Cloudflare

Cloudflare Logpush posts batches of logs to an HTTP destination. Point a job at /v1/ingest, and each record becomes an event.

Logpush needs an Enterprise zone for HTTP requests, or a Workers Paid plan for Workers trace events.

The destination

https://edge.simpledatalogs.com/v1/ingest?header_Authorization=Bearer%20sdl_sec_…&header_Content-Type=application%2Fx-ndjson&header_Content-Encoding=gzip

• header_… parameters become request headers. Logpush always gzips, and the last one says so.
• Logpush tests the destination with one small upload. It shows up once in Unparsed as missing_event.

HTTP requests

Create the job with a record_template, so each request gets an id and a time:

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/logpush/jobs" \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --json '{
    "name": "simpledatalogs",
    "dataset": "http_requests",
    "destination_conf": "https://edge.simpledatalogs.com/v1/ingest?header_Authorization=Bearer%20sdl_sec_…&header_Content-Type=application%2Fx-ndjson&header_Content-Encoding=gzip",
    "max_upload_records": 1000,
    "output_options": {
      "field_names": ["RayID", "EdgeStartTimestamp", "ClientRequestHost", "ClientRequestMethod", "ClientRequestPath", "EdgeResponseStatus", "CacheCacheStatus", "EdgeColoCode"],
      "timestamp_format": "rfc3339ms",
      "record_template": "\"event\":\"http_request\",\"event_id\":{{.RayID}},\"ts\":{{.EdgeStartTimestamp}},\"host\":{{.ClientRequestHost}},\"method\":{{.ClientRequestMethod}},\"path\":{{.ClientRequestPath}},\"status\":{{.EdgeResponseStatus}},\"cache\":{{.CacheCacheStatus}},\"colo\":{{.EdgeColoCode}}"
    },
    "enabled": true
  }'

• Each request is an http_request event, deduped on its Ray ID.
• Leave ClientIP out of field_names; it would be stored as sent.

Workers trace events

Use the account endpoint (/accounts/$ACCOUNT_ID/logpush/jobs) with "dataset": "workers_trace_events" and:

"output_options": {
  "field_names": ["EventTimestampMs", "ScriptName", "Outcome", "Logs", "Exceptions"],
  "record_template": "\"event\":\"worker_invocation\",\"ts\":{{.EventTimestampMs}},\"script\":{{.ScriptName}},\"outcome\":{{.Outcome}},\"logs\":{{.Logs}},\"exceptions\":{{.Exceptions}}"
}

Each invocation is a worker_invocation event, with its console.log lines under logs. These records carry no id, so a retried batch can count twice.

Keep the volume down

Every request is an event

An HTTP requests job sends one record per request to the zone. Use "sample_rate": 0.1 in output_options, or a filter on the job, to send fewer.

• Keep max_upload_records at 1000, so each gzipped batch stays well under the 512 KB limit.

Tested by posting Logpush-shaped batches (gzip NDJSON, sent twice) to the local stack, not against a live Logpush job.

Next steps

• Payload shapes: other tools' events on /v1/ingest.