> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare

> Connect your Cloudflare account so Sazabi can automatically create and manage Logpush jobs for the datasets you select.

[All Cloudflare integration capabilities](https://docs.sazabi.com/catalogs/integrations/cloudflare)

## About

Cloudflare Logpush exports zone and account logs — HTTP requests, WAF and firewall events, DNS queries, Network Analytics, account audit logs, Zero Trust logs, and more — to Sazabi over HTTP. Connecting your account lets Sazabi create and maintain a Logpush job for each dataset you select; Sazabi provisions the job automatically when you add a log stream.

Cloudflare also has a **Send to an endpoint** path where you create the Logpush job yourself and point it at a Sazabi intake URL. See [Cloudflare endpoint page](https://docs.sazabi.com/catalogs/log-sources/send-to-an-endpoint/cloudflare.md) for that setup.

> [!NOTE]
>
> Cloudflare Logpush is available on every plan since September 30, 2026. Free, Pro, and Business accounts pay Cloudflare per GB beyond the included monthly usage; Enterprise accounts keep their contract terms. See Cloudflare's [Logpush availability](https://developers.cloudflare.com/logs/logpush/#availability) and [Logpush pricing](https://developers.cloudflare.com/logs/logpush/pricing/).

### Datasets

Each log stream is one Logpush job for one dataset. Zone datasets get one stream per zone; account datasets get one stream per account. Every dataset except **HTTP requests** ships all of its fields, including the security fields outside Cloudflare's default field set (for example the WAF `RuleID`, `Source`, and `Description` on firewall events). HTTP requests keeps Cloudflare's default fields to hold down volume.

Most datasets need the Cloudflare product that produces them, as the table shows.

| Dataset | Scope | Also needs |
| - | - | - |
| `http_requests` — HTTP requests | Zone | — |
| `firewall_events` — Firewall events (WAF, rate limiting, bot and DDoS actions) | Zone | WAF or another security product active on the zone |
| `dns_logs` — DNS logs | Zone | Cloudflare authoritative DNS |
| `spectrum_events` — Spectrum events | Zone | Spectrum |
| `page_shield_events` — Page Shield events | Zone | Page Shield |
| `nel_reports` — NEL reports | Zone | — |
| `audit_logs` — Audit logs | Account | — |
| `network_analytics_logs` — Network analytics | Account | Magic Transit, Spectrum, or Magic Network Monitoring |
| `access_requests` — Access requests | Account | Cloudflare Access, plus **Zero Trust: PII Read** on the token |
| `gateway_dns`, `gateway_http`, `gateway_network` — Gateway DNS, HTTP, and network | Account | Cloudflare Gateway, plus **Zero Trust: PII Read** on the token |
| `zero_trust_network_sessions` — Zero Trust network sessions | Account | Cloudflare Gateway, plus **Zero Trust: PII Read** on the token |
| `ssh_logs` — SSH logs | Account | Access for Infrastructure, plus **Zero Trust: PII Read** on the token |
| `casb_findings` — CASB findings | Account | Cloudflare CASB |
| `device_posture_results` — Device posture results | Account | WARP device posture checks |
| `dlp_forensic_copies` — DLP forensic copies | Account | Cloudflare DLP |
| `dns_firewall_logs` — DNS Firewall logs | Account | DNS Firewall |
| `email_security_alerts` — Email security alerts | Account | Email security |
| `magic_ids_detections` — Magic IDS detections | Account | Magic Firewall IDS |
| `workers_trace_events` — Workers trace events | Account | Workers Paid plan ([Workers Logpush pricing](https://developers.cloudflare.com/workers/platform/pricing/#workers-trace-events-logpush)) |

Sazabi keeps each record as Cloudflare sends it, with the event time read from the dataset's timestamp field.

## Prerequisites

* A Cloudflare account on any plan.
* Permission to create API tokens under **My Profile > API Tokens** in your Cloudflare dashboard.

## Set up in the dashboard

**Step 1**

### Create a Cloudflare API token

Create a Cloudflare API token with the following permissions:

* **Account Settings: Read** (account scope)
* **Account Logs: Edit** (account scope, for account datasets)
* **Zone: Read** (zone scope)
* **Zone Logs: Edit** (zone scope, for zone datasets)

For Zero Trust datasets (Access requests, Gateway DNS, HTTP, and network, SSH logs, and other Zero Trust logs), also add **Zero Trust: PII Read** (account scope). Cloudflare requires it to create Logpush jobs for these datasets.

You can use the [Cloudflare API token template](https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%2C%22scope%22%3A%22account%22%7D%2C%7B%22key%22%3A%22account_logs%22%2C%22type%22%3A%22edit%22%2C%22scope%22%3A%22account%22%7D%2C%7B%22key%22%3A%22logs%22%2C%22type%22%3A%22edit%22%2C%22scope%22%3A%22zone%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%2C%22scope%22%3A%22zone%22%7D%5D\&name=Sazabi+Cloudflare+Logpush) to pre-fill the required permissions. Pick the account you want to connect, click **Continue to summary**, then **Create Token**, and copy the token.

