logpush](https://developers.cloudflare.com/logs/) Forward Cloudflare logs to third-party tools for debugging, identifying configuration adjustments, and creating analytics dashboards. [Analytics](https://developers.cloudflare.com/analytics/) Visualize the metadata collected by our products in the Cloudflare dashboard. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"WebPage","@id":"https://developers.cloudflare.com/observability/logs/log-explorer/#page","headline":"Log Explorer (Legacy)","description":"Store and explore Cloudflare logs in the dashboard.","url":"https://developers.cloudflare.com/observability/logs/log-explorer/","inLanguage":"en","image":"https://developers.cloudflare.com/observability/logs/log-explorer/og.png?v=7bb59558ed9b4b08","dateModified":"2026-10-15","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Query and configure Log Explorer via the API. title: Log Explorer API image: https://developers.cloudflare.com/observability/logs/log-explorer/api/og.png?v=8c4c19f1b2404d62 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/observability/llms.txt > Use this file to discover all available pages before exploring further. # Log Explorer API Last updated Oct 15, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/observability/logs/log-explorer/api/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Configuration and Log searches are also available via a public API. ## Authentication Authentication with the API can be done via an API token or API key with an email. Refer to [Create API token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/) for further instructions. For detailed information on permissions required for each feature, refer to the [Permissions](https://developers.cloudflare.com/observability/logs/log-explorer/#permissions) section. ## Query data Log Explorer includes a SQL API for submitting queries. For example, to find an HTTP request with a specific [Ray ID](https://developers.cloudflare.com/fundamentals/reference/cloudflare-ray-id/), use the following SQL query: ```bash curl https://api.cloudflare.com/client/v4/zones/{zone_id}/logs/explorer/query/sql \ --header "Authorization: Bearer " \ --url-query query="SELECT clientRequestScheme, clientRequestHost, clientRequestMethod, edgeResponseStatus, clientRequestUserAgent FROM http_requests WHERE RayID = '806c30a3cec56817' LIMIT 1" ``` This command returns the following HTTP request details: ```json { "result": [ { "clientrequestscheme": "https", "clientrequesthost": "example.com", "clientrequestmethod": "GET", "clientrequestuseragent": "curl/7.88.1", "edgeresponsestatus": 200 } ], "success": true, "errors": [], "messages": [] } ``` As another example, you could find Cloudflare Access requests with selected columns from a specific timeframe by performing the following SQL query: ```bash curl https://api.cloudflare.com/client/v4/accounts/{account_id}/logs/explorer/query/sql \ --header "Authorization: Bearer " \ --url-query query="SELECT CreatedAt, AppDomain, AppUUID, Action, Allowed, Country, RayID, Email, IPAddress, UserUID FROM access_requests WHERE Date >= '2025-02-06' AND Date <= '2025-02-06' AND CreatedAt >= '2025-02-06T12:28:39Z' AND CreatedAt <= '2025-02-06T12:58:39Z'" ``` This command returns the following request details: ```json { "result": [ { "createdat": "2025-01-14T18:17:55Z", "appdomain": "example.com", "appuuid": "a66b4ab0-ccdf-4d60-a6d0-54a59a827d92", "action": "login", "allowed": true, "country": "us", "rayid": "90fbb07c0b316957", "email": "user@example.com", "ipaddress": "1.2.3.4", "useruid": "52859e81-711e-4de0-8b31-283336060e79" } ], "success": true, "errors": [], "messages": [] } ``` Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/observability/logs/log-explorer/api/#page","headline":"Log Explorer API","description":"Query and configure Log Explorer via the API.","url":"https://developers.cloudflare.com/observability/logs/log-explorer/api/","inLanguage":"en","image":"https://developers.cloudflare.com/observability/logs/log-explorer/api/og.png?v=8c4c19f1b2404d62","dateModified":"2026-10-15","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: View recent changes to Cloudflare Logs. title: Changelog image: https://developers.cloudflare.com/observability/logs/log-explorer/changelog/og.png?v=8bc4946606370755 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/observability/llms.txt > Use this file to discover all available pages before exploring further. # Changelog Last updated Oct 15, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/observability/logs/log-explorer/changelog/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) [Subscribe to RSS](https://developers.cloudflare.com/changelog/rss/log-explorer.xml) ## 2026-10-07 **Query Log Explorer datasets from Observability Logs** Log Explorer datasets are now queried from the [Logs](https://developers.cloudflare.com/observability/logs/) page under **Observability** in the Cloudflare dashboard. The Logs page brings Log Explorer and Workers Observability datasets together with a shared filter builder, SQL editor, and visualizations. As part of this change, the **Log Explorer** menu is no longer shown in the dashboard navigation. - Your enabled datasets, saved queries, and SQL queries continue to work on the Logs page. - To manage datasets, open the dataset selector on the Logs page and select **Configure** next to the Log Explorer datasets. - The previous Log Search page remains available at its direct URL. For more information, refer to [Log Search](https://developers.cloudflare.com/observability/logs/log-explorer/log-search/) and the [Logs overview](https://developers.cloudflare.com/observability/logs/). ## 2026-08-28 **Improved dataset configuration in Log Explorer** Log Explorer has a refreshed dataset configuration experience in the Cloudflare dashboard. The new controls make it easier to choose which fields and events Log Explorer ingests. - **Grouped field selection** organizes fields by category and shows the number selected in each group. - **Field details** identify each field's data type and mark required or deprecated fields. - **Bulk controls** let you select all fields or reset the selection to the dataset defaults. - **Ingestion filters** let you ingest all events or only events that match your conditions. These controls are available when you add a dataset or select **Actions** > **Edit** for an enabled dataset. For more information, refer to [Configure fields and filters](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#configure-fields-and-filters). ## 2026-08-26 **Delete Log Explorer datasets** Cloudflare Log Explorer customers can now permanently delete account and zone datasets from the Cloudflare dashboard or API. Deletion protection is enabled by default to prevent accidental data loss. In the dashboard, go to [Manage datasets](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/), disable deletion protection for the dataset, select **Delete**, and enter the dataset name to confirm. To delete a dataset through the API, first set `deletion_protection` to `false` with the [Update an account or zone dataset](https://developers.cloudflare.com/api/resources/logs/subresources/log_explorer/subresources/datasets/methods/update/) method. Then use the [Delete an account or zone dataset](https://developers.cloudflare.com/api/resources/logs/subresources/log_explorer/subresources/datasets/methods/delete/) method. Dataset deletion is irreversible and runs asynchronously. You cannot recreate the same dataset while deletion is in progress. ## 2026-08-20 **Per-zone post-quantum visibility in Logpush and Log Explorer** [Cloudflare Radar ↗︎](https://radar.cloudflare.com/post-quantum) publishes global statistics on post-quantum key agreement adoption across all Cloudflare traffic, but until now customers had no way to see the same measurement scoped to their own zones. This is now possible because the [`http_requests`](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/zone/http_requests/) Logpush dataset — also queryable in [Log Explorer](https://developers.cloudflare.com/observability/logs/log-explorer/) — includes a new `ClientTLSKeyExchangeGroup` field. The field reports the TLS key exchange group negotiated on the client-to-Cloudflare connection, by group name. Post-quantum connections appear as `X25519MLKEM768`, and classical connections appear as `X25519`, `P-256`, or another named group. A value of `UNK` means the group could not be determined, and `NONE` means either RSA key exchange was used or TLS was not used. With this field, you can build per-zone reports showing what percentage of your inbound HTTPS traffic is protected by post-quantum key agreement, break the number down by hostname, path, user agent, or country, and push the data into your SIEM via any [Logpush destination](https://developers.cloudflare.com/logs/logpush/logpush-job/enable-destinations/). ## 2026-04-22 **Custom dashboards available to all customers** Custom Dashboards are now available to all Cloudflare customers. Build personalized views that highlight the metrics most critical to your infrastructure and security posture, moving beyond standard product dashboards. This update significantly expands the data available for visualization. Build charts based on any of the **100+ datasets** available via the Cloudflare GraphQL API, covering everything from WAF events and Workers metrics to Load Balancing and Zero Trust logs. #### Log Explorer integration Log Explorer customers can select Log Explorer datasets to create charts from raw, unsampled log data. #### Key benefits - **Unified visibility**: Consolidate signals from different Cloudflare products (for example, HTTP Traffic and R2 Storage) into a single view. - **Flexible monitoring**: Create charts that focus on specific status codes, ASN regions, or security actions that matter to your business. - **Expanded limits**: Log Explorer customers can create up to **100 dashboards** (up from 25 for standard customers). ![Custom Dashboards home page showing dashboard list and chart previews](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1079,height=793,format=webp/_astro/customdashboardshome.BIpSvImM.jpg) To get started, refer to the [Custom Dashboards documentation](https://developers.cloudflare.com/analytics/custom-dashboards/). ## 2026-03-11 **Ingest field selection for Log Explorer** Cloudflare Log Explorer now allows you to customize exactly which data fields are ingested and stored when enabling or managing log datasets. Previously, ingesting logs often meant taking an "all or nothing" approach to data fields. With **Ingest Field Selection**, you can now choose from a list of available and recommended fields for each dataset. This allows you to reduce noise, focus on the metrics that matter most to your security and performance analysis, and manage your data footprint more effectively. #### Key capabilities - **Granular control:** Select only the specific fields you need when enabling a new dataset. - **Dynamic updates:** Update fields for existing, already enabled logstreams at any time. - **Historical consistency:** Even if you disable a field later, you can still query and receive results for that field for the period it was captured. - **Data integrity:** Core fields, such as `Timestamp`, are automatically retained to ensure your logs remain searchable and chronologically accurate. #### Example configuration When configuring a dataset via the dashboard or API, you can define a specific set of fields. The `Timestamp` field remains mandatory to ensure data indexability. ```json { "dataset": "firewall_events", "enabled": true, "fields": [ "Timestamp", "ClientRequestHost", "ClientIP", "Action", "EdgeResponseStatus", "OriginResponseStatus" ] } ``` For more information, refer to the [Log Explorer documentation](https://developers.cloudflare.com/observability/logs/log-explorer/). ## 2026-02-09 **Tabs and pivots** Log Explorer now supports multiple concurrent queries with the new Tabs feature. Work with multiple queries simultaneously and pivot between datasets to investigate malicious activity more effectively. #### Key capabilities - **Multiple tabs:** Open and switch between multiple query tabs to compare results across different datasets. - **Quick filtering:** Select the filter button from query results to add a value as a filter to your current query. - **Pivot to new tab:** Use Cmd + click on the filter button to start a new query tab with that filter applied. - **Preserved progress:** Your query progress is preserved on each tab if you navigate away and return. For more information, refer to the [Log Explorer documentation](https://developers.cloudflare.com/observability/logs/log-explorer/). ## 2025-11-13 **Fixed custom SQL date picker inconsistencies** We've resolved a bug in Log Explorer that caused inconsistencies between the custom SQL date field filters and the date picker dropdown. Previously, users attempting to filter logs based on a custom date field via a SQL query sometimes encountered unexpected results or mismatching dates when using the interactive date picker. This fix ensures that the custom SQL date field filters now align correctly with the selection made in the date picker dropdown, providing a reliable and predictable filtering experience for your log data. This is particularly important for users creating custom log views based on time-sensitive fields. ## 2025-11-13 **Log Explorer adds 14 new datasets** We've significantly enhanced Log Explorer by adding support for 14 additional Cloudflare product datasets. This expansion enables Operations and Security Engineers to gain deeper visibility and telemetry across a wider range of Cloudflare services. By integrating these new datasets, users can now access full context to efficiently investigate security incidents, troubleshoot application performance issues, and correlate logged events across different layers (like application and network) within a single interface. This capability is crucial for a complete and cohesive understanding of event flows across your Cloudflare environment. The newly supported datasets include: #### Zone Level - `Dns_logs` - `Nel_reports` - `Page_shield_events` - `Spectrum_events` - `Zaraz_events` #### Account Level - `Audit Logs` - `Audit_logs_v2` - `Biso_user_actions` - `DNS firewall logs` - `Email_security_alerts` - `Magic Firewall IDS` - `Network Analytics` - `Sinkhole HTTP` - `ipsec_logs` Note `Auditlog` and `Auditlog_v2` datasets require `audit-log.read` permission for querying. The `biso_user_actions` dataset requires either the `Super Admin` or `ZT PII` role for querying. #### Example: Correlating logs You can now use Log Explorer to query and filter with each of these datasets. For example, you can identify an IP address exhibiting suspicious behavior in the `FW_event` logs, and then instantly pivot to the `Network Analytics` logs or `Access` logs to see its network-level traffic profile or if it bypassed a corporate policy. To learn more and get started, refer to the [Log Explorer documentation](https://developers.cloudflare.com/observability/logs/log-explorer/) and