Skip to content

[Logs] Adds APIRequest component to Logs destinations #23594

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 11, 2025
Merged

[Logs] Adds APIRequest component to Logs destinations #23594

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
58 changes: 32 additions & 26 deletions src/content/docs/logs/get-started/enable-destinations/datadog.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ head:

---

import { Render, TabItem, Tabs } from "~/components"
import { Render, TabItem, Tabs, APIRequest } from "~/components"

Cloudflare Logpush supports pushing logs directly to Datadog via the Cloudflare dashboard or via API.

Expand Down Expand Up @@ -100,21 +100,30 @@ To create a job, make a `POST` request to the Logpush jobs endpoint with the fol

Example request using cURL:

```bash
curl https://api.cloudflare.com/client/v4/zones/{zone_id}/logpush/jobs \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>" \
--header "Content-Type: application/json" \
--data '{
"name": "<DOMAIN_NAME>",
"destination_conf": "datadog://<DATADOG_ENDPOINT_URL>?header_DD-API-KEY=<DATADOG_API_KEY>&ddsource=cloudflare&service=<SERVICE>&host=<HOST>&ddtags=<TAGS>",
"output_options": {
"field_names": ["ClientIP", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "EdgeEndTimestamp", "EdgeResponseBytes", "EdgeResponseStatus" ,"EdgeStartTimestamp", "RayID"],
"timestamp_format": "rfc3339"
},
"dataset": "http_requests"
}'
```
<APIRequest
path="/zones/{zone_id}/logpush/jobs"
method="POST"
json={{
name: "<DOMAIN_NAME>",
destination_conf:
"datadog://<DATADOG_ENDPOINT_URL>?header_DD-API-KEY=<DATADOG_API_KEY>&ddsource=cloudflare&service=<SERVICE>&host=<HOST>&ddtags=<TAGS>",
output_options: {
field_names: [
"ClientIP",
"ClientRequestHost",
"ClientRequestMethod",
"ClientRequestURI",
"EdgeEndTimestamp",
"EdgeResponseBytes",
"EdgeResponseStatus",
"EdgeStartTimestamp",
"RayID"
],
timestamp_format: "rfc3339"
},
dataset: "http_requests"
}}
/>

Response:

Expand Down Expand Up @@ -146,16 +155,13 @@ To enable a job, make a `PUT` request to the Logpush jobs endpoint. You will use

Example request using cURL:

```bash
curl --request PUT \
https://api.cloudflare.com/client/v4/zones/{zone_id}/logpush/jobs/{job_id} \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>" \
--header "Content-Type: application/json" \
--data '{
"enabled": true
}'
```
<APIRequest
path="/zones/{zone_id}/logpush/jobs/{job_id}"
method="PUT"
json={{
enabled: true
}}
/>

Response:

Expand Down
30 changes: 15 additions & 15 deletions src/content/docs/logs/get-started/enable-destinations/elastic.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,8 @@ head:

---

import { APIRequest } from "~/components"

Push your Cloudflare logs to Elastic for instant visibility and insights. Enabling this integration with Elastic comes with a predefined dashboard to view all of your Cloudflare observability and security data with ease.

The Cloudflare Logpush integration can be used in three different modes to collect data:
Expand Down Expand Up @@ -39,21 +41,19 @@ Add the same custom header along with its value on both sides for additional sec

For example, while creating a job along with a header and value for a particular dataset:

```bash
curl --location https://api.cloudflare.com/zones/{zone_id}/logpush/jobs \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>" \
--header "Content-Type: application/json" \
--data-raw '{
"name": "<PUBLIC_DOMAIN>",
"destination_conf": "https://<PUBLIC_DOMAIN>:<PUBLIC_PORT>?header_<SECRET_HEADER>=<SECRET_VALUE>",
"dataset": "http_requests",
"output_options": {
"field_names": ["RayID","EdgeStartTimestamp"],
"timestamp_format": "rfc3339"
}
}'
```
<APIRequest
path="/zones/{zone_id}/logpush/jobs"
method="POST"
json={{
name: "<PUBLIC_DOMAIN>",
destination_conf: "https://<PUBLIC_DOMAIN>:<PUBLIC_PORT>?header_<SECRET_HEADER>=<SECRET_VALUE>",
dataset: "http_requests",
output_options: {
field_names: ["RayID", "EdgeStartTimestamp"],
timestamp_format: "rfc3339"
}
}}
/>

## Enable the Integration in Elastic

Expand Down
37 changes: 18 additions & 19 deletions src/content/docs/logs/get-started/enable-destinations/http.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ sidebar:

---

import { Render } from "~/components"
import { Render, APIRequest } from "~/components"

Cloudflare Logpush now supports the ability to send logs to configurable HTTP endpoints.

Expand Down Expand Up @@ -68,21 +68,20 @@ The `ownership_challenge` parameter is not required to create a Logpush job to a

## Example curl request

```bash
curl https://api.cloudflare.com/client/v4/zones/{zone_id}/logpush/jobs \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>" \
--header "Content-Type: application/json" \
--data '{
"name": "theburritobot.com-https",
"output_options": {
"field_names": ["EdgeStartTimestamp", "RayID"],
"timestamp_format": "rfc3339"
},
"destination_conf": "https://logs.example.com?header_Authorization=Basic%20REDACTED&tags=host:theburritobot.com,dataset:http_requests",
"max_upload_bytes": 5000000,
"max_upload_records": 1000,
"dataset": "http_requests",
"enabled": true
}'
```
<APIRequest
path="/zones/{zone_id}/logpush/jobs"
method="POST"
json={{
name: "theburritobot.com-https",
output_options: {
field_names: ["EdgeStartTimestamp", "RayID"],
timestamp_format: "rfc3339"
},
destination_conf:
"https://logs.example.com?header_Authorization=Basic%20REDACTED&tags=host:theburritobot.com,dataset:http_requests",
max_upload_bytes: 5000000,
max_upload_records: 1000,
dataset: "http_requests",
enabled: true
}}
/>
61 changes: 29 additions & 32 deletions src/content/docs/logs/get-started/enable-destinations/ibm-cloud-logs.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,8 @@ head:

---

import { APIRequest } from "~/components"

Cloudflare Logpush supports pushing logs directly to IBM Cloud Logs via API. The dashboard functionality will later be added.

## Manage via API
Expand Down Expand Up @@ -43,28 +45,26 @@ To create a job, make a `POST` request to the Logpush jobs endpoint with the fol

Example request using cURL:

```bash
curl https://api.cloudflare.com/client/v4/zones/{zone_id}/logpush/jobs \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>" \
--header "Content-Type: application/json" \
--data '{
"name": "<DOMAIN_NAME>",
"output_options": {
"output_type": "ndjson",
"timestamp_format": "rfc3339",
"batch_prefix": "[",
"batch_suffix": "]",
"record_prefix": "{\"applicationName\":\"ibm-platform-log\",\"subsystemName\":\"internet-svcs:logpush\",\"text\":{",
"record_suffix": "}}",
"record_delimiter": ","
},
"destination_conf": "ibmcl://<INSTANCE_ID>.ingress.<REGION>.logs.cloud.ibm.com/logs/v1/singles?ibm_api_key=<IBM_API_KEY>",
"max_upload_bytes": 2000000,
"dataset": "http_requests",
"enabled": true
}'
```
<APIRequest
method="POST"
path="/zones/{zone_id}/logpush/jobs"
json={{
name: "<DOMAIN_NAME>",
output_options: {
output_type: "ndjson",
timestamp_format: "rfc3339",
batch_prefix: "[",
batch_suffix: "]",
record_prefix: "{\"applicationName\":\"ibm-platform-log\",\"subsystemName\":\"internet-svcs:logpush\",\"text\":{",
record_suffix: "}}",
record_delimiter: ","
},
destination_conf: "ibmcl://<INSTANCE_ID>.ingress.<REGION>.logs.cloud.ibm.com/logs/v1/singles?ibm_api_key=<IBM_API_KEY>",
max_upload_bytes: 2000000,
dataset: "http_requests",
enabled: true
}}
/>

Response:

Expand Down Expand Up @@ -103,16 +103,13 @@ To enable a job, make a `PUT` request to the Logpush jobs endpoint. You will use

Example request using cURL:

```bash
curl --request PUT \
https://api.cloudflare.com/client/v4/zones/{zone_id}/logpush/jobs/{job_id} \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>" \
--header "Content-Type: application/json" \
--data '{
"enabled": true
}'
```
<APIRequest
method="PUT"
path="/zones/{zone_id}/logpush/jobs/{job_id}"
json={{
enabled: true
}}
/>

Response:

Expand Down
88 changes: 52 additions & 36 deletions src/content/docs/logs/get-started/enable-destinations/ibm-qradar.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@ sidebar:
order: 98
---

import { APIRequest } from "~/components"

To configure a QRadar/Cloudflare integration you have the option to use one of the following methods:

- [HTTP Receiver protocol](/logs/get-started/enable-destinations/ibm-qradar/#http-receiver-protocol)
Expand All @@ -16,45 +18,59 @@ To send Cloudflare logs to QRadar you need to create a [Logpush job to HTTP endp

### Cloudflare Firewall events

```bash
curl https://api.cloudflare.com/client/v4/zones/{zone_id}/logpush/jobs \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>" \
--header "Content-Type: application/json" \
--data '{
"name": "<NAME>",
"output_options": {
"field_names": ["Action", "ClientIP", "ClientASN", "ClientASNDescription", "ClientCountry", "ClientIPClass","ClientRefererHost", "ClientRefererPath", "ClientRefererQuery", "ClientRefererScheme", "ClientRequestHost","ClientRequestMethod", "ClientRequestPath", "ClientRequestProtocol", "ClientRequestQuery", "ClientRequestScheme","ClientRequestUserAgent", "EdgeColoCode", "EdgeResponseStatus", "Kind", "MatchIndex", "Metadata","OriginResponseStatus", "OriginatorRayID", "RayID", "RuleID", "Source", "Datetime"],
"timestamp_format": "rfc3339"
},
"destination_conf": "<QRADAR_URL>:<LOG_SOURCE_PORT>",
"max_upload_bytes": 5000000,
"max_upload_records": 1000,
"dataset": "firewall_events",
"enabled": true
}'
```
<APIRequest
method="POST"
path="/zones/{zone_id}/logpush/jobs"
json={{
name: "<NAME>",
output_options: {
field_names: [
"Action", "ClientIP", "ClientASN", "ClientASNDescription", "ClientCountry", "ClientIPClass",
"ClientRefererHost", "ClientRefererPath", "ClientRefererQuery", "ClientRefererScheme",
"ClientRequestHost", "ClientRequestMethod", "ClientRequestPath", "ClientRequestProtocol",
"ClientRequestQuery", "ClientRequestScheme", "ClientRequestUserAgent", "EdgeColoCode",
"EdgeResponseStatus", "Kind", "MatchIndex", "Metadata", "OriginResponseStatus",
"OriginatorRayID", "RayID", "RuleID", "Source", "Datetime"
],
timestamp_format: "rfc3339"
},
destination_conf: "<QRADAR_URL>:<LOG_SOURCE_PORT>",
max_upload_bytes: 5000000,
max_upload_records: 1000,
dataset: "firewall_events",
enabled: true
}}
/>


### Cloudflare HTTP events

```bash
curl https://api.cloudflare.com/client/v4/zones/{zone_id}/logpush/jobs \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>" \
--header "Content-Type: application/json" \
--data '{
"name": "<NAME>",
"output_options": {
"field_names": ["ClientRequestMethod", "EdgeResponseStatus", "ClientIP", "ClientSrcPort", "CacheCacheStatus","ClientCountry", "ClientDeviceType", "ClientIPClass", "ClientMTLSAuthCertFingerprint", "ClientMTLSAuthStatus","ClientRegionCode", "ClientRequestBytes", "ClientRequestHost", "ClientRequestPath", "ClientRequestProtocol","ClientRequestReferer", "ClientRequestScheme", "ClientRequestSource", "ClientRequestURI", "ClientRequestUserAgent","ClientSSLCipher", "ClientSSLProtocol", "ClientXRequestedWith", "EdgeEndTimestamp", "EdgeRequestHost","EdgeResponseBodyBytes", "EdgeResponseBytes", "EdgeServerIP", "EdgeStartTimestamp", "SecurityActions","SecurityRuleIDs", "SecuritySources", "OriginIP", "OriginResponseStatus", "OriginSSLProtocol", "ParentRayID", "RayID", "SecurityAction", "WAFAttackScore", "SecurityRuleID", "SecurityRuleDescription", "WAFSQLiAttackScore","WAFXSSAttackScore", "EdgeStartTimestamp"],
"timestamp_format": "rfc3339"
},
"destination_conf": "<QRADAR_URL>:<LOG_SOURCE_PORT>",
"max_upload_bytes": 5000000,
"max_upload_records": 1000,
"dataset": "http_requests",
"enabled": true
}'
```
<APIRequest
method="POST"
path="/zones/{zone_id}/logpush/jobs"
json={{
name: "<NAME>",
output_options: {
field_names: [
"ClientRequestMethod", "EdgeResponseStatus", "ClientIP", "ClientSrcPort", "CacheCacheStatus",
"ClientCountry", "ClientDeviceType", "ClientIPClass", "ClientMTLSAuthCertFingerprint", "ClientMTLSAuthStatus",
"ClientRegionCode", "ClientRequestBytes", "ClientRequestHost", "ClientRequestPath", "ClientRequestProtocol",
"ClientRequestReferer", "ClientRequestScheme", "ClientRequestSource", "ClientRequestURI", "ClientRequestUserAgent",
"ClientSSLCipher", "ClientSSLProtocol", "ClientXRequestedWith", "EdgeEndTimestamp", "EdgeRequestHost",
"EdgeResponseBodyBytes", "EdgeResponseBytes", "EdgeServerIP", "EdgeStartTimestamp", "SecurityActions",
"SecurityRuleIDs", "SecuritySources", "OriginIP", "OriginResponseStatus", "OriginSSLProtocol", "ParentRayID",
"RayID", "SecurityAction", "WAFAttackScore", "SecurityRuleID", "SecurityRuleDescription", "WAFSQLiAttackScore",
"WAFXSSAttackScore", "EdgeStartTimestamp"
],
timestamp_format: "rfc3339"
},
destination_conf: "<QRADAR_URL>:<LOG_SOURCE_PORT>",
max_upload_bytes: 5000000,
max_upload_records: 1000,
dataset: "http_requests",
enabled: true
}}
/>

Cloudflare checks the accessibility of the IP address, port, and validates the certificate of the HTTP Receive log source. If all parameters are valid, a Logpush is created, and starts to send events to HTTP Receiver log source.

Expand Down
Loading