**Step 2**

### Find your Cloudflare account ID

Your account ID is the 32-character hexadecimal string in your Cloudflare dashboard URL or on the **Account Overview** page.

**Step 3**

### Connect in Sazabi

Go to [**Settings > Log streams**](https://app.sazabi.com/settings/log-source-providers), click **Add source**, and select **Cloudflare Logpush**. Enter your API token and account ID, then click **Connect**.

Sazabi validates the token and account ID against the Cloudflare API. Once confirmed, your connection appears in the log source list.

**Step 4**

### Add log streams

After the connection is saved, click **Add log stream** to open the dataset picker. Select the zone or account datasets you want to forward. For each selected dataset Sazabi creates a Logpush job pointed at a dedicated intake URL (the public key it embeds is handled for you) — no further configuration is needed on the Cloudflare side.

## Set up with the CLI

You can also connect the Cloudflare log source with the [Sazabi CLI](https://docs.sazabi.com/reference/cli.md) (installed and authenticated — see [CLI reference](https://docs.sazabi.com/reference/cli/log-sources.md)).

Create a native connection by passing your API token and account ID as metadata:

```bash theme={"system"}
sazabi log-sources create cloudflare --mode native \
  --metadata '{"cloudflareApiToken":"'"$CLOUDFLARE_API_TOKEN"'","accountId":"<your account ID>"}'
```

Use the same token permissions as the dashboard flow (Account Settings Read, Account Logs Edit, Zone Read, Zone Logs Edit, plus Zero Trust PII Read for Zero Trust datasets). The CLI validates the token and account ID against the Cloudflare API and creates the log source; note the log source ID it prints.

Add a log stream — one Logpush job per dataset — with `sazabi log-streams create`. Pass the dataset in `--config`; use `"scope":"account"` for account-scoped datasets, or `"scope":"zone"` with the zone's `zoneId`, `zoneName`, and `accountId` for zone-scoped datasets:

```bash theme={"system"}
# WAF and firewall events for one zone
sazabi log-streams create --log-source-id <log-source-id> \
  --config '{"scope":"zone","accountId":"<your account ID>","zoneId":"<zone ID>","zoneName":"example.com","dataset":"firewall_events"}'

# Network Analytics logs for the account
sazabi log-streams create --log-source-id <log-source-id> \
  --config '{"scope":"account","accountId":"<your account ID>","dataset":"network_analytics_logs"}'
```

Use any dataset id from the [Datasets](#datasets) table.

Run `sazabi log-sources list` to confirm the source and its streams.

## Verify

Generate activity on a connected zone or account — for example send an HTTP request, trigger a firewall rule, or make a DNS query.

Open the [Intake page](https://docs.sazabi.com/guides/instrument/intake.md) in the Sazabi dashboard and confirm that records attributed to the **Cloudflare Logpush** source appear. Logs typically arrive within one to two minutes of the Logpush job delivering them.

## Troubleshooting

**A dataset fails to provision even though the token has the right permissions** — The account may not have the Cloudflare product behind that dataset (see the table above), or it may have reached its Logpush job limit for the dataset. Some existing Enterprise contracts keep a limit of four jobs per dataset; see Cloudflare's [Logpush limits](https://developers.cloudflare.com/logs/logpush/#limits).

**Token validation fails** — Confirm the token has Account Settings Read on the account you entered. Sazabi validates the token by reading that account.

**A log stream fails to provision with a permissions error** — Account datasets need **Account Logs: Edit** and zone datasets need **Zone Logs: Edit**. Zero Trust datasets (Access, Gateway, SSH logs, and Zero Trust network sessions) also need **Zero Trust: PII Read**. Edit the token in Cloudflare to add the missing permission, then add the log stream again.

**No datasets appear in the stream picker** — The account ID must match the account the token was issued for. Verify the 32-character account ID from your Cloudflare dashboard URL.

**Logs stop appearing after a period** — The Logpush job may have been deleted or paused in Cloudflare, or the token may have been revoked. Check the job status under **Analytics & Logs > Logpush** in your Cloudflare dashboard, then reconnect from [**Settings > Log streams**](https://app.sazabi.com/settings/log-source-providers) in Sazabi if needed.

## Further reading

> [card] [Intake](https://docs.sazabi.com/guides/instrument/intake.md)
>
> See per-source ingestion volume and health in the Intake page.

> [card] [Cloudflare (send to an endpoint)](https://docs.sazabi.com/catalogs/log-sources/send-to-an-endpoint/cloudflare.md)
>
> Point a Logpush job you manage yourself at a Sazabi intake URL.

> [card] [Log sources](https://docs.sazabi.com/catalogs/log-sources.md)
>
> Browse the full log source catalog.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.