Logpush

LogpushDatasets

LogpushDatasetsFields

List fields

logpush.datasets.fields.get(, ) -> FieldGetResponse

GET/{accounts_or_zones}/{account_or_zone_id}/logpush/datasets/{dataset_id}/fields

ModelsExpand Collapse

Dict[str, str]

LogpushDatasetsJobs

List Logpush jobs for a dataset

logpush.datasets.jobs.get(, ) -> SyncSinglePage[Optional[LogpushJob]]

GET/{accounts_or_zones}/{account_or_zone_id}/logpush/datasets/{dataset_id}/jobs

LogpushEdge

List Instant Logs jobs

logpush.edge.get() -> SyncSinglePage[Optional[InstantLogpushJob]]

GET/zones/{zone_id}/logpush/edge/jobs

Create Instant Logs job

logpush.edge.create() -> InstantLogpushJob

POST/zones/{zone_id}/logpush/edge/jobs

ModelsExpand Collapse

class InstantLogpushJob: …

destination_conf: Optional[str]

Unique WebSocket address that will receive messages from Cloudflare’s edge.

formaturi

maxLength4096

fields: Optional[str]

Comma-separated list of fields.

filter: Optional[str]

Filters to drill down into specific events.

sample: Optional[int]

The sample parameter is the sample rate of the records set by the client: “sample”: 1 is 100% of records “sample”: 10 is 10% and so on.

session_id: Optional[str]

Unique session id of the job.

LogpushJobs

List Logpush jobs

logpush.jobs.list() -> SyncSinglePage[Optional[LogpushJob]]

GET/{accounts_or_zones}/{account_or_zone_id}/logpush/jobs

Get Logpush job details

logpush.jobs.get(, ) -> LogpushJob

GET/{accounts_or_zones}/{account_or_zone_id}/logpush/jobs/{job_id}

Create Logpush job

logpush.jobs.create() -> LogpushJob

POST/{accounts_or_zones}/{account_or_zone_id}/logpush/jobs

Update Logpush job

logpush.jobs.update(, ) -> LogpushJob

PUT/{accounts_or_zones}/{account_or_zone_id}/logpush/jobs/{job_id}

Delete Logpush job

logpush.jobs.delete(, ) -> JobDeleteResponse

DELETE/{accounts_or_zones}/{account_or_zone_id}/logpush/jobs/{job_id}

ModelsExpand Collapse

class LogpushJob: …

id: Optional[int]

Unique id of the job.

minimum1

dataset: Optional[Literal["access_requests", "account_abuse_protection_events", "audit_logs", 34 more]]

Name of the dataset. A list of supported datasets can be found on the Developer Docs.

One of the following:

"access_requests"

"account_abuse_protection_events"

"audit_logs"

"audit_logs_v2"

"biso_user_actions"

"casb_findings"

"device_posture_results"

"dex_application_tests"

"dex_device_state_events"

"dlp_forensic_copies"

"dns_firewall_logs"

"dns_logs"

"email_security_alerts"

"email_security_post_delivery_events"

"firewall_events"

"gateway_dns"

"gateway_http"

"gateway_network"

"http_requests"

"ipsec_logs"

"magic_bgp_logs"

"magic_ids_detections"

"mcp_portal_logs"

"mnm_flow_logs"

"nel_reports"

"network_analytics_logs"

"page_shield_events"

"sinkhole_http_logs"

"spectrum_events"

"ssh_logs"

"turnstile_events"

"warp_config_changes"

"warp_toggle_changes"

"websocket_analytics"

"workers_trace_events"

"zaraz_events"

"zero_trust_network_sessions"

destination_conf: Optional[str]

Uniquely identifies a resource (such as an s3 bucket) where data. will be pushed. Additional configuration parameters supported by the destination may be included.

formaturi

maxLength4096

enabled: Optional[bool]

Flag that indicates if the job is enabled.

error_message: Optional[str]

If not null, the job is currently failing. Failures are usually. repetitive (example: no permissions to write to destination bucket). Only the last failure is recorded. On successful execution of a job the error_message and last_error are set to null.

