Cloudflare Logs with Sazabi

Last verified on Nov 8, 2026.

Cloudflare sits in front of your application, so its logs answer a different question than your application logs do. They show what arrived at the edge, what the edge did with it and what it passed through. Sazabi takes two kinds of Cloudflare data.

Two sources, two questions

Logpush exports zone and account logs over HTTP: HTTP requests, firewall events, DNS logs, network analytics, audit logs, Zero Trust logs and more. You can connect your account and let Sazabi create and manage a job per dataset, or create a Logpush job yourself with an HTTP destination. Both work on every Cloudflare plan since September 30, 2026; Free, Pro and Business accounts pay Cloudflare per GB beyond the included monthly usage, and the Workers trace events dataset needs the Workers Paid plan (Cloudflare: Logpush availability).

Workers telemetry carries console output and OTLP traces from your Workers. It does not use Logpush and has its own prerequisites.

Use Logpush to see traffic and security decisions at the edge. Use Workers telemetry to see your own code run.

What the datasets tell you

Each dataset is one Logpush job, with zone datasets set up per zone and account datasets per account. A few worth knowing:

• http_requests is one record per request. It keeps Cloudflare's default fields to hold down volume.
• firewall_events records WAF, rate limiting, bot and DDoS actions. It ships all of its fields, including the WAF RuleID, Source and Description.
• dns_logs needs Cloudflare authoritative DNS.
• audit_logs holds account audit logs.

Sazabi keeps each record as Cloudflare sends it and reads the event time from the dataset's timestamp field.

Example: which rule is blocking traffic

Suppose support reports that customers in one region can't reach checkout. The firewall_events dataset holds the answer. In a Sazabi thread, ask for the firewall events for that zone over the last hour, grouped by RuleID and Description.

RuleID        Description                      Count
9f2c...       Rate limit: /api/checkout        3,412
b71e...       Managed rule: SQLi in body          18

This is an example result with made-up values. One rule with thousands of hits points straight at the cause. A rate limit set too low for a promotion is a configuration change you can make today, while a managed rule firing on legitimate bodies needs an exception. The same group-by on http_requests can show cache behavior. Cloudflare documents CacheCacheStatus values such as hit, miss and dynamic, where dynamic means the request was not eligible for cache, for instance because the firewall blocked it.

Limits to plan around

Logpush has no storage or search of its own, and Cloudflare pushes batches as soon as it can, so records arrive close to real time. Each zone dataset stream is one Logpush job. Cloudflare's job limits depend on the plan and dataset, and some existing Enterprise customers keep a limit of four jobs per dataset, so a zone that already has jobs for another tool can leave less room.

Some datasets need the Cloudflare product that produces them, such as Access, Gateway or Spectrum. Zero Trust datasets also need the Zero Trust PII Read permission on the API token. If a dataset is missing from the picker, check the product and the token before you look anywhere else.

Running both sources together

Logpush and Workers telemetry answer different halves of one incident. Say a rate limit rule blocks a burst of requests and a Worker behind it starts failing on the rest. The firewall records show the blocked traffic. The Worker logs show the errors that got through. Looking at only one of them tells half the story.

Keep a short note of which zones and Workers send to Sazabi. Logpush is configured per zone or account in the Cloudflare dashboard, while Workers telemetry is configured per Worker in its Wrangler file, so the two can drift apart without anyone noticing. A weekly look at the Intake page for volume per source catches a stopped job.

Set up in short

For the native path, create an API token with Account Settings Read, Account Logs Edit, Zone Read and Zone Logs Edit, connect it in Sazabi and pick datasets. For a manual job, choose the HTTP destination, paste the intake URL and set the timestamp format to RFC3339.

Cloudflare Workers can also export OpenTelemetry data, so the OpenTelemetry integration explains the protocol underneath. Other platforms in the same family are listed under cloud platforms. If a Cloudflare feature sends webhooks instead, the Webhook Events source stores them as logs.