Cloudflare Logpush Integration

Cloudflare Logpush is a feature that allows you to push HTTP request logs and other Cloudflare-generated logs directly to your desired storage, analytics, and monitoring solutions like Axiom. The integration with Axiom aims to provide real-time insights into web traffic, and operational issues, thereby helping to monitor and troubleshoot effectively.

What is Cloudflare Logpush?

Cloudflare Logpush enables Cloudflare users to automatically export their logs in JSON format to a variety of endpoints. This feature is incredibly useful for analytics, auditing, debugging, and monitoring the performance and security of websites. Types of logs you can export include HTTP request logs, firewall events, and more.

Installing Cloudflare Logpush app

Prerequisites:

  • An active Cloudflare Enterprise account
  • API Tokens or Global API Key. To create an API token, click my profile, select API tokens, and click on create token, you can use a template or create a custom token with the following permissions.

Logpush on zones

You can create a token that has access to a single zone, single account or a mix of all these, depending on your needs, for account access the token must have theses permissions:

  • Logs : Edit
  • Account settings : Read

for the zones, only Logs: Edit is required.

Steps:

  • Login to Cloudflare Dashboard: Navigate to your Cloudflare dashboard and select the Enterprise zone (domain) you wish to enable Logpush for.

  • Set Filters and Fields: Optionally, you can filter logs by field (like Client IP, User Agent, etc.) and set the type of logs you want (e.g., HTTP requests, firewall events).

  • Back in Axiom, Click on settings, select Apps, and install the Cloudflare Logpush App with the token you created from the profile settings in Clouflare.

Install CloudFlare logpush App

  • Next, you will see your available accounts and zones, pick the Cloudflare datasets you want to subscribe to:

Install CloudFlare logpush App

  • The installation will use the Cloudflare API to create Logpush jobs for each dataset that has been selected.

  • After completetion of the installation, you can find the installed Logpush jobs at Cloudflare:

for Zone-scoepd logpush jobs: cloudflare logpush on zone level

for Account-scoped logpush jobs: cloudflare logpush on account level

  • Back in the Axiom, you can see your Cloudflare Logpush dashboard.

Using Axiom with Cloudflare Logpush offers a powerful solution for real-time monitoring, observability, and analytics. Axiom can help you gain deep insights into your application's performance, errors, and application bottlenecks.

Benefits of using the Axiom Cloudflare Logpush Dashboard

  • Real-time Visibility into Web Performance: One of the most crucial features is the ability to see how your website or application is performing in real-time. The dashboard can show everything from page load times to error rates, giving you immediate insights that can help in timely decision-making.

cloudflare logpush on account level

  • Actionable Insights for Troubleshooting: The dashboard doesn't just provide raw data; it provides insights. Whether it's an error that needs immediate fixing or performance metrics that show an error from your application, having this information readily available makes it easier to identify problems and resolve them swiftly.

cloudflare logpush on account level

  • DNS Metrics: Understanding the DNS requests, DNS queries, and DNS cache hit from your application is vital to track if there's a request spike or get the total number of queries in your system.

DNS metrics

  • Centralized Logging and Error Tracing: With logs coming in from various parts of your application stack, centralizing them within Axiom makes it easier to correlate events across different layers of your infrastructure. This is crucial for troubleshooting complex issues that may span multiple services or components.

Centralized loggind and error tracing


Supported Cloudflare Logpush Datasets

Axiom supports all the Cloudflare account-scoped datasets:

Zone-scopedAccount-scoped
  • DNS logs
  • Firewall events
  • HTTP requests
  • NEL reports
  • Spectrum events
  • Access requests
  • Audit logs
  • CASB Findings
  • Device posture results
  • DNS Firewall Logs
  • Gateway DNS
  • Gateway HTTP
  • Gateway Network
  • Magic IDS Detections
  • Network Analytics Logs
  • Workers Trace Events
  • Zero Trust Network Session Logs

Was this page helpful?