the [Cloudflare Logs documentation](https://developers.cloudflare.com/logs/). ## 2025-11-11 **Resize your custom SQL window in Log Explorer** We're excited to announce a quality-of-life improvement for Log Explorer users. You can now resize the custom SQL query window to accommodate longer and more complex queries. Previously, if you were writing a long custom SQL query, the fixed-size window required excessive scrolling to view the full query. This update allows you to easily drag the bottom edge of the query window to make it taller. This means you can view your entire custom query at once, improving the efficiency and experience of writing and debugging complex queries. To learn more and get started, refer to the [Log Explorer documentation](https://developers.cloudflare.com/observability/logs/log-explorer/). ## 2025-11-04 **Log Explorer now supports query cancellation** We're excited to announce that Log Explorer users can now cancel queries that are currently running. This new feature addresses a common pain point: waiting for a long, unintended, or misconfigured query to complete before you can submit a new, correct one. With query cancellation, you can immediately stop the execution of any undesirable query, allowing you to quickly craft and submit a new query, significantly improving your investigative workflow and productivity within Log Explorer. ## 2025-11-04 **Log Explorer now shows query result distribution** We're excited to announce a new feature in Log Explorer that significantly enhances how you analyze query results: the Query results distribution chart. This new chart provides a graphical distribution of your results over the time window of the query. Immediately after running a query, you will see the distribution chart above your result table. This visualization allows Log Explorer users to quickly spot trends, identify anomalies, and understand the temporal concentration of log events that match their criteria. For example, you can visually confirm if a spike in traffic or errors occurred at a specific time, allowing you to focus your investigation efforts more effectively. This feature makes it faster and easier to extract meaningful insights from your vast log data. The chart will dynamically update to reflect the logs matching your current query. ## 2025-09-11 **Contextual pivots** Directly from [Log Search](https://developers.cloudflare.com/observability/logs/log-explorer/log-search/) results, customers can pivot to other parts of the Cloudflare dashboard to immediately take action as a result of their investigation. From the `http_requests` or `fw_events` dataset results, right click on an IP Address or JA3 Fingerprint to pivot to the Investigate portal to lookup the reputation of an IP address or JA3 fingerprint. ![Investigate IP address](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1038,height=486,format=webp/_astro/investigate-ip-address.BMVSMzDi.png) Easily learn about error codes by linking directly to our documentation from the **EdgeResponseStatus** or **OriginResponseStatus** fields. ![View documentation](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1186,height=476,format=webp/_astro/view-documentation.Cem5QgeO.png) From the `gateway_http` dataset, click on a **policyid** to link directly to the Zero Trust dashboard to review or make changes to a specific Gateway policy. ![View policy](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1274,height=498,format=webp/_astro/policyid.CVjEdahj.png) ## 2025-09-11 **New results table view** The results table view of **Log Search** has been updated with additional functionality and a more streamlined user experience. Users can now easily: - Remove/add columns. - Resize columns. - Sort columns. - Copy values from any field. ![New results table view](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1786,height=342,format=webp/_astro/new-table.C2Q8mWJ9.png) ## 2025-09-03 **Logging headers and cookies using custom fields** [Log Explorer](https://developers.cloudflare.com/observability/logs/log-explorer/) now supports logging and filtering on header or cookie fields in the [`http_requests` dataset](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/zone/http_requests/). Create a custom field to log desired header or cookie values into the `http_requests` dataset and Log Explorer will import these as searchable fields. Once configured, use the custom SQL editor in Log Explorer to view or filter on these requests. ![Edit Custom fields](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1790,height=404,format=webp/_astro/edit-custom-fields.Cy4qXSpL.png) For more details, refer to [Headers and cookies](https://developers.cloudflare.com/observability/logs/log-explorer/log-search/#headers-and-cookies). ## 2025-08-15 **Extended retention** Customers can now rely on Log Explorer to meet their log retention compliance requirements. Contract customers can choose to store their logs in Log Explorer for up to two years, at an additional cost of $0.10 per GB per month. Customers interested in this feature can contact their account team to have it added to their contract. ## 2025-07-09 **Usage tracking** [Log Explorer](https://developers.cloudflare.com/observability/logs/log-explorer/) customers can now monitor their data ingestion volume to keep track of their billing. Monthly usage is displayed at the top of the [Log Search](https://developers.cloudflare.com/observability/logs/log-explorer/log-search/) and [Manage Datasets](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/) screens in Log Explorer. ![Ingested data](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=418,height=157,format=webp/_astro/ingested-data.D2flqRIu.png) ## 2025-06-18 **Log Explorer is GA** [Log Explorer](https://developers.cloudflare.com/observability/logs/log-explorer/) is now GA, providing native observability and forensics for traffic flowing through Cloudflare. Search and analyze your logs, natively in the Cloudflare dashboard. These logs are also stored in Cloudflare's network, eliminating many of the costs associated with other log providers. ![Log Explorer dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=512,height=208,format=webp/_astro/log-explorer-dash.CJSVLZ7Y.png) With Log Explorer, you can now: - **Monitor security and performance issues with custom dashboards** – use natural language to define charts for measuring response time, error rates, top statistics and more. - **Investigate and troubleshoot issues with Log Search** – use data type-aware search filters or custom sql to investigate detailed logs. - **Save time and collaborate with saved queries** – save Log Search queries for repeated use or sharing with other users in your account. - **Access Log Explorer at the account and zone level** – easily find Log Explorer at the account and zone level for querying any dataset. For help getting started, refer to [our documentation](https://developers.cloudflare.com/observability/logs/log-explorer/). Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"BlogPosting","@id":"https://developers.cloudflare.com/observability/logs/log-explorer/changelog/#page","headline":"Changelog","description":"View recent changes to Cloudflare Logs.","url":"https://developers.cloudflare.com/observability/logs/log-explorer/changelog/","inLanguage":"en","image":"https://developers.cloudflare.com/observability/logs/log-explorer/changelog/og.png?v=8bc4946606370755","dateModified":"2026-10-15","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: SQL queries for traffic, security, and performance analysis. title: Example SQL queries image: https://developers.cloudflare.com/observability/logs/log-explorer/example-queries/og.png?v=d3e9aa9397950f66 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/observability/llms.txt > Use this file to discover all available pages before exploring further. # Example SQL queries Last updated Oct 15, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/observability/logs/log-explorer/example-queries/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) The following examples show practical SQL queries you can use with the `http_requests` dataset in Log Explorer. For the full list of supported SQL syntax, refer to [SQL queries supported](https://developers.cloudflare.com/observability/logs/log-explorer/sql-queries/). Adjust the date ranges in each example to match the time period you want to query. ## Summarize CDN usage Get a high-level summary of total requests and data transfer for a specific time period. Results include total bytes transferred and conversions to megabytes and gigabytes. ```sql SELECT COUNT(*) AS total_requests, SUM(EdgeResponseBytes) AS total_data_transfer, SUM(EdgeResponseBytes) / (1024.0 * 1024.0 * 1024.0) AS total_data_transfer_gb, SUM(EdgeResponseBytes) / (1024.0 * 1024.0) AS total_data_transfer_mb FROM http_requests WHERE {{ timeFilter }} ``` ## Review distribution of security actions Understand how security actions, such as blocks and challenges, are distributed across your traffic and identify the most common security responses applied to requests. ```sql SELECT SecurityAction, COUNT(*) AS ActionCount FROM http_requests WHERE SecurityAction != 'unknown' AND SecurityAction IS NOT NULL GROUP BY SecurityAction ORDER BY ActionCount DESC ``` ## Find IPs that triggered challenges Identify the top client IP addresses and request URIs that triggered managed, JavaScript, or interactive challenges to investigate potential bot activity or targeted attacks. ```sql SELECT ClientIP, ClientRequestURI, SecurityActions, COUNT(*) AS Count FROM http_requests WHERE {{ timeFilter }} AND ( ARRAY_CONTAINS(SecurityActions, 'challenge') OR ARRAY_CONTAINS(SecurityActions, 'managedChallenge') OR ARRAY_CONTAINS(SecurityActions, 'jsChallenge') OR ARRAY_CONTAINS(SecurityActions, 'challengeSolved') ) GROUP BY ClientIP, ClientRequestURI, SecurityActions ORDER BY Count DESC LIMIT 20 ``` ## Find highest bandwidth consumers by URI Identify which request URIs consume the most bandwidth to pinpoint large assets or endpoints that drive the most data transfer. ```sql SELECT ClientRequestURI, SUM(EdgeResponseBytes) / (1024 * 1024) AS MegabytesTransferred FROM http_requests WHERE {{ timeFilter }} GROUP BY ClientRequestURI ORDER BY MegabytesTransferred DESC LIMIT 10 ``` ## Analyze client round-trip time by country Analyze client TCP round-trip time (RTT) across different countries to identify regions with high latency that might benefit from additional optimization. ```sql SELECT ClientCountry, COUNT(*) AS requests, AVG(ClientTCPRttMs) AS avg_rtt, MIN(ClientTCPRttMs) AS min_rtt, MAX(ClientTCPRttMs) AS max_rtt FROM http_requests WHERE {{ timeFilter }} GROUP BY ClientCountry ORDER BY avg_rtt DESC LIMIT 20 ``` ## Summarize CDN traffic by cache status Break down traffic by cache status and measure the average time to first byte (TTFB) for each status to evaluate cache effectiveness and identify opportunities to improve cache hit ratios. ```sql SELECT CacheCacheStatus, COUNT(*) AS requests, SUM(EdgeResponseBytes) AS total_bytes, AVG(EdgeTimeToFirstByteMs) AS avg_ttfb FROM http_requests WHERE {{ timeFilter }} GROUP BY CacheCacheStatus ORDER BY requests DESC ``` ## Find slowest paths by time to first byte Find request paths with the highest average time to first byte (TTFB), along with request counts and server error counts toidentify slow endpoints that may need optimization. ```sql SELECT ClientRequestPath, AVG(EdgeTimeToFirstByteMs) AS avg_ttfb, COUNT(*) AS requests, SUM(CASE WHEN EdgeResponseStatus >= 500 THEN 1 ELSE 0 END) AS errors FROM http_requests WHERE {{ timeFilter }} GROUP BY ClientRequestPath ORDER BY avg_ttfb DESC LIMIT 10 ``` Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/observability/logs/log-explorer/example-queries/#page","headline":"Example SQL queries","description":"SQL queries for traffic, security, and performance analysis.","url":"https://developers.cloudflare.com/observability/logs/log-explorer/example-queries/","inLanguage":"en","image":"https://developers.cloudflare.com/observability/logs/log-explorer/example-queries/og.png?v=d3e9aa9397950f66","dateModified":"2026-10-15","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Find answers to common questions about Log Explorer. title: FAQ image: https://developers.cloudflare.com/observability/logs/log-explorer/faq/og.png?v=b756f8bb3748eaa8 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/observability/llms.txt > Use this file to discover all available pages before exploring further. # FAQ Last updated Oct 15, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/observability/logs/log-explorer/faq/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) These questions cover Log Explorer (Legacy). ## Which fields (or columns) are available for querying? All fields listed in [Datasets](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/) for the [supported datasets](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#supported-datasets) can be queried. ## Why is the `MatchedRules` field empty for some requests? `MatchedRules` is populated only by security and transformation rules (WAF, Rate Limiting, Transform Rules, Snippets). Cache rules do not populate this field. If you are investigating cache behavior, use the `Cache*` fields such as `CacheCacheStatus` instead. ## Why does my query not complete or time out? Queries perform best when their parameters focus on narrower ranges of time. You may experience query timeouts when your query would return a large quantity of data. Consider refining your query to improve performance. ## Why do I not see any logs in my queries after enabling the dataset? Ingestion starts from the moment you enable the dataset. Logs for events that occurred before you enabled the dataset are not available. Make sure that new events have been generated since enabling the dataset, and check again. ## My query returned an error. How do I figure out what went wrong? We are actively working on improving error codes. If you receive a generic error, check your SQL syntax (if you are using the custom SQL feature), and make sure you have included a date and a limit. If the query still fails it is likely timing out. Try refining your filters. ## Where is the data stored? The data is stored in Cloudflare R2. Each dataset is stored on a per-customer level, similar to Cloudflare D1, ensuring that your data is kept separate from that of other customers. In the future, this single-tenant storage model will provide you with the flexibility to create your own retention policies and decide in which regions you want to store your data. ## Does Log Explorer support Customer Metadata Boundary? Customer Metadata Boundary is currently not supported for Log Explorer. ## Are there any constraints on the log volume that Log Explorer can support? We are continually scaling the Log Explorer data platform. At present, Log Explorer supports log ingestion rates of up to 50,000 records per second. If your needs exceed this, contact your account team. ## How is Log Explorer different from Logpush? Do I need both? Log Explorer lets you search and analyze your Cloudflare logs directly in the dashboard or via API. [Logpush](https://developers.cloudflare.com/logs/logpush/), on the other hand, delivers raw logs to third-party SIEMs or storage systems. You generally do not need both, but some customers choose to use these datasets for quick investigation and Logpush for long-term storage or integration with other tools. ## Is there a free version or trial of Log Explorer? Log Explorer is available as a paid add-on for any Application Services or Zero Trust purchase. There is no free version at this time. ## How is Log Explorer billed? Billing is based on the volume of logs indexed and stored, measured in gigabytes (GB). Your charges scale with the amount of log data you choose to retain. Unlike query-based billing models (for example, BigQuery), charges are not based on how often you search or scan your data. Once logs are ingested and stored, you can query them without additional cost. ## Are logs from attack traffic included in my Log Explorer usage? Yes. In general, billing is based on the total volume of logs ingested and stored, including attack traffic. Since these logs are often critical for investigating security incidents, they are treated the same as all other log data. However, logs generated from Layer 7 (L7) DDoS attack traffic are not ingested by default and therefore do not count toward your usage. ## How does Log Explorer store data in R2, and why do I not see it in my own R2 bucket? Log Explorer uses Cloudflare Logpush and R2 behind the scenes to stream and store logs. For technical and performance reasons, the data is stored in internal, customer-specific R2 buckets managed by Cloudflare. These buckets are single-tenant to keep your data isolated, but they are not visible in your account's R2 interface. You are not billed separately for this storage — it is included in your usage. ## Are Custom Dashboards based on R2 Log Explorer data, or on GraphQL? Custom Dashboards use [GraphQL](https://developers.cloudflare.com/analytics/graphql-api/sampling/) for standard analytics datasets. Customers with the Log Explorer add-on can also select Log Explorer datasets to create charts from raw, unsampled log data. This is supported on all plans and account types, with no additional enablement required. You cannot turn a saved or active query directly into a Custom Dashboard chart. For more information, refer to [Custom dashboards](https://developers.cloudflare.com/analytics/custom-dashboards/). ## How can I track my Log Explorer usage? Your monthly usage is displayed at the top of the Log Search and Manage Datasets dashboard sections. ![Usage display in the dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1078,height=380,format=webp/_astro/log-explorer-usage.CTcGXtWV.png) ## How do I turn off Log Explorer? To turn off Log Explorer you must: 1. **Stop log ingestion to immediately stop incurring additional charges.** To stop log ingestion, turn off any datasets that are on at both the account level and zone level. 2. **Cancel the Log Explorer subscription to stop renewal.** Your subscription may remain active until the end of the current billing cycle. ### 1. Stop log ingestion After performing the following steps, you will immediately stop incurring additional charges for Log Explorer. #### Review and turn off account-level datasets 1. In the Cloudflare dashboard, go to the account-level **Manage datasets** page. [Go to **Manage datasets** ↗](https://dash.cloudflare.com/?to=/:account/log-explorer/manage-sources) 2. Turn off each dataset you no longer need using the toggle. To confirm each operation, select **Stop ingesting logs**. #### Review and turn off zone-level datasets 1. In the Cloudflare dashboard, go to the zone-level **Manage datasets** page. [Go to **Manage datasets** ↗](https://dash.cloudflare.com/?to=/:account/:zone/log-explorer/manage-sources) 2. Turn off each dataset you no longer need using the toggle. To confirm each operation, select **Stop ingesting logs**. 3. Repeat for all relevant zones. ### 2. Cancel the Log Explorer subscription This operation will stop Log Explorer's renewal. 1. In the Cloudflare dashboard, go to the **Billing** page. [Go to **Billing** ↗](https://dash.cloudflare.com/?to=/:account/billing) 2. In the **Subscriptions** tab, find the Log Explorer subscription and select **Cancel**. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/observability/logs/log-explorer/faq/#page","headline":"FAQ","description":"Find answers to common questions about Log Explorer.","url":"https://developers.cloudflare.com/observability/logs/log-explorer/faq/","inLanguage":"en","image":"https://developers.cloudflare.com/observability/logs/log-explorer/faq/og.png?v=b756f8bb3748eaa8","dateModified":"2026-10-15","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Search and explore stored logs via dashboard or API. title: Log Search image: https://developers.cloudflare.com/observability/logs/log-explorer/log-search/og.png?v=ab971a803946c9f5 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/observability/llms.txt > Use this file to discover all available pages before exploring further. # Log Search Last updated Oct 15, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/observability/logs/log-explorer/log-search/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Log Explorer (Legacy) lets you store and explore your Cloudflare logs directly within the Cloudflare dashboard or API, giving you visibility into your logs without the need to forward them to third-party services. Logs are stored on Cloudflare's global network using the R2 object storage platform and can be queried via the dashboard or SQL API. Log Search is now part of Observability Logs Log Explorer datasets are queried from the [Logs](https://developers.cloudflare.com/observability/logs/) page under **Observability** in the Cloudflare dashboard. The **Log Explorer** menu is no longer shown in the dashboard navigation. Your enabled datasets, saved queries, and SQL queries continue to work on the Logs page, and the previous Log Search page remains available at its direct URL. ## When to use Log Explorer Use Log Explorer when you need to investigate what actually happened with real production traffic: - Analyzing historical data and trends - Investigating security incidents after they occur - Searching for patterns across thousands of requests - Monitoring application performance over time - Providing forensic evidence to support teams Use [Cloudflare Trace](https://developers.cloudflare.com/rules/trace-request/), shown as **Rule simulator** in the dashboard, when you need to test what would happen with a simulated request: - Understanding why a rule did not trigger as expected - Testing how your rules handle different request scenarios - Seeing the evaluation order of your rules - Simulating requests from different geolocations or conditions The key difference is that Log Explorer shows actual traffic, while Cloudflare Trace shows simulated "what-if" scenarios. Both are separate from [Cloudflare Traces](https://developers.cloudflare.com/observability/traces/), which records how real requests move through Cloudflare. ## Use Log Explorer You can filter and view your logs via the Cloudflare dashboard or the API. 1. In the Cloudflare dashboard, go to **Observability** > **Logs**. [Go to **Logs** ↗](https://dash.cloudflare.com/?to=/:account/observability/logs) 2. Open the dataset selector and choose a Log Explorer dataset, such as **HTTP requests**. For zone-scoped datasets, select one domain or all domains. 3. Select a preset or custom time range. 4. Add filters by selecting a field, an operator, and a value. To write SQL instead, select **Open SQL editor**, enter a query against the selected dataset, and select **Run query**. SQL queries are available for Log Explorer datasets only. For the filter query language, functions, and keyboard shortcuts, refer to the built-in reference on the Logs page or the [Logs overview](https://developers.cloudflare.com/observability/logs/). For example, to find an HTTP request with a specific [Ray ID](https://developers.cloudflare.com/fundamentals/reference/cloudflare-ray-id/), open the SQL editor and enter the following SQL query: ```sql SELECT clientRequestScheme, clientRequestHost, clientRequestMethod, edgeResponseStatus, clientRequestUserAgent FROM http_requests WHERE RayID = '806c30a3cec56817' LIMIT 1 ``` As another example, to find Cloudflare Access requests with selected columns from a specific timeframe you could perform the following SQL query: ```sql SELECT CreatedAt, AppDomain, AppUUID, Action, Allowed, Country, RayID, Email, IPAddress, UserUID FROM access_requests WHERE Date >= '2025-02-06' AND Date <= '2025-02-06' AND CreatedAt >= '2025-02-06T12:28:39Z' AND CreatedAt <= '2025-02-06T12:58:39Z' ``` ### Headers and cookies To query request headers, response headers, and cookies you must first enable logging for these fields using [Custom fields](https://developers.cloudflare.com/logs/logpush/logpush-job/custom-fields/). Configure the list of custom fields using the API or the dashboard; there is no need to modify the Logpush job itself. The example below shows how to query HTTP requests by date, timestamp, client country, and a custom request header. Be sure to log the specific headers or cookies you plan to query in advance. ```bash SELECT clientip, clientrequesthost, clientrequestmethod, edgeendtimestamp, edgestarttimestamp, rayid, clientcountry, requestheaders FROM http_requests WHERE Date >= '2025-07-17' AND Date <= '2025-07-17' AND edgeendtimestamp >= '2025-07-17T07:54:19Z' AND edgeendtimestamp <= '2025-07-18T07:54:19Z' AND clientcountry = 'us' AND requestheaders."x-test-header" like '%654AM%'; ``` ### Save queries After building your query, you can save it by selecting **Save search**. Provide a name and description to help identify it later. To view your saved searches, select **Saved searches**. Queries saved in the previous Log Search page appear as saved searches on the Logs page. ## Integration with Security Analytics You can also open Log Search directly from the [Security Analytics dashboard](https://developers.cloudflare.com/waf/analytics/security-analytics/#logs). When doing so, the filters you applied in Security Analytics will automatically carry over to your query. ## Optimize your queries All Log Explorer datasets contain a special column called `date`, which helps to narrow down the amount of data that is scanned to respond to your query, resulting in faster query response times. The value of `date` must be in the form of `YYYY-MM-DD`. For example, to query logs that occurred on October 12, 2023, add the following to your `WHERE` clause: `date = '2023-10-12'`. The column supports the standard operators of `<`, `>`, and `=`. 1. Log in to the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/login) and select your account. 2. Go to **Observability** > **Logs**, select a Log Explorer dataset, and select **Open SQL editor**. 3. Enter the following SQL query: ```sql SELECT clientip, clientrequesthost, clientrequestmethod, clientrequesturi, edgeendtimestamp, edgeresponsestatus, originresponsestatus, edgestarttimestamp, rayid, clientcountry, clientrequestpath, date FROM http_requests WHERE date = '2023-10-12' LIMIT 500 ``` ### Additional query optimization tips - Narrow your query time frame. Focus on a smaller time window to reduce the volume of data processed. This helps avoid querying excessive amounts of data and speeds up response times. - Omit `ORDER BY` and `LIMIT` clauses. These clauses can slow down queries, especially when dealing with large datasets. For queries that return a large number of records, reduce the time frame instead of limiting to the newest `N` records from a broader time frame. - Select only necessary columns. For example, replace `SELECT *` with the list of specific columns you need. You can also use `SELECT RayId` as a first iteration and follow up with a query that filters by the Ray IDs to retrieve additional columns. Additionally, you can use `SELECT COUNT(*)` to probe for time frames with matching records without retrieving the full dataset. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/observability/logs/log-explorer/log-search/#page","headline":"Log Search","description":"Search and explore stored logs via dashboard or API.","url":"https://developers.cloudflare.com/observability/logs/log-explorer/log-search/","inLanguage":"en","image":"https://developers.cloudflare.com/observability/logs/log-explorer/log-search/og.png?v=ab971a803946c9f5","dateModified":"2026-10-15","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Enable, disable, or delete Log Explorer datasets. title: Manage datasets image: https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/og.png?v=d1f4a26b9f0b45a8 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/observability/llms.txt > Use this file to discover all available pages before exploring further. # Manage datasets Last updated Oct 15, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) You can enable, disable, or delete the Log Explorer datasets available to query in [Logs](https://developers.cloudflare.com/observability/logs/). Note Canceling a Log Explorer subscription stops renewal, but it does not automatically stop log ingestion during the current billing cycle. To completely turn off Log Explorer, refer to [How do I turn off Log Explorer?](https://developers.cloudflare.com/observability/logs/log-explorer/faq/#how-do-i-turn-off-log-explorer). ## Supported datasets Log Explorer currently supports the following datasets: ### Zone level - [HTTP Requests](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/zone/http_requests/) ( `http_requests`) - [Firewall Events](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/zone/firewall_events/) ( `firewall_events`) - [DNS Logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/zone/dns_logs/) ( `dns_logs`) - [NEL Reports](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/zone/nel_reports/) ( `nel_reports`) - [Page Shield Events](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/zone/page_shield_events/) ( `page_shield_events`) (events for client-side security) - [Spectrum Events](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/zone/spectrum_events/) ( `spectrum_events`) - [Zaraz Events](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/zone/zaraz_events/) ( `zaraz_events`) ### Account level - [Access requests](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/access_requests/) ( `access_requests`) - [CASB findings](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/casb_findings/) ( `casb_findings`) - [Device posture results](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/device_posture_results/) ( `device_posture_results`) - [Gateway DNS](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/gateway_dns/) ( `gateway_dns`) - [Gateway HTTP](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/gateway_http/) ( `gateway_http`) - [Gateway Network](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/gateway_network/) ( `gateway_network`) - [Zero Trust Network Session Logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions/) ( `zero_trust_network_sessions`) - [Audit Logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/audit_logs/) ( `audit_logs`) - [Audit\_logs\_v2](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/audit_logs_v2/) ( `audit_logs_v2`) - [Browser Isolation User Actions](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/biso_user_actions/) ( `biso_user_actions`) - [DNS firewall logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/dns_firewall_logs/) ( `dns_firewall_logs`) - [Email security alerts](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/email_security_alerts/) ( `email_security_alerts`) - [Magic BGP Logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/magic_bgp_logs/) ( `magic_bgp_logs`) - [Magic IDS Detections](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/magic_ids_detections/) ( `magic_ids_detections`) - [Network Analytics](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/network_analytics_logs/) ( `network_analytics_logs`) - [Sinkhole HTTP Logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/sinkhole_http_logs/) ( `sinkhole_http_logs`) - [IP Sec Logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/ipsec_logs/) ( `ipsec_logs`) ## Enable Log Explorer To begin storing logs, enable the desired datasets through the dashboard or API. ### Dashboard 1. In the Cloudflare dashboard, open the **Manage datasets** page. From **Observability** > **Logs**, open the dataset selector and select **Configure** next to the Log Explorer datasets, or use the button below. [Go to **Manage datasets** ↗](https://dash.cloudflare.com/?to=/:account/log-explorer/manage-sources) 2. Select **Add dataset**. 3. Choose a dataset and, for zone-level datasets, a zone. 4. Under **Select fields**, choose the fields to ingest. 5. Under **Filter logs**, choose whether to ingest all events or only events that match a filter. 6. Select **Add**. Note It may take a few minutes for the logs to become available for querying. #### Configure fields and filters Use **Select fields** to control which data points are stored. Fields are grouped by category, and each category shows its selected field count. Select a category to add or remove all fields in that group, or expand the category to select individual fields. Each field shows its data type. Required fields remain selected and are marked **Required**. Fields that Cloudflare no longer recommends are marked **Deprecated**. Select **Select all** to include every available field, or **Reset to default** to restore the dataset defaults. Use **Filter logs** to ingest **All events** or **Only events matching a filter**. A filter condition consists of a field, an operator, and a value. All conditions within a group must match. An event can match any filter group. To change the fields or filter for an enabled dataset, open the **Manage datasets** page. Find the dataset, select **Actions** > **Edit**, update the configuration, and select **Update**. ### API Use the API to enable each dataset you want to store. It may take a few minutes after a log stream is enabled before you can view the logs. The following `curl` command is an example for enabling the zone-level dataset `http_requests`, as well as the expected response when the command succeeds. ```bash curl https://api.cloudflare.com/client/v4/zones/{zone_id}/logs/explorer/datasets \ --header "Authorization: Bearer " \ --json '{ "dataset": "http_requests" }' ``` ```json { "result": { "dataset": "http_requests", "object_type": "zone", "object_id": "", "created_at": "2025-06-03T14:33:16Z", "updated_at": "2025-06-03T14:33:16Z", "dataset_id": "01973635f7e273a1964a02f4d4502499", "enabled": true, "deletion_protection": true }, "success": true, "errors": [], "messages": [] } ``` To enable an account-level dataset, replace `zones/{zone_id}` with `accounts/{account_id}` in the `curl` command. For example: ```bash curl https://api.cloudflare.com/client/v4/accounts/{account_id}/logs/explorer/datasets \ --header "Authorization: Bearer " \ --json '{ "dataset": "access_requests" }' ``` ## Delete a dataset Deleting a dataset permanently removes the dataset and its stored data. Deletion runs asynchronously. You cannot recreate the same dataset for the account or zone while deletion is in progress. Caution Dataset deletion is irreversible. Deleted data cannot be recovered. 1. In the Cloudflare dashboard, open the **Manage datasets** page. [Go to **Manage datasets** ↗](https://dash.cloudflare.com/?to=/:account/log-explorer/manage-sources) 2. Find the dataset and select **Actions** > **Delete**. 3. If deletion protection is enabled, disable it in the confirmation dialog. 4. Enter the dataset name and select **Delete**. 1. Set `deletion_protection` to `false` with the [Update an account or zone dataset](https://developers.cloudflare.com/api/resources/logs/subresources/log_explorer/subresources/datasets/methods/update/) method. 2. Delete the dataset with the [Delete an account or zone dataset](https://developers.cloudflare.com/api/resources/logs/subresources/log_explorer/subresources/datasets/methods/delete/) method. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/#page","headline":"Manage datasets","description":"Enable, disable, or delete Log Explorer datasets.","url":"https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/","inLanguage":"en","image":"https://developers.cloudflare.com/observability/logs/log-explorer/manage-datasets/og.png?v=d1f4a26b9f0b45a8","dateModified":"2026-10-15","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Understand Log Explorer billing and usage. title: Pricing and managing usage image: https://developers.cloudflare.com/observability/logs/log-explorer/pricing/og.png?v=f9f78a676d93cc7a --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/observability/llms.txt > Use this file to discover all available pages before exploring further. # Pricing and managing usage Last updated Oct 15, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/observability/logs/log-explorer/pricing/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Log Explorer (Legacy) is billed on the volume of logs ingested and stored, measured in gigabytes (GB). Your charges scale with the amount of log data you choose to retain. Unlike query-based billing models, charges are not based on how often you search or scan your data. Once logs are ingested and stored, you can query them without additional cost. ## Availability Log Explorer is available as a paid add-on for any Application Services or Zero Trust purchase. There is no free version or trial available at this time. ## Billable usage Billing is strictly consumption-based, calculated by the GBs ingested and stored. ### Attack traffic Because these datasets are used for forensics, attack traffic is considered valuable data for analysis and is included in your billable usage. Note Logs generated from Layer 7 (L7) DDoS attack traffic are not ingested by default and do not count toward your usage. ## Estimate usage To estimate your usage, review your request volumes in **Analytics** for specific Cloudflare log datasets. ### Record size by dataset The following table provides average and maximum record sizes for each dataset to help you estimate potential storage needs: | Dataset | Average Record Size | Maximum Record Size | | --- | --- | --- | | `audit_logs` | 2.69 kB | 172 kB | | `email_security_alerts` | 6.74 kB | 74.9 kB | | `firewall_events` | 1.36 kB | 47.2 kB | | `audit_logs_v2` | 1.73 kB | 28.5 kB | | `zaraz_events` | 7.30 kB | 11.7 kB | | `http_requests` | 1.56 kB | 9.76 kB | | `gateway_dns` | 1.44 kB | 6.23 kB | | `dex_application_tests` | 3.29 kB | 5.67 kB | | `casb_findings` | 2.67 kB | 3.80 kB | | `gateway_http` | 1.47 kB | 2.60 kB | | `dex_device_state_events` | 1.98 kB | 2.57 kB | | `page_shield_events` | 443 B | 2.02 kB | | `network_analytics_logs` | 1.31 kB | 1.87 kB | | `zero_trust_network_sessions` | 1.21 kB | 1.52 kB | | `gateway_network` | 877 B | 1.17 kB | | `device_posture_results` | 730 B | 944 B | | `spectrum_events` | 685 B | 925 B | | `sinkhole_http_logs` | 705 B | 705 B | | `access_requests` | 446 B | 541 B | | `dns_firewall_logs` | 387 B | 469 B | | `dns_logs` | 199 B | 409 B | | `magic_ids_detections` | 334 B | 349 B | | `warp_toggle_changes` | 327 B | 335 B | | `ipsec_logs` | 207 B | 260 B | | `nel_reports` | 204 B | 224 B | ## Monitor usage Cloudflare provides three primary ways to track your consumption and maintain financial oversight: - **In-product quick indicator**: View your current month's usage at the top of the **Log Search** and **Manage Datasets** sections. - **Account-level billing**: Access a detailed view of current and previous months' cumulative usage under **Manage Account** > **Billing**. - **Usage alerts**: Set up automated notifications to trigger when billable usage exceeds a defined threshold. ### Configure a usage alert 1. Log in to the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/) and select **Manage account**. 2. Go to **Notifications** > **Add**. 3. Select **Usage-based Billing**. 4. Define your threshold and the notification destination (email, PagerDuty, or webhooks). ## Deactivate Log Explorer To stop using Log Explorer and end associated charges, you must complete both of the following steps: ### 1. Stop log ingestion Disabling datasets stops additional ingestion charges immediately. 1. Go to the [Manage datasets ↗︎](https://dash.cloudflare.com/?to=/:account/log-explorer/manage-sources) page at the account level. 2. Use the toggle to turn off each dataset you no longer need. 3. Select **Stop ingesting logs** to confirm. ### 2. Cancel the subscription This prevents the subscription from renewing at the next billing cycle. 1. Go to the [Billing ↗︎](https://dash.cloudflare.com/?to=/:account/billing) page. 2. In the **Subscriptions** tab, find the **Log Explorer** subscription and select **Cancel**. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/observability/logs/log-explorer/pricing/#page","headline":"Pricing and managing usage","description":"Understand Log Explorer billing and usage.","url":"https://developers.cloudflare.com/observability/logs/log-explorer/pricing/","inLanguage":"en","image":"https://developers.cloudflare.com/observability/logs/log-explorer/pricing/og.png?v=f9f78a676d93cc7a","dateModified":"2026-10-15","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Review SQL syntax supported by Log Explorer. title: SQL queries supported image: https://developers.cloudflare.com/observability/logs/log-explorer/sql-queries/og.png?v=f0e05bb544df8935 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/observability/llms.txt > Use this file to discover all available pages before exploring further. # SQL queries supported Last updated Oct 15, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/observability/logs/log-explorer/sql-queries/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) This page outlines the SQL features supported by Log Explorer, including common aggregation functions, expressions, and query clauses. The following diagram illustrates the general shape of a valid query on these datasets. It shows how standard SQL clauses — such as `SELECT`, `WHERE`, `GROUP BY`, and `ORDER BY` — can be composed to form supported queries. ![Supported SQL grammar](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=980,height=864,format=webp/_astro/supported-sql-grammar-graph.bOILnB7v.png) Examples of queries include: - `SELECT * FROM table WHERE (a = 1 OR b = "hello") AND c < 25.89` - `SELECT a, b, c FROM table WHERE d >= "GB" LIMIT 10` Note - A default `LIMIT` of 10,000 is applied if the `LIMIT` clause is omitted. - The `WHERE` clause supports up to 25 predicates, which can be grouped using parentheses. ### SQL Clauses in detail The following SQL clauses define the structure and logic of queries in Log Explorer: - `SELECT` - The `SELECT` clause specifies the columns that you want to retrieve from the database tables. It can include individual column names, expressions, or even wildcard characters to select all columns. - `FROM` - The `FROM` clause specifies the tables from which to retrieve data. It indicates the source of the data for the `SELECT` statement. - `WHERE` - The `WHERE` clause filters the rows returned by a query based on specified conditions. It allows you to specify conditions that must be met for a row to be included in the result set. - `SELECT DISTINCT` - Removes duplicate rows from the result set. - `GROUP BY` - Groups rows for aggregation. The `GROUP BY` clause is used to group rows that have the same values into summary rows. - `ORDER BY` - Sorts the result set. The `ORDER BY` clause is used to sort the result set by one or more columns in ascending or descending order. - `LIMIT` - Restricts the number of rows returned. The `LIMIT` clause is used to constrain the number of rows returned by a query. It is often used in conjunction with the `ORDER BY` clause to retrieve the top `N` rows or to implement pagination. - `OFFSET` - Skips a specified number of rows before returning results. The sections that follow break down the remaining components shown in the diagram — such as aggregation functions, string and numeric expressions, and supported operators — in more detail. ## Functions Queries support a range of SQL functions to transform, evaluate, or summarize data. These include scalar and aggregation functions. ### Scalar functions These help manipulate or evaluate values (often strings): - `ARRAY_CONTAINS(array, element)` – Checks if the array contains the element.
Example ARRAY_CONTAINS(['US', 'CA'], ClientCountry) Returns rows where ClientCountry is either US or CA.
- `SUBSTRING(string, from_number, for_number)` – Extracts part of a string.
Example SUBSTRING(ClientRequestPath, 0, 5) Extracts the first 5 characters from ClientRequestPath.
- `LOWER(string)` – Converts to lowercase.
Example LOWER(ClientRequestUserAgent) Converts the user agent string to lowercase.
- `UPPER(string)` – Converts to uppercase.
Example UPPER(ClientCountry) Converts the country code to uppercase.
### Aggregation functions Used to perform calculations on sets of rows: - `SUM(expression)` – Total of values.
Example SUM(ClientRequestBytes) Adds up the total number of bytes requested by clients.
- `MIN(expression)` – Minimum value.
Example MIN(OriginResponseDurationMs) Finds the shortest response time from origin servers.
- `MAX(expression)` – Maximum value.
Example MAX(OriginResponseDurationMs) Finds the longest response time.
- `COUNT(expression)` – Number of rows (can be all rows or non-null values).
Example COUNT(ClientRequestUserAgent) Counts how many rows have a user agent value.
- `COUNT(DISTINCT expression)` – Number of distinct non-null values.
Example COUNT(DISTINCT ClientIP) Counts how many unique client IPs made requests.
- `AVG(expression)` – Average of numeric values.
Example AVG(OriginResponseDurationMs) Computes the average origin response time in milliseconds.
The diagram below represents the grammar for SQL expressions including scalar and aggregate functions. ![Scalar and aggregate functions](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=392,height=428,format=webp/_astro/scalar-aggregate-functions.ucmFeJbw.png) ## Expressions Conditions or logic used in queries: - `CASE WHEN` – Conditional logic (like if-else). - `AS` – Alias for columns or tables. - `LIKE` – Pattern matching. - `IN (list)` – Checks if a value is in a list. - `BETWEEN ... AND ...` – Checks if a value is within a range. - `Unary operator` – Operates on one operand (for example, `-5`). - `Binary operator` – Operates on two operands (for example, `5 + 3`). - `Nested Expressions` – Expression wrapped with parentheses, like `( x > y )` or `( 1 )`. - `Compound identifier` – Multi-part name (for example, `schema.table.column`). - `Array` – A collection of values (supported differently across SQL dialects). - `Literals` - represent values such as strings, numbers, or arrays. The diagram below represents the grammar for SQL expressions, detailing the various forms an expression can take, including columns, literals, functions, operators, and aliases. ![SQL expressions](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1152,height=714,format=webp/_astro/expressions.BHSBeoXm.png) The diagram below defines the grammar for unary operators, which operate on a single operand (for example, negation or logical `NOT`): ![Grammar for unary operators](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=354,height=264,format=webp/_astro/not.BmwQbTYc.png) ## Binary Operators Used for arithmetic, comparison, logical operations: - Arithmetic: `+`, `-`, `*`, `/`, `%` (modulo) - Comparison: `>`, `<`, `>=`, `<=`, `=`, `!=` (or `<>`)\` - Logical: `AND`, `OR`, `XOR` - Bitwise: `&`, `|`, `^`, `>>`, `<<` - String concat: `||` Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/observability/logs/log-explorer/sql-queries/#page","headline":"SQL queries supported","description":"Review SQL syntax supported by Log Explorer.","url":"https://developers.cloudflare.com/observability/logs/log-explorer/sql-queries/","inLanguage":"en","image":"https://developers.cloudflare.com/observability/logs/log-explorer/sql-queries/og.png?v=f0e05bb544df8935","dateModified":"2026-10-15","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Inspect production request paths in Cloudflare Observability. title: Traces image: https://developers.cloudflare.com/observability/traces/og.png?v=2f14e97f99a2b734 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/observability/llms.txt > Use this file to discover all available pages before exploring further. # Traces Last updated Oct 9, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/observability/traces/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Cloudflare Traces show how production requests move through Cloudflare and record traces from actual traffic on your domain. Each trace contains [spans](https://developers.cloudflare.com/observability/traces/spans/) for supported steps in the request path, such as [Rules](https://developers.cloudflare.com/rules/), request routing, [Cache](https://developers.cloudflare.com/cache/), [Workers](https://developers.cloudflare.com/workers/), and origin connections. A span records how long an operation took, its outcome, and related attributes, which helps you see where a request slowed down or failed. ![A Cloudflare trace showing request processing spans, Worker and origin operations, timing, and details for a selected span.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2638,height=1124,format=webp/_astro/full-cloudflare-trace.BdBuHOv5.png) Use Cloudflare Traces to answer questions such as: - Why was a request blocked or challenged, and which [security rule](https://developers.cloudflare.com/waf/custom-rules/) took action? - Was the URL rewritten by a [Transform Rule](https://developers.cloudflare.com/rules/transform/) before it reached the application? - Which [Page Rules](https://developers.cloudflare.com/rules/page-rules/), [Snippets](https://developers.cloudflare.com/rules/snippets/), or [Workers](https://developers.cloudflare.com/workers/) handled or changed the request? - Was the response served from [cache](https://developers.cloudflare.com/cache/), and where was time spent between Cloudflare, the origin connection, and the application? - Was the behavior isolated to a particular [Cloudflare location or region](https://developers.cloudflare.com/fundamentals/concepts/how-cloudflare-works/)? ## Enable tracing Enable tracing separately for each domain in your account. To manage sampling, context, export destinations, and trace rules, refer to [Configuration](https://developers.cloudflare.com/observability/traces/configuration/). ## Inspect a trace Use **Add filter** or enter a query to search across traces for the selected time range. To find the trace for one request, filter on its Ray ID. Open a trace to see the full request path as a hierarchy of spans. Each row represents one operation, and its bar shows when the operation ran and how long it took. Expand a span to inspect its child operations, or search for a span by name. Select a span to open its details. The detail panel shows the span status, service, trigger, span and trace IDs, duration compared to similar spans, and recorded attributes. You can search or copy the attributes while investigating the operation. Cloudflare Trace [Cloudflare Trace](https://developers.cloudflare.com/rules/trace-request/) simulates how Cloudflare configurations would handle a request. It does not show actual production traffic. ## Frequently asked questions ### Does tracing add latency to my requests No. Tracing has no measurable overhead on request processing. Requests that are not sampled skip tracing entirely. ### Why is there a gap in my trace A Worker in the request path may not have Workers tracing enabled. Enable it using `observability.traces.enabled = true` in your [Wrangler configuration](https://developers.cloudflare.com/workers/observability/traces/#how-to-enable-tracing). ### Why is there no outbound connection span If the response was served from cache, Cloudflare did not contact your origin. Check the `cloudflare.cache.status` attribute on the `cache` span to confirm it was a HIT rather than an origin connection. ### How do I capture the trace for a specific request Filter by Ray ID in the dashboard with `cloudflare.ray_id = ""`. To guarantee a particular request is captured regardless of the default sample rate, create a [trace rule](https://developers.cloudflare.com/observability/traces/configuration/#trace-rules) that matches a custom debug header and sets the sample rate to 100%. ### Can I sample only slow requests or errors Not yet. Sampling is [head-based ↗︎](https://opentelemetry.io/docs/concepts/sampling/#head-sampling) — the decision happens when a request arrives, before the outcome is known. Tail-based sampling is not currently supported. ### Are request header values captured in spans Header names and the operations performed on them are captured. Header values are not captured. URLs and query strings are captured. ### Are span names a stable interface No. Span names and structure may change as the product evolves. Do not build hard dependencies on the exact shape of Cloudflare-emitted spans. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"WebPage","@id":"https://developers.cloudflare.com/observability/traces/#page","headline":"Traces","description":"Inspect production request paths in Cloudflare Observability.","url":"https://developers.cloudflare.com/observability/traces/","inLanguage":"en","image":"https://developers.cloudflare.com/observability/traces/og.png?v=2f14e97f99a2b734","dateModified":"2026-10-09","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Choose how each domain samples, stores, exports, and connects traces. title: Configuration image: https://developers.cloudflare.com/observability/traces/configuration/og.png?v=61a155bcdb386a5f --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/observability/llms.txt > Use this file to discover all available pages before exploring further. # Configuration Last updated Oct 9, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/observability/traces/configuration/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Configure [Cloudflare Traces](https://developers.cloudflare.com/observability/traces/) separately for each domain. Choose how many requests to trace, where to save or send traces, and whether to connect them to traces from other systems. ![Trace settings for sampling, persistence, export destinations, trace rules, and trace context propagation.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1500,height=892,format=webp/_astro/trace-configuration.K-zGxXIJ.png) ## Head sampling **Default sample rate (%)** sets how many requests Cloudflare traces. For example, a rate of `10%` traces about 10 out of every 100 requests. Trace rules can use a different rate for requests that match a rule. Cloudflare makes the sampling decision when the request arrives. Once a request is selected for tracing, Cloudflare captures the full request path. There is no overhead with enabling tracing. Free plan daily limit Free accounts have a daily ingestion limit. When this limit is reached, Cloudflare stops ingesting new traces for the remainder of that day. Refer to [Cloudflare Observability pricing](https://developers.cloudflare.com/observability/pricing/) for limit details. ## Trace rules Trace rules override the default sample rate for matching requests. Cloudflare uses the first matching rule, so rule order matters. Choose **Custom filter expression** to match selected requests, or choose **All incoming requests** to apply the rule to every request. Build a custom filter from fields, operators, and values, or select **Edit expression** to write it with the [Cloudflare Rules language](https://developers.cloudflare.com/ruleset-engine/rules-language/). Set **Sample rate (%)** to the percentage of matching requests you want to trace. Select **Save as Draft** to keep the rule inactive, or select **Deploy** to start using it. ![A trace rule that samples all incoming requests with a URL path starting with /api/v1.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1350,height=878,format=webp/_astro/create-trace-rule.PluHax99.png) ## Persist traces Turn on **Persist to Cloudflare** to save traces in Cloudflare and view them in the dashboard. Pricing Beginning December 1, 2026, persisted traces contribute to Cloudflare Observability ingestion and storage usage. Refer to [Cloudflare Observability pricing](https://developers.cloudflare.com/observability/pricing/). ## Export traces Use **Export destinations** to send traces to configured account-level OpenTelemetry destinations. To create a destination or configure a provider, refer to [OpenTelemetry export](https://developers.cloudflare.com/observability/export/opentelemetry/). You can save and export the same traces. If you only want traces in an external tool, turn off **Persist to Cloudflare**. ## Propagate trace context Trace context carries identifiers that connect spans from different systems into one trace. Cloudflare uses [W3C Trace Context ↗︎](https://www.w3.org/TR/trace-context-1/) to connect its spans to services before or after Cloudflare in the request path. You can configure incoming and outgoing propagation separately. ### Incoming trace context Use **Incoming trace context** to choose whether Cloudflare accepts trace context included with an incoming request. The default setting is *Reject*, which ignores the incoming context so Cloudflare does not join the caller's trace. Caution Cloudflare does not verify that incoming trace context came from a trusted caller. If you accept it, treat the joined trace as untrusted. ### Forward context to your origin Turn on **Forward to origin** to include trace context in requests that Cloudflare sends to your origin. An instrumented origin can use this context to add its spans to the same trace. Forwarding context does not instrument the origin or create origin spans by itself. To view Cloudflare and origin spans in one trace in a third-party observability tool, send both sets of spans to the same OpenTelemetry destination. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/observability/traces/configuration/#page","headline":"Configuration","description":"Choose how each domain samples, stores, exports, and connects traces.","url":"https://developers.cloudflare.com/observability/traces/configuration/","inLanguage":"en","image":"https://developers.cloudflare.com/observability/traces/configuration/og.png?v=61a155bcdb386a5f","dateModified":"2026-10-09","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Understand spans captured as requests move through Cloudflare. title: Spans image: https://developers.cloudflare.com/observability/traces/spans/og.png?v=2668c41ce53abbb0 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/observability/llms.txt > Use this file to discover all available pages before exploring further. # Spans Last updated Oct 9, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/observability/traces/spans/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) A span represents one operation within a trace. Each span records when an operation started and how long it took. Related spans form a hierarchy that shows how a request moved through Cloudflare. The spans in a trace depend on the products and request path involved. A span appears only when the corresponding operation runs. ## Span reference | Span | What it covers | What its duration measures | | --- | --- | --- | | `cloudflare_request` | Cloudflare's processing of an HTTP request. This is the root span for platform-level request processing. | Starts after tracing configuration and sampling are resolved. Includes the request processing, upstream, response delivery, and post-processing, but excludes processing before tracing is activated. | | `response` | Response processing and delivery to the client. | Starts after an upstream or internally generated response becomes available. This includes the time spent to fully stream the response back to the client. | | `workers_routing` | The decision to match, skip, or reject a Workers route or custom domain. A `skipped` means a skip or disabled route matched. Requests that are not eligible for Workers routing do not emit this span. | Includes the time to evaluate the routes/custom domains that might match the request. Does not include the time executing the Worker. | | `page_rules` | One evaluation of a configured Page Rules set. | Includes the time to evaluate the Page Rules. It does not include applying those actions to the request. | | `cache` | Getting a response from Cloudflare's cache, fetching or revalidating it when needed. | On a cache hit, includes reading and transferring the cached response. If Cloudflare needs to fetch or revalidate the response, that time is included too, including waiting for another request already filling the cache. **Includes the full response body, not just the cache lookup.** | | `dynamic` | Fetching and returning an uncached response. | Includes establishing a connection when needed, sending the request and its body, waiting for the response, and transferring the full response body. **It is not just the time your origin spends processing the request.** | | `upstream` | Fetching a response from another Cloudflare location using Tiered Cache. | Includes establishing a connection when needed, sending the request, waiting for the other location to produce a response, and receiving its full response body. If that location needs to fetch from your origin, that wait is included. **It is not just the network travel time between locations.** | ## Ruleset phase spans Ruleset phase spans measure rule execution and application of the phase output. They start after eligibility checks and request-body preparation, and end after Cloudflare applies the resulting actions. A skipped phase does not emit a span. | Span | Ruleset phase covered | | --- | --- | | `http_request_dynamic_redirect` | Dynamic Redirect Rules | | `http_request_transform` | Early request Transform Rules | | `http_config_settings` | Configuration Rules | | `http_request_origin` | Origin Rules | | `http_request_firewall_custom` | Custom rules | | `http_request_firewall_managed` | Managed rules | | `http_request_redirect` | Request redirect rules | | `http_request_late_transform_managed` | Managed late request transforms | | `http_request_late_transform` | Late request transforms | | `http_request_cache_settings` | Cache Rules | | `http_request_snippets` | Snippets rules | | `http_custom_errors` | Custom Error Rules | | `http_response_headers_transform_managed` | Managed response header transforms | | `http_response_headers_transform` | Response Header Transform Rules | | `http_response_compression` | Compression Rules | | `http_response_firewall_managed` | Managed response firewall processing | ## Workers runtime spans Cloudflare Traces include spans for supported Workers runtime operations, including handler invocations, fetch calls, and binding operations. Refer to [Workers spans and attributes](https://developers.cloudflare.com/workers/observability/traces/spans-and-attributes/) for the complete runtime reference. You can also [create custom spans](https://developers.cloudflare.com/workers/observability/traces/custom-spans/) for application-specific operations. Note [Workers tracing](https://developers.cloudflare.com/workers/observability/traces/) needs to be enabled to see Workers spans in a Cloudflare Trace. ## Features without spans Some Cloudflare features do not yet have dedicated spans. Requests processed by these features still appear in traces, but without span-level detail for that processing. - DDoS protection rules - Cloudflare Access - Cloudflare Tunnel Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/observability/traces/spans/#page","headline":"Spans","description":"Understand spans captured as requests move through Cloudflare.","url":"https://developers.cloudflare.com/observability/traces/spans/","inLanguage":"en","image":"https://developers.cloudflare.com/observability/traces/spans/og.png?v=2668c41ce53abbb0","dateModified":"2026-10-09","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Gain end-to-end visibility into request flows across your Workers application with automatic tracing instrumentation. title: Traces image: https://developers.cloudflare.com/workers/observability/traces/og.png?v=5a79cedf9f235251 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/workers/llms.txt > Use this file to discover all available pages before exploring further. # Traces Last updated Oct 2, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/workers/observability/traces/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) ### What is Workers tracing? Tracing gives you end-to-end visibility into the life of a request as it travels through your Workers application and connected services. This helps you identify performance bottlenecks, debug issues, and understand complex request flows. With tracing you can answer questions such as: - What is the cause of a long-running request? - How long do subrequests from my Worker take? - How long are my calls to my KV Namespace or R2 bucket taking? ![Example trace showing a POST request to a cake shop with multiple spans including fetch requests and durable object operations](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1348,height=414,format=webp/_astro/wobs_waterfall_trace_122.BveqL__z.png) ### Automatic instrumentation Cloudflare Workers provides tracing instrumentation **out of the box** — no code changes or SDK are required. Simply enable tracing on your Worker and Cloudflare automatically captures telemetry data for: - **Fetch calls** — All outbound HTTP requests, capturing timing, status codes, and request metadata. This enables you to quickly identify how external dependencies affect your application's performance. - **Binding calls** — Interactions with various Worker bindings such as KV reads and writes, R2 object storage operations and Durable Object invocations. - **RPC calls** — Calls between Workers and Durable Objects, including caller-side session spans and individual method-call spans. - **Handler calls** — The complete lifecycle of each Worker invocation, including triggers such as [fetch handlers](https://developers.cloudflare.com/workers/runtime-apis/handlers/fetch/), [scheduled handlers](https://developers.cloudflare.com/workers/runtime-apis/handlers/scheduled/), and [queue handlers](https://developers.cloudflare.com/queues/configuration/javascript-apis/#consumer). For a full list of instrumented operations, refer to the [spans and attributes documentation](https://developers.cloudflare.com/workers/observability/traces/spans-and-attributes/). ### Custom spans You can also create your own spans to trace application-specific logic. Custom spans nest automatically with the built-in instrumentation, giving you end-to-end visibility across both platform operations and your own code. For more information, refer to [Custom spans](https://developers.cloudflare.com/workers/observability/traces/custom-spans/). ### How to enable tracing You can configure tracing by setting `observability.traces.enabled = true` in your [Wrangler configuration file](https://developers.cloudflare.com/workers/wrangler/configuration/#observability). ```jsonc { "observability": { "traces": { "enabled": true, // optional sampling rate (recommended for high-traffic workloads) "head_sampling_rate": 0.05 } } } ``` ```toml [observability.traces] enabled = true head_sampling_rate = 0.05 ``` Note In the future, Cloudflare plans to enable automatic tracing in addition to logs when you set `observability.enabled = true` in your Wrangler configuration. While automatic tracing is in early beta, this setting will not enable tracing by default, and will only enable logs. An updated [`compatibility_date`](https://developers.cloudflare.com/workers/configuration/compatibility-dates/) will be required for this change to take effect. ### Exporting OpenTelemetry traces to a 3rd party destination Workers tracing follows [OpenTelemetry (OTel) standards ↗︎](https://opentelemetry.io/). This makes it compatible with popular observability platforms, such as [Honeycomb](https://developers.cloudflare.com/observability/export/opentelemetry/honeycomb/), [Grafana Cloud](https://developers.cloudflare.com/observability/export/opentelemetry/grafana-cloud/), and [Axiom](https://developers.cloudflare.com/observability/export/opentelemetry/axiom/), while requiring zero development effort from you. If your observability provider has an available OpenTelemetry endpoint, you can export traces (and logs)! You can also set `persist: false` to export traces to your destination without persisting them in the Cloudflare dashboard. This allows you to use a third-party observability provider as your sole traces destination. To export OpenTelemetry data from Workers, refer to [OpenTelemetry export](https://developers.cloudflare.com/workers/observability/opentelemetry-export/). ### Sampling Default Sampling Rate The default sampling rate is `1`, meaning 100% of requests will be traced if tracing is enabled. Set `head_sampling_rate` if you want to trace fewer requests. With sampling, you can trace a percentage of incoming requests in your Cloudflare Worker. This allows you to manage volume and costs, while still providing meaningful insights into your application. The valid sampling range is from `0` to `1`, where `0` indicates zero out of one hundred invocations will be traced, and `1` indicates every requests will be traced, and a number such a `0.05` indicates five out of one hundred requests will be traced. If you have not specified a sampling rate, it defaults to `1`, meaning 100% of requests will be traced. ```jsonc { "observability": { "traces": { "enabled": true, // set tracing sampling rate to 5% "head_sampling_rate": 0.05 }, "logs": { "enabled": true, // set logging sampling rate to 60% "head_sampling_rate": 0.6 } } } ``` ```toml [observability.traces] enabled = true head_sampling_rate = 0.05 [observability.logs] enabled = true head_sampling_rate = 0.6 ``` If you have `head_sampling_rate` configured for logs, you can also create a separate rate for traces. Sampling is [head-based ↗︎](https://opentelemetry.io/docs/concepts/sampling/#head-sampling), meaning that non-traced requests do not incur any tracing overhead. ### Limits and pricing Workers traces have seven-day retention. Beginning December 1, 2026, stored traces contribute to account-level ingestion and storage usage under [Cloudflare Observability pricing](https://developers.cloudflare.com/observability/pricing/). Sampling reduces the number of spans ingested and stored, which reduces billable usage. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"WebPage","@id":"https://developers.cloudflare.com/workers/observability/traces/#page","headline":"Traces","description":"Gain end-to-end visibility into request flows across your Workers application with automatic tracing instrumentation.","url":"https://developers.cloudflare.com/workers/observability/traces/","inLanguage":"en","image":"https://developers.cloudflare.com/workers/observability/traces/og.png?v=5a79cedf9f235251","dateModified":"2026-10-02","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Set up alerts across Cloudflare products and deliver them to email, webhooks, PagerDuty, or connected services. title: Alerts image: https://developers.cloudflare.com/notifications/og.png?v=53368d19a966bd60 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/notifications/llms.txt > Use this file to discover all available pages before exploring further. # Alerts Last updated Oct 2, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/notifications/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Cloudflare Alerts monitor your account and notify you when something needs attention — from DDoS attacks and certificate expirations to origin failures and billing spikes. Built-in alerts cover products such as DDoS Protection, SSL/TLS, and Billing. Custom Alerts let you define your own threshold, anomaly, or SLO conditions on supported SQL API datasets. ## Delivery methods Alerts can be delivered to: - **Email** (all plans) - **[Webhooks](https://developers.cloudflare.com/notifications/get-started/configure-webhooks/)** (all plans; accounts without a paid zone can configure up to 100 webhook destinations) - **[PagerDuty](https://developers.cloudflare.com/notifications/get-started/configure-pagerduty/)** (Business and higher) - **Connected services**, including coding agents ## [Get started](https://developers.cloudflare.com/notifications/get-started/) Create and manage alerts from the Cloudflare dashboard. Configure where alerts are delivered. ## [Available alerts](https://developers.cloudflare.com/notifications/notification-available/) Browse the full list of alert types organized by Cloudflare product. ## [Alert history](https://developers.cloudflare.com/notifications/notification-history/) View a log of alerts that have been sent on your account. ## [API reference](https://developers.cloudflare.com/notifications/api-reference/) Manage alerts programmatically using the Cloudflare API. ## [Reference](https://developers.cloudflare.com/notifications/reference/) Troubleshooting, common errors, and details on specific alert types. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"WebPage","@id":"https://developers.cloudflare.com/notifications/#page","headline":"Alerts","description":"Set up alerts across Cloudflare products and deliver them to email, webhooks, PagerDuty, or connected services.","url":"https://developers.cloudflare.com/notifications/","inLanguage":"en","image":"https://developers.cloudflare.com/notifications/og.png?v=53368d19a966bd60","dateModified":"2026-10-02","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Export Cloudflare logs and traces to external destinations. title: Export image: https://developers.cloudflare.com/observability/export/og.png?v=1dfc3a2fe167de72 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/observability/llms.txt > Use this file to discover all available pages before exploring further. # Export Last updated Oct 2, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/observability/export/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Use Logpush for logs generated by Cloudflare products. Use OpenTelemetry for logs and traces from Cloudflare Observability and Workers. ### [Logpush](https://developers.cloudflare.com/logs/logpush/) Send Cloudflare logs to supported storage and analytics destinations. ### [OpenTelemetry export](https://developers.cloudflare.com/observability/export/opentelemetry/) Send Cloudflare Traces, Workers traces, and Workers logs to an OpenTelemetry destination. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"WebPage","@id":"https://developers.cloudflare.com/observability/export/#page","headline":"Export","description":"Export Cloudflare logs and traces to external destinations.","url":"https://developers.cloudflare.com/observability/export/","inLanguage":"en","image":"https://developers.cloudflare.com/observability/export/og.png?v=1dfc3a2fe167de72","dateModified":"2026-10-02","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Push logs in near real-time to storage or SIEM. title: Logpush image: https://developers.cloudflare.com/logs/logpush/og.png?v=7891593910363aac --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/logs/llms.txt > Use this file to discover all available pages before exploring further. # Logpush Last updated Sep 30, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/logs/logpush/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Logpush delivers logs in batches as quickly as possible, with no minimum batch size, potentially delivering files more than once per minute. This capability enables Cloudflare to provide information almost in real time, in smaller file sizes. The push frequency is automatic and cannot be adjusted—Cloudflare pushes logs in batches as soon as possible. However, users can configure the batch size [using the API](https://developers.cloudflare.com/logs/logpush/logpush-job/api-configuration/#max-upload-parameters) for improved control in case the log destination has specific requirements. Important limitation Logpush only pushes logs once as they become available and cannot backfill historical data. If your job is disabled or fails, logs generated during that period are permanently lost. This is why configuring [health notifications](https://developers.cloudflare.com/logs/logpush/logpush-health/) is essential for early detection of issues. Logpush does not offer storage or search functionality for logs; its primary aim is to send logs as quickly as they arrive. Cloudflare Logpush supports pushing logs to storage services, SIEMs, and log management providers via the Cloudflare dashboard or API. ## Estimating log volume Before setting up a Logpush job, you can estimate the total volume of data that will be pushed to your destination. The volume depends on your traffic, selected fields, and compression. ### Quick sizing for HTTP Requests A quick sizing estimate for an [HTTP Requests](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/zone/http_requests/) dataset: - \~100–250 bytes per request (compressed, depending on fields selected) - 1M requests/day → \~100–250 MB/day - 30M requests/month → \~3–7.5 GB/month ### Daily storage by traffic volume - 100k req/day → \~25–50 MB/day - 1M req/day → \~250–500 MB/day - 10M req/day → \~2.5–5 GB/day - 100M req/day → \~25–50 GB/day These ranges reflect field selection, compression, and whether you include extra fields or [custom fields](https://developers.cloudflare.com/logs/logpush/logpush-job/custom-fields/). Other datasets (Firewall, Workers, Load Balancing) add volume separately. For precise estimates, you can [sample your logs via Logpull](https://developers.cloudflare.com/logs/logpull/additional-details/#estimating-daily-data-volume) using a 1-hour sample. ## Limits There is currently a max limit of **4 Logpush jobs per zone**. Trying to create a job once the limit has been reached will result in an error message: `creating a new job is not allowed: exceeded max jobs allowed`. ## Availability | | Free | Pro | Business | Enterprise | | --- | --- | --- | --- | --- | | Availability | Yes | Yes | Yes | Yes | Dataset availability depends on the Cloudflare products on your account. Workers Trace Events Logpush requires the [Workers Paid](https://developers.cloudflare.com/workers/platform/pricing/#workers-trace-events-logpush) plan and retains separate request-based pricing. For usage rates and included monthly usage, refer to [Pricing](https://developers.cloudflare.com/logs/logpush/pricing/). Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/logs/logpush/#page","headline":"Logpush","description":"Push logs in near real-time to storage or SIEM.","url":"https://developers.cloudflare.com/logs/logpush/","inLanguage":"en","image":"https://developers.cloudflare.com/logs/logpush/og.png?v=7891593910363aac","dateModified":"2026-09-30","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Export Cloudflare logs and traces to OpenTelemetry destinations. title: OpenTelemetry export image: https://developers.cloudflare.com/observability/export/opentelemetry/og.png?v=2a6205b4ded568cd --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/observability/llms.txt > Use this file to discover all available pages before exploring further. # OpenTelemetry export Last updated Oct 2, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/observability/export/opentelemetry/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Cloudflare exports telemetry to destinations that support the OpenTelemetry Protocol (OTLP). Use these destinations with Cloudflare telemetry and your existing observability tools. ## Supported telemetry You can export these telemetry types: - [**Cloudflare Traces**](https://developers.cloudflare.com/observability/traces/) - Traces showing production request paths through Cloudflare - [**Workers Traces**](https://developers.cloudflare.com/workers/observability/traces/) - Traces showing requests through Workers and connected services - [**Workers Logs**](https://developers.cloudflare.com/workers/observability/logs/workers-logs/) - Application and system logs, including `console.log()` output ## Available destinations These endpoint formats cover common observability providers. Check your provider documentation for current authentication requirements. | Provider | Traces endpoint | Logs endpoint | | --- | --- | --- | | [**Honeycomb**](https://developers.cloudflare.com/observability/export/opentelemetry/honeycomb/) | `https://api.honeycomb.io/v1/traces` | `https://api.honeycomb.io/v1/logs` | | [**Grafana Cloud**](https://developers.cloudflare.com/observability/export/opentelemetry/grafana-cloud/) | `https://otlp-gateway-.grafana.net/otlp/v1/traces` | `https://otlp-gateway-.grafana.net/otlp/v1/logs` | | [**Firetiger** ↗︎](https://docs.firetiger.com/ingest/cloudflare-workers.html) | `https://ingest.cloud.firetiger.com/v1/traces` | `https://ingest.cloud.firetiger.com/v1/logs` | | [**Axiom**](https://developers.cloudflare.com/observability/export/opentelemetry/axiom/) | `https://api.axiom.co/v1/traces` | `https://api.axiom.co/v1/logs` | | [**Sentry**](https://developers.cloudflare.com/observability/export/opentelemetry/sentry/) | `https:///api//integration/otlp/v1/traces` | `https:///api//integration/otlp/v1/logs` | | [**Sematext** ↗︎](https://sematext.com/docs/guide/managed-otlp-endpoint/) | `https://otlp-receiver.sematext.com` (US), `https://otlp-receiver.eu.sematext.com` (EU) | `https://otlp-receiver.sematext.com` (US), `https://otlp-receiver.eu.sematext.com` (EU) | | [**PostHog**](https://developers.cloudflare.com/observability/export/opentelemetry/posthog/) | Not supported | `https://.i.posthog.com/i/v1/logs` | | [**Datadog** ↗︎](https://docs.datadoghq.com/opentelemetry/setup/otlp_ingest/managed_platforms/) | `https://cloudflare.integrations.otlp./v1/traces` | `https://cloudflare.integrations.otlp./v1/logs` | | [**New Relic** ↗︎](https://docs.newrelic.com/docs/opentelemetry/best-practices/opentelemetry-otlp/) | `https://otlp.nr-data.net/v1/traces` | `https://otlp.nr-data.net/v1/logs` | | [**Splunk Observability** ↗︎](https://dev.splunk.com/observability/reference/api/ingest_data/latest) | `https://ingest..signalfx.com/v2/trace/otlp` | N/A | | [**Splunk Platform** ↗︎](https://github.com/splunk/splunk-connect-for-otlp) | `http://splunk.internal:4318/v1/traces` | `http://splunk.internal:4318/v1/logs` | | [**SigNoz** ↗︎](https://signoz.io/docs/integrations/outposts/cloudflare-workers/) | `https://ingest..signoz.cloud:443/v1/traces` | `https://ingest..signoz.cloud:443/v1/logs` | Authentication Most providers require authentication headers. Check your provider documentation for specific requirements. ## Create a destination Create an account-level Cloudflare Observability destination first. Protocol Cloudflare does not support the [binary format ↗︎](https://opentelemetry.io/docs/specs/otlp/#binary-protobuf-encoding) for OTLP ingestion. ![Observability Destinations dashboard showing configured destinations for Grafana and Honeycomb with their respective endpoints and status](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1794,height=750,format=webp/_astro/destinations.B-CW_OSI.png) 1. In the Cloudflare dashboard, go to **Observability** > **Destinations**. [Go to **OpenTelemetry** ↗](https://dash.cloudflare.com/?to=/:account/observability/destinations) 2. Select **Add destination**. 3. Configure the destination: - **Destination name** - Enter a descriptive name, such as `grafana-traces`. - **Destination type** - Select *Traces* or *Logs*. - **OTLP endpoint** - Enter the provider endpoint for your telemetry type. - **Custom headers** - Add any provider authentication headers. 4. Select **Save**. ![Edit Destination dialog showing configuration for Honeycomb tracing with destination name, type selection, OTLP endpoint, and custom headers](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1942,height=974,format=webp/_astro/destination-setup.B8cxx8yd.png) ## Enable export for Cloudflare Traces Add the destination under **Export destinations** in your domain settings. Refer to [Cloudflare Traces configuration](https://developers.cloudflare.com/observability/traces/configuration/#export-traces). ## Enable OpenTelemetry export for your Worker Configure and redeploy your Worker after creating a destination. Refer to [Workers OpenTelemetry export](https://developers.cloudflare.com/workers/observability/opentelemetry-export/). ## Check destination status The dashboard shows each destination delivery status. The status reflects the most recent delivery attempt. | Status | Description | Troubleshooting | | --- | --- | --- | | **Last: n minutes ago** | Cloudflare delivered data recently. | No action required | | **Never run** | Cloudflare has not delivered data. | Check source traffic, export settings, and sampling rates | | **Error** | Cloudflare could not deliver data. | Check the OTLP endpoint and authentication headers | ## Known limitations Some providers do not support every OTLP telemetry type. Check the [available destinations](#available-destinations) and your provider documentation. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/observability/export/opentelemetry/#page","headline":"OpenTelemetry export","description":"Export Cloudflare logs and traces to OpenTelemetry destinations.","url":"https://developers.cloudflare.com/observability/export/opentelemetry/","inLanguage":"en","image":"https://developers.cloudflare.com/observability/export/opentelemetry/og.png?v=2a6205b4ded568cd","dateModified":"2026-10-02","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Send Cloudflare traces and logs to Axiom with OpenTelemetry. title: Export to Axiom image: https://developers.cloudflare.com/observability/export/opentelemetry/axiom/og.png?v=501bb85a9cd9f2d9 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/observability/llms.txt > Use this file to discover all available pages before exploring further. # Export to Axiom Last updated Oct 2, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/observability/export/opentelemetry/axiom/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Axiom stores, searches, and analyzes telemetry data. Export Cloudflare traces and logs to query data and create dashboards. ![Trace view with timing information displayed on a timeline](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=3773,height=1235,format=webp/_astro/axiom-example.BRPbEoGh.png) This guide configures Axiom to receive Cloudflare traces and logs. ## Prerequisites Before you begin, you need an active [Axiom account ↗︎](https://app.axiom.co/register). You also need Cloudflare logs or traces to export. ## 1. Create a dataset Skip this step if you already have a dataset. 1. Log in to your [Axiom account ↗︎](https://app.axiom.co/). 2. Go to **Datasets**. 3. Select **New Dataset**. 4. Enter a name, such as `cloudflare-otel`. 5. Select **Create Dataset**. ## 2. Get an Axiom API token 1. Go to **Settings** > **API Tokens**. 2. Select **Create API Token**. 3. Enter a descriptive name, such as `cloudflare-otel`. 4. Select the **Ingest** permission. 5. Select datasets for the token, or select **All Datasets**. 6. Select **Create**. 7. Copy and securely store the API token. The API token starts with `xaat-`. ## 3. Configure a Cloudflare Observability destination Axiom provides separate OpenTelemetry Protocol (OTLP) endpoints for traces and logs: - **Traces**: `https://api.axiom.co/v1/traces` - **Logs**: `https://api.axiom.co/v1/logs` 1. In the Cloudflare dashboard, go to **Observability** > **Destinations**. [Go to **OpenTelemetry** ↗](https://dash.cloudflare.com/?to=/:account/observability/destinations) 2. Select **Add destination**. 3. Configure the destination: - **Destination name**: Enter `axiom-traces` or `axiom-logs`. - **Destination type**: Select *Traces* or *Logs*. - **OTLP endpoint**: Enter the matching Axiom endpoint. 4. Add an authentication header: - **Header name**: `Authorization` - **Header value**: `Bearer ` 5. Add the dataset header: - **Header name**: `X-Axiom-Dataset` - **Header value**: Your dataset name 6. Select **Save**. ## 4. Enable export Creating a destination does not start exporting telemetry. To export [Workers Logs](https://developers.cloudflare.com/workers/observability/logs/workers-logs/) or [Workers Traces](https://developers.cloudflare.com/workers/observability/traces/), [configure OpenTelemetry export for your Worker](https://developers.cloudflare.com/workers/observability/opentelemetry-export/). To export [Cloudflare Traces](https://developers.cloudflare.com/observability/traces/), [configure export for your domain](https://developers.cloudflare.com/observability/traces/configuration/#export-traces). Data may take several minutes to appear in Axiom. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/observability/export/opentelemetry/axiom/#page","headline":"Export to Axiom","description":"Send Cloudflare traces and logs to Axiom with OpenTelemetry.","url":"https://developers.cloudflare.com/observability/export/opentelemetry/axiom/","inLanguage":"en","image":"https://developers.cloudflare.com/observability/export/opentelemetry/axiom/og.png?v=501bb85a9cd9f2d9","dateModified":"2026-10-02","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Send Cloudflare traces and logs to Grafana Cloud. title: Export to Grafana Cloud image: https://developers.cloudflare.com/observability/export/opentelemetry/grafana-cloud/og.png?v=5df6f3224492c5f5 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/observability/llms.txt > Use this file to discover all available pages before exploring further. # Export to Grafana Cloud Last updated Oct 2, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/observability/export/opentelemetry/grafana-cloud/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Grafana Cloud provides visualization, alerting, and telemetry analytics. It accepts Cloudflare telemetry through the OpenTelemetry Protocol (OTLP). Export Cloudflare traces to Grafana Tempo and logs to Grafana Loki. ![Grafana Tempo trace view showing a distributed trace for a service with multiple spans including fetch requests, durable object subrequests, and queue operations, with timing information displayed on a timeline](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1934,height=714,format=webp/_astro/grafana-traces.CuFntNVO.png) This guide configures Grafana Cloud to receive Cloudflare traces and logs. ## Prerequisites Before you begin, you need an active [Grafana Cloud account ↗︎](https://grafana.com/auth/sign-up/create-user). You also need Cloudflare logs or traces to export. ## 1. Get your OpenTelemetry credentials 1. Log in to the [Grafana Cloud portal ↗︎](https://grafana.com/). 2. From your organization home page, go to **Connections** > **Add new connection**. 3. Search for `OpenTelemetry`, then select **OpenTelemetry (OTLP)**. 4. Select **Quickstart**, then select **JavaScript**. 5. Select **Create a new token**. 6. Enter a token name, such as `cloudflare-otel`. 7. Select **Create token**, then select **Close**. 8. Copy the `OTEL_EXPORTER_OTLP_ENDPOINT` value from **Environment variables**. 9. Copy the `OTEL_EXPORTER_OTLP_HEADERS` value from the same block. ## 2. Configure Cloudflare Observability destinations 1. In the Cloudflare dashboard, go to **Observability** > **Destinations**. [Go to **OpenTelemetry** ↗](https://dash.cloudflare.com/?to=/:account/observability/destinations) 2. Select **Add destination**. 3. Enter a descriptive destination name, such as `grafana-traces`. 4. For **Destination type**, select *Traces* or *Logs*. Create a separate destination for each type you export. 5. Enter the Grafana OTLP endpoint for your telemetry type: - **Traces**: Append `/v1/traces` to the endpoint. - **Logs**: Append `/v1/logs` to the endpoint. 6. Add the Grafana authentication header: - **Header name**: `Authorization` - **Header value**: The Basic authentication value from Grafana 7. Select **Save**. The endpoint resembles `https://otlp-gateway-prod-us-east-2.grafana.net/otlp`. ## 3. Enable export Creating a destination does not start exporting telemetry. To export [Workers Logs](https://developers.cloudflare.com/workers/observability/logs/workers-logs/) or [Workers Traces](https://developers.cloudflare.com/workers/observability/traces/), [configure OpenTelemetry export for your Worker](https://developers.cloudflare.com/workers/observability/opentelemetry-export/). To export [Cloudflare Traces](https://developers.cloudflare.com/observability/traces/), [configure export for your domain](https://developers.cloudflare.com/observability/traces/configuration/#export-traces). Data may take several minutes to appear in Grafana Cloud. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/observability/export/opentelemetry/grafana-cloud/#page","headline":"Export to Grafana Cloud","description":"Send Cloudflare traces and logs to Grafana Cloud.","url":"https://developers.cloudflare.com/observability/export/opentelemetry/grafana-cloud/","inLanguage":"en","image":"https://developers.cloudflare.com/observability/export/opentelemetry/grafana-cloud/og.png?v=5df6f3224492c5f5","dateModified":"2026-10-02","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Send Cloudflare traces and logs to Honeycomb with OpenTelemetry. title: Export to Honeycomb image: https://developers.cloudflare.com/observability/export/opentelemetry/honeycomb/og.png?v=a91ac1dd9ce63aa2 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/observability/llms.txt > Use this file to discover all available pages before exploring further. # Export to Honeycomb Last updated Oct 2, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/observability/export/opentelemetry/honeycomb/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Honeycomb is an observability platform for high-cardinality telemetry data. Export Cloudflare telemetry to Honeycomb to query logs, inspect traces, and create dashboards. ![Trace view including POST request, fetch operations, durable object subrequest, and queue send, with timing information displayed on a timeline](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2196,height=704,format=webp/_astro/honeycomb-example.cEkEF1c4.png) This guide configures Honeycomb to receive Cloudflare traces and logs. ## Prerequisites Before you begin, you need an active [Honeycomb account ↗︎](https://ui.honeycomb.io/signup). You also need Cloudflare logs or traces to export. ## 1. Get your Honeycomb API key 1. Log in to your [Honeycomb account ↗︎](https://ui.honeycomb.io/). 2. From your profile menu, select **Team Settings**. 3. Select **Environments**, then select the gear icon. 4. Select an environment or create one. 5. Under **API Keys**, select **Create Ingest API Key**. 6. Enter a descriptive name, such as `cloudflare-otel`. 7. Select **Can create services/datasets**. 8. Select **Create**. 9. Copy and securely store the API key. The API key starts with `hcaik_`. ## 2. Configure Cloudflare Observability destinations Honeycomb provides separate OpenTelemetry Protocol (OTLP) endpoints for traces and logs: - **Traces**: `https://api.honeycomb.io/v1/traces` - **Logs**: `https://api.honeycomb.io/v1/logs` ### Configure a traces destination 1. In the Cloudflare dashboard, go to **Observability** > **Destinations**. [Go to **OpenTelemetry** ↗](https://dash.cloudflare.com/?to=/:account/observability/destinations) 2. Select **Add destination**. 3. Configure the destination: - **Destination name**: `honeycomb-traces` - **Destination type**: *Traces* - **OTLP endpoint**: `https://api.honeycomb.io/v1/traces` - **Custom header name**: `x-honeycomb-team` - **Custom header value**: Your Honeycomb API key 4. Select **Save**. ### Configure a logs destination 1. Select **Add destination** again. 2. Configure the destination: - **Destination name**: `honeycomb-logs` - **Destination type**: *Logs* - **OTLP endpoint**: `https://api.honeycomb.io/v1/logs` - **Custom header name**: `x-honeycomb-team` - **Custom header value**: Your Honeycomb API key 3. Select **Save**. ## 3. Enable export Creating a destination does not start exporting telemetry. To export [Workers Logs](https://developers.cloudflare.com/workers/observability/logs/workers-logs/) or [Workers Traces](https://developers.cloudflare.com/workers/observability/traces/), [configure OpenTelemetry export for your Worker](https://developers.cloudflare.com/workers/observability/opentelemetry-export/). To export [Cloudflare Traces](https://developers.cloudflare.com/observability/traces/), [configure export for your domain](https://developers.cloudflare.com/observability/traces/configuration/#export-traces). Data may take several minutes to appear in Honeycomb. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/observability/export/opentelemetry/honeycomb/#page","headline":"Export to Honeycomb","description":"Send Cloudflare traces and logs to Honeycomb with OpenTelemetry.","url":"https://developers.cloudflare.com/observability/export/opentelemetry/honeycomb/","inLanguage":"en","image":"https://developers.cloudflare.com/observability/export/opentelemetry/honeycomb/og.png?v=a91ac1dd9ce63aa2","dateModified":"2026-10-02","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Send Cloudflare logs to PostHog with OpenTelemetry. title: Export to PostHog image: https://developers.cloudflare.com/observability/export/opentelemetry/posthog/og.png?v=b04f19c37d80595b --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/observability/llms.txt > Use this file to discover all available pages before exploring further. # Export to PostHog Last updated Oct 2, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/observability/export/opentelemetry/posthog/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) PostHog provides product analytics, logs, and error tracking. Export Cloudflare logs to correlate them with sessions and events. ![PostHog logs view with attributes expanded and a timeline view at the top](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2580,height=1702,format=webp/_astro/posthog-example.DhJh65s7.png) This guide configures PostHog to receive Cloudflare logs. ## Prerequisites Before you begin, you need: - An active [PostHog account ↗︎](https://app.posthog.com/signup) - Your PostHog project API key - Cloudflare logs available for export ## 1. Get your PostHog project API key 1. Log in to your [PostHog account ↗︎](https://app.posthog.com/). 2. Go to [**Project settings** ↗︎](https://app.posthog.com/settings/project). 3. Find **Project API key** in the project details. 4. Copy the project API key. The project API key starts with `phc_`. ## 2. Select your PostHog endpoint PostHog uses different endpoints for each data region: | Region | Logs endpoint | | --- | --- | | **US** (default) | `https://us.i.posthog.com/i/v1/logs` | | **EU** | `https://eu.i.posthog.com/i/v1/logs` | Find your region in your PostHog project settings. Your PostHog URL also contains `us` or `eu`. ## 3. Configure a Cloudflare Observability destination Caution PostHog accepts logs through its OpenTelemetry Protocol (OTLP) endpoint. It does not accept traces through OTLP. 1. In the Cloudflare dashboard, go to **Observability** > **Destinations**. [Go to **OpenTelemetry** ↗](https://dash.cloudflare.com/?to=/:account/observability/destinations) 2. Select **Add destination**. 3. Configure the destination: - **Destination name**: `posthog-logs` - **Destination type**: *Logs* - **OTLP endpoint**: Your PostHog regional logs endpoint - **Custom header name**: `Authorization` - **Custom header value**: `Bearer ` 4. Select **Save**. ![Cloudflare destination configuration for PostHog logs with destination name, type selection, OTLP endpoint, and custom headers](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1194,height=1180,format=webp/_astro/posthog-example-destination-modal.Dkn5CFBP.png) ## 4. Enable export Creating a destination does not start exporting logs. To export [Workers Logs](https://developers.cloudflare.com/workers/observability/logs/workers-logs/), [configure OpenTelemetry export for your Worker](https://developers.cloudflare.com/workers/observability/opentelemetry-export/). PostHog does not support [Workers Traces](https://developers.cloudflare.com/workers/observability/traces/) or [Cloudflare Traces](https://developers.cloudflare.com/observability/traces/) through OTLP. ## 5. View logs in PostHog 1. Log in to your [PostHog account ↗︎](https://app.posthog.com/). 2. Go to **Logs**. 3. Review exported severity levels, timestamps, and attributes. You can filter logs by severity, time range, attributes, and keywords. ## Troubleshooting ### Logs do not appear in PostHog 1. Verify that the API key starts with `phc_`. 2. Confirm that the endpoint matches your PostHog region. 3. Check the destination status in the Cloudflare dashboard. 4. Check whether sampling excludes the expected logs. ### Fix authentication errors Confirm that the `Authorization` value includes the `Bearer` prefix. Also verify that the project API key remains active. Alternatively, add the token to the endpoint query string: `https://us.i.posthog.com/i/v1/logs?token=`. ## Related resources - [PostHog logs documentation ↗︎](https://posthog.com/docs/logs) - [PostHog getting started with logs ↗︎](https://posthog.com/docs/logs/start-here) - [OpenTelemetry logs specification ↗︎](https://opentelemetry.io/docs/specs/otel/logs/) Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/observability/export/opentelemetry/posthog/#page","headline":"Export to PostHog","description":"Send Cloudflare logs to PostHog with OpenTelemetry.","url":"https://developers.cloudflare.com/observability/export/opentelemetry/posthog/","inLanguage":"en","image":"https://developers.cloudflare.com/observability/export/opentelemetry/posthog/og.png?v=b04f19c37d80595b","dateModified":"2026-10-02","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Send Cloudflare traces and logs to Sentry with OpenTelemetry. title: Export to Sentry image: https://developers.cloudflare.com/observability/export/opentelemetry/sentry/og.png?v=247022c35dd41725 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/observability/llms.txt > Use this file to discover all available pages before exploring further. # Export to Sentry Last updated Oct 2, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/observability/export/opentelemetry/sentry/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Sentry provides distributed tracing, logs, and application monitoring. Export Cloudflare telemetry to query data and create alerts or dashboards. ![Sentry trace view with timing information displayed on a timeline](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2474,height=862,format=webp/_astro/sentry-example.DU-HO2rh.png) This guide configures Sentry to receive Cloudflare traces and logs. ## Prerequisites Before you begin, you need an active [Sentry account ↗︎](https://sentry.io/signup/). You also need Cloudflare logs or traces to export. ## 1. Create a Sentry project Skip this step if you already have a project. 1. Log in to your [Sentry account ↗︎](https://sentry.io/). 2. Go to **Insights** > **Projects**. 3. Select [**New Project** ↗︎](https://sentry.io/orgredirect/organizations/:orgslug/insights/projects/new/). 4. Complete the project form, then select **Create Project**. ## 2. Get your Sentry OTLP endpoints Sentry provides separate OpenTelemetry Protocol (OTLP) endpoints for traces and logs: - **Traces**: `https:///api//integration/otlp/v1/traces` - **Logs**: `https:///api//integration/otlp/v1/logs` 1. In Sentry, go to [**Settings** > **Projects** ↗︎](https://sentry.io/orgredirect/organizations/:orgslug/settings/projects/). 2. Select your project. 3. Under **SDK Setup**, select **Client Keys (DSN)**. 4. Copy the OTLP endpoints and authentication header. For endpoint details, refer to [Sentry OTLP documentation ↗︎](https://docs.sentry.io/concepts/otlp/). ## 3. Configure Cloudflare Observability destinations In the Cloudflare dashboard, go to **Observability** > **Destinations**. [Go to **OpenTelemetry** ↗](https://dash.cloudflare.com/?to=/:account/observability/destinations) ### Configure a traces destination 1. Select **Add destination**. 2. Configure the destination: - **Destination name**: `sentry-traces` - **Destination type**: *Traces* - **OTLP endpoint**: Your Sentry OTLP traces endpoint - **Custom header name**: `x-sentry-auth` - **Custom header value**: `sentry sentry_key=` 3. Select **Save**. ### Configure a logs destination 1. Select **Add destination**. 2. Configure the destination: - **Destination name**: `sentry-logs` - **Destination type**: *Logs* - **OTLP endpoint**: Your Sentry OTLP logs endpoint - **Custom header name**: `x-sentry-auth` - **Custom header value**: `sentry sentry_key=` 3. Select **Save**. ## 4. Enable export Creating a destination does not start exporting telemetry. To export [Workers Logs](https://developers.cloudflare.com/workers/observability/logs/workers-logs/) or [Workers Traces](https://developers.cloudflare.com/workers/observability/traces/), [configure OpenTelemetry export for your Worker](https://developers.cloudflare.com/workers/observability/opentelemetry-export/). To export [Cloudflare Traces](https://developers.cloudflare.com/observability/traces/), [configure export for your domain](https://developers.cloudflare.com/observability/traces/configuration/#export-traces). Data may take several minutes to appear in Sentry. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/observability/export/opentelemetry/sentry/#page","headline":"Export to Sentry","description":"Send Cloudflare traces and logs to Sentry with OpenTelemetry.","url":"https://developers.cloudflare.com/observability/export/opentelemetry/sentry/","inLanguage":"en","image":"https://developers.cloudflare.com/observability/export/opentelemetry/sentry/og.png?v=247022c35dd41725","dateModified":"2026-10-02","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Understand Cloudflare Observability ingestion and storage pricing. title: Pricing image: https://developers.cloudflare.com/observability/pricing/og.png?v=6b4ce7ba6d5bba9b --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/observability/llms.txt > Use this file to discover all available pages before exploring further. # Pricing Last updated Oct 15, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/observability/pricing/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Beginning December 1, 2026, all Cloudflare logs and traces will use the same pricing model. Log Explorer datasets have a different price point of $1 per GB ingested and include 30-day retention. Queries, dashboards, alerts, and analytics do not incur additional charge. Refer to [Datasets](https://developers.cloudflare.com/observability/logs/datasets/) to review the price point and retention for each dataset. ## Included in the new Observability pricing The following logs and traces share account-level ingestion and storage allowances: - [Cloudflare Traces](https://developers.cloudflare.com/observability/traces/) - [Workers Logs](https://developers.cloudflare.com/workers/observability/logs/workers-logs/) - [Workers Traces](https://developers.cloudflare.com/workers/observability/traces/) - [Containers logs](https://developers.cloudflare.com/containers/faq/#how-do-container-logs-work) - [R2 Data Access Logs](https://developers.cloudflare.com/r2/buckets/data-access-logs/) - [AI Gateway logs](https://developers.cloudflare.com/ai-gateway/observability/logging/) - [Issues](https://developers.cloudflare.com/workers/observability/issues/) ### Plans | Plan | Included ingestion | Included storage | Additional ingestion | Additional storage | | --- | --- | --- | --- | --- | | Free | 0.5 GB per day | Seven-day retention included | Not available | Not separately metered | | Paid | 50 GB per billing cycle | 10 GB-month per billing cycle | $0.25 per GB | $0.10 per GB-month | Enterprise accounts move to this pricing when their contract renews. Until then, existing contract terms apply. Paid usage continues automatically after an allowance is exhausted. Ingestion and storage are separate meters, so unused ingestion allowance cannot be applied to storage or the reverse. Allowances do not roll over between billing cycles. You will be able to view your current ingestion and storage usage, remaining allowances, and estimated charges in **Billable Usage**. On Free, Cloudflare stops ingesting new data when the account reaches its daily limit. Ingestion resumes when the allowance resets at 00:00 UTC. Stored data remains queryable for its seven-day retention period. ### How usage is measured #### Ingestion Ingestion includes the event body, the default enriched attributes, and custom attributes. Ingestion is pre-compression and does not include dropped events. Sampling data before storage reduces both ingestion and storage usage. #### Storage Storage is measured in GB-month using the maximum amount of queryable data stored each day: > **GB-month = sum of each day's maximum queryable GB / 30** For example, 1 GB that remains queryable for 30 days contributes 1 GB-month. Data stops contributing to storage usage when it is no longer queryable. ### Example Suppose a Paid account uses 75 GB of ingestion and 20 GB-month of storage during one billing cycle: | Usage | Calculation | Additional charge | | --- | --- | --- | | Ingestion | (75 GB - 50 GB included) x $0.25 | $6.25 | | Storage | (20 GB-month - 10 GB-month included) x $0.10 | $0.80 | | Total | $6.25 + $0.80 | $7.05 | ### Longer retention Logs and traces in the shared allowance have a default seven-day retention. Log Explorer datasets include 30-day retention. Cloudflare plans to add configurable 30, 90, and 365-day retention periods in the future. ### Existing customers Existing Workers Observability customers on Free, Pro, and Business plans automatically move to this pricing on December 1, 2026. Ingestion charges apply only to data received on or after that date. Enterprise accounts move at contract renewal. For Paid accounts, data retained on December 1 begins contributing to storage usage from that date. Usage before December 1 is not charged retroactively. ## Log Explorer (Legacy) Log Explorer datasets preserve complete event fidelity and use a different ingestion price point. Their usage does not consume the pooled allowances in [Plans](#plans). For usage estimates, monitoring, and deactivation, refer to [Pricing and managing usage](https://developers.cloudflare.com/observability/logs/log-explorer/pricing/). | Ingestion | Retention | Queries | | --- | --- | --- | | $1 per GB ingested | 30 days | No additional charge | Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/observability/pricing/#page","headline":"Pricing","description":"Understand Cloudflare Observability ingestion and storage pricing.","url":"https://developers.cloudflare.com/observability/pricing/","inLanguage":"en","image":"https://developers.cloudflare.com/observability/pricing/og.png?v=6b4ce7ba6d5bba9b","dateModified":"2026-10-15","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ```