Skip to main content

Cloudflare Logs

Send logs to Last9 from Cloudflare for CDN monitoring and worker monitoring via Logpush

Introduction​

This document lists step-by-step instructions for pushing logs from Cloudflare to Last9.

Prerequisites​

  1. Create a Last9 account by following Getting Started.
  2. Keep the following information handy from the Integrations page:
    • $last9_otlp_endpoint: Last9's OTLP endpoint copies from Cloudflare Integration section from Integrations page.
    • $last9_basic_auth_header: OTLP Basic authorization header

Setup​

You can use Cloudflare's Logpush Custom HTTPS endpoint integration to push logs from Cloudflare to Last9. Logpush delivers logs in batches as quickly as possible, with no minimum batch size, potentially delivering files more than once per minute. This capability enables Cloudflare to provide information almost in real time, in smaller file sizes.

Logpush does not offer storage or search functionality for logs; its primary aim is to send logs as quickly as they arrive which makes it perfect candidate to send logs to Last9 Log Management.

Via Cloudflare dashboard​

  1. In Select a destination, choose HTTP destination.

  2. Enter the HTTP endpoint as the Last9 Endpoint, and select Continue.

https://$last9_otlp_endpoint/cloudflare?header_Authorization=<encoded($last9_basic_auth_header)>

  1. Select the dataset to push to the storage service.

  2. In the next step, you need to configure your logpush job:

    • Enter the Job name as Last9.
    • Under If logs match, you can select the events to include and/or remove from your logs. Refer to Filters for more information. Not all datasets have this option available.
    • In Send the following fields, you can choose to either push all logs to Last9 or selectively choose which logs you want to push.

  3. In Advanced Options:

    • Choose the format of timestamp fields in your logs to be UnixNano.

  4. Select Submit once you are done configuring your logpush job.

Via API​

To create a Logpush job, make a POST request to the Logpush job creation endpoint URL with the appropriate parameters.

Example curl request​

curl https://api.cloudflare.com/client/v4/zones/{zone_id}/logpush/jobs \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>" \
--header "Content-Type: application/json" \
--data '{
  "name": "last9",
  "output_options": {
    "field_names": ["EdgeStartTimestamp", "RayID"],
    "timestamp_format": "unixnano"
  },
  "destination_conf": "https://$last9_otlp_endpoint/cloudflare?header_Authorization=<encoded($last9_basic_auth_header)>",
  "dataset": "http_requests",
  "enabled": true
}'

Verification​

Visit Log Explorer to see the Cloudflare logs in action.

Troubleshooting​

Please get in touch with us on Discord or Email if you have any questions.