Deprecatedfrequency: Optional[Literal["high", "low"]]

This field is deprecated. Please use max_upload_* parameters instead. . The frequency at which Cloudflare sends batches of logs to your destination. Setting frequency to high sends your logs in larger quantities of smaller files. Setting frequency to low sends logs in smaller quantities of larger files.

One of the following:

"high"

"low"

kind: Optional[Literal["", "edge"]]

The kind parameter (optional) is used to differentiate between Logpush and Edge Log Delivery jobs (when supported by the dataset).

One of the following:

""

"edge"

last_complete: Optional[datetime]

Records the last time for which logs have been successfully pushed. If the last successful push was for logs range 2018-07-23T10:00:00Z to 2018-07-23T10:01:00Z then the value of this field will be 2018-07-23T10:01:00Z. If the job has never run or has just been enabled and hasn’t run yet then the field will be empty.

formatdate-time

last_error: Optional[datetime]

Records the last time the job failed. If not null, the job is currently. failing. If null, the job has either never failed or has run successfully at least once since last failure. See also the error_message field.

formatdate-time

Deprecatedlogpull_options: Optional[str]

This field is deprecated. Use output_options instead. Configuration string. It specifies things like requested fields and timestamp formats. If migrating from the logpull api, copy the url (full url or just the query string) of your call here, and logpush will keep on making this call for you, setting start and end times appropriately.

formaturi-reference

maxLength4096

max_upload_bytes: Optional[Union[Literal[0], int, null]]

The maximum uncompressed file size of a batch of logs. This setting value must be between 5 MB and 1 GB, or 0 to disable it. Note that you cannot set a minimum file size; this means that log files may be much smaller than this batch size.

One of the following:

Literal[0]

The maximum uncompressed file size of a batch of logs. This setting value must be between 5 MB and 1 GB, or 0 to disable it. Note that you cannot set a minimum file size; this means that log files may be much smaller than this batch size.

int

max_upload_interval_seconds: Optional[Union[Literal[0], int, null]]

The maximum interval in seconds for log batches. This setting must be between 30 and 300 seconds (5 minutes), or 0 to disable it. Note that you cannot specify a minimum interval for log batches; this means that log files may be sent in shorter intervals than this.

One of the following:

Literal[0]

The maximum interval in seconds for log batches. This setting must be between 30 and 300 seconds (5 minutes), or 0 to disable it. Note that you cannot specify a minimum interval for log batches; this means that log files may be sent in shorter intervals than this.

int

max_upload_records: Optional[Union[Literal[0], int, null]]

The maximum number of log lines per batch. This setting must be between 1000 and 1,000,000 lines, or 0 to disable it. Note that you cannot specify a minimum number of log lines per batch; this means that log files may contain many fewer lines than this.

One of the following:

Literal[0]

The maximum number of log lines per batch. This setting must be between 1000 and 1,000,000 lines, or 0 to disable it. Note that you cannot specify a minimum number of log lines per batch; this means that log files may contain many fewer lines than this.

int

Optional human readable job name. Not unique. Cloudflare suggests. that you set this to a meaningful string, like the domain name, to make it easier to identify your job.

maxLength512

output_options: Optional[OutputOptions]

The structured replacement for logpull_options. When including this field, the logpull_option field will be ignored.

class OutputOptions: …

The structured replacement for logpull_options. When including this field, the logpull_option field will be ignored.

batch_prefix: Optional[str]

String to be prepended before each batch.

batch_suffix: Optional[str]

String to be appended after each batch.

cve_2021_44228: Optional[bool]

If set to true, will cause all occurrences of ${ in the generated files to be replaced with x{.

field_delimiter: Optional[str]

String to join fields. This field be ignored when record_template is set.

field_names: Optional[List[str]]

List of field names to be included in the Logpush output. For the moment, there is no option to add all fields at once, so you must specify all the fields names you are interested in.

merge_subrequests: Optional[bool]

If set to true, subrequests will be merged into the parent request. Only supported for the http_requests dataset.

output_type: Optional[Literal["ndjson", "csv"]]

Specifies the output type, such as ndjson or csv. This sets default values for the rest of the settings, depending on the chosen output type. Some formatting rules, like string quoting, are different between output types.

One of the following:

"ndjson"

"csv"

record_delimiter: Optional[str]

String to be inserted in-between the records as separator.

record_prefix: Optional[str]

String to be prepended before each record.

record_suffix: Optional[str]

String to be appended after each record.

record_template: Optional[str]

String to use as template for each record instead of the default json key value mapping. All fields used in the template must be present in field_names as well, otherwise they will end up as null. Format as a Go text/template without any standard functions, like conditionals, loops, sub-templates, etc.

sample_rate: Optional[float]

Specifies the sampling rate as a floating number greater than 0 and at most 1. Sampling is applied on top of filtering, and regardless of the current sample_interval of the data.

formatfloat

exclusiveMinimum

maximum1

minimum0

timestamp_format: Optional[Literal["unixnano", "unix", "rfc3339", 2 more]]

String to specify the format for timestamps, such as unixnano, unix, rfc3339, rfc3339ms or rfc3339ns.

One of the following:

"unixnano"

"unix"

"rfc3339"

"rfc3339ms"

"rfc3339ns"

class JobDeleteResponse: …

id: Optional[int]

Unique id of the job.

minimum1

LogpushOwnership

Get ownership challenge

logpush.ownership.create() -> OwnershipCreateResponse

POST/{accounts_or_zones}/{account_or_zone_id}/logpush/ownership

Validate ownership challenge

logpush.ownership.validate() -> OwnershipValidation

POST/{accounts_or_zones}/{account_or_zone_id}/logpush/ownership/validate

ModelsExpand Collapse

class OwnershipValidation: …

valid: Optional[bool]

class OwnershipCreateResponse: …

filename: Optional[str]

message: Optional[str]

valid: Optional[bool]

LogpushTransformers

List transformers

logpush.transformers.list() -> SyncSinglePage[TransformerListResponse]

GET/accounts/{account_id}/logpush/transformers

Get transformer

logpush.transformers.get(, ) -> TransformerGetResponse

GET/accounts/{account_id}/logpush/transformers/{transformer_id}

Create transformer

logpush.transformers.create() -> TransformerCreateResponse

POST/accounts/{account_id}/logpush/transformers

Update transformer

logpush.transformers.update(, ) -> TransformerUpdateResponse

PUT/accounts/{account_id}/logpush/transformers/{transformer_id}

Delete transformer

logpush.transformers.delete(, ) -> TransformerDeleteResponse

DELETE/accounts/{account_id}/logpush/transformers/{transformer_id}

Preview transformer

logpush.transformers.preview() -> SyncSinglePage[TransformerPreviewResponse]

POST/accounts/{account_id}/logpush/transformers/preview

ModelsExpand Collapse

class TransformerListResponse: …

id: Optional[int]

The transformer ID.

minimum1

associated_jobs: Optional[List[AssociatedJob]]

Logpush jobs that reference this transformer.

id: Optional[int]

The logpush job ID.

The logpush job destination name.

object_tag: Optional[str]

The zone or account tag.

object_type: Optional[Literal["zone", "account"]]

Whether the job is zone-scoped or account-scoped.

One of the following:

"zone"

"account"

created_at: Optional[datetime]

When the transformer was created (RFC 3339).

formatdate-time

dataset: Optional[str]

The dataset this transformer operates on, derived from the SQL query’s FROM clause. Informational only. May be absent if the dataset cannot be determined from the query.

description: Optional[str]

Optional customer-provided description.

maxLength4096

Customer-provided name for identification.

maxLength255

updated_at: Optional[datetime]

When the transformer was last modified (RFC 3339).

formatdate-time

class TransformerGetResponse: …

id: Optional[int]

The transformer ID.

minimum1

associated_jobs: Optional[List[AssociatedJob]]

Logpush jobs that reference this transformer.

id: Optional[int]

The logpush job ID.

The logpush job destination name.

object_tag: Optional[str]

The zone or account tag.

object_type: Optional[Literal["zone", "account"]]

Whether the job is zone-scoped or account-scoped.

One of the following:

"zone"

"account"

created_at: Optional[datetime]

When the transformer was created (RFC 3339).

formatdate-time

dataset: Optional[str]

The dataset this transformer operates on, derived from the SQL query’s FROM clause. Informational only. May be absent if the dataset cannot be determined from the query.

description: Optional[str]

Optional customer-provided description.

maxLength4096

Customer-provided name for identification.

maxLength255

updated_at: Optional[datetime]

When the transformer was last modified (RFC 3339).

formatdate-time

class TransformerCreateResponse: …

id: Optional[int]

The transformer ID.

minimum1

associated_jobs: Optional[List[AssociatedJob]]

Logpush jobs that reference this transformer.

id: Optional[int]

The logpush job ID.

The logpush job destination name.

object_tag: Optional[str]

The zone or account tag.

object_type: Optional[Literal["zone", "account"]]

Whether the job is zone-scoped or account-scoped.

One of the following:

"zone"

"account"

created_at: Optional[datetime]

When the transformer was created (RFC 3339).

formatdate-time

dataset: Optional[str]

The dataset this transformer operates on, derived from the SQL query’s FROM clause. Informational only. May be absent if the dataset cannot be determined from the query.

description: Optional[str]

Optional customer-provided description.

maxLength4096

Customer-provided name for identification.

maxLength255

updated_at: Optional[datetime]

When the transformer was last modified (RFC 3339).

formatdate-time

class TransformerUpdateResponse: …

id: Optional[int]

The transformer ID.

minimum1

associated_jobs: Optional[List[AssociatedJob]]

Logpush jobs that reference this transformer.

id: Optional[int]

The logpush job ID.

The logpush job destination name.

object_tag: Optional[str]

The zone or account tag.

object_type: Optional[Literal["zone", "account"]]

Whether the job is zone-scoped or account-scoped.

One of the following:

"zone"

"account"

created_at: Optional[datetime]

When the transformer was created (RFC 3339).

formatdate-time

dataset: Optional[str]

The dataset this transformer operates on, derived from the SQL query’s FROM clause. Informational only. May be absent if the dataset cannot be determined from the query.

description: Optional[str]

Optional customer-provided description.

maxLength4096

Customer-provided name for identification.

maxLength255

updated_at: Optional[datetime]

When the transformer was last modified (RFC 3339).

formatdate-time

class TransformerDeleteResponse: …

id: Optional[int]

The deleted transformer’s ID.

Dict[str, object]

LogpushTransformersContent

Get transformer content

logpush.transformers.content.get(, ) -> ContentGetResponse

GET/accounts/{account_id}/logpush/transformers/{transformer_id}/content

ModelsExpand Collapse

class ContentGetResponse: …

content: Optional[str]

The SQL query content.

LogpushTransformersVersions

List transformer versions

logpush.transformers.versions.list(, ) -> SyncSinglePage[VersionListResponse]

GET/accounts/{account_id}/logpush/transformers/{transformer_id}/versions

ModelsExpand Collapse

class VersionListResponse: …

id: Optional[int]

Unique identifier for this version.

formatint64

minimum1

created_at: Optional[datetime]

When this version was created (RFC 3339).

formatdate-time

version: Optional[int]

Sequential version number.

minimum1

ModelsExpand Collapse

class ValidateDestinationResponse: …

message: Optional[str]

valid: Optional[bool]

class ValidateDestinationExistsResponse: …

exists: Optional[bool]

class ValidateOriginResponse: …

message: Optional[str]

valid: Optional[bool]

Logpush

LogpushDatasets

LogpushDatasetsFields

ModelsExpand Collapse

LogpushDatasetsJobs

LogpushEdge

ModelsExpand Collapse

LogpushJobs

ModelsExpand Collapse

LogpushOwnership

ModelsExpand Collapse

LogpushTransformers

ModelsExpand Collapse

LogpushTransformersContent

ModelsExpand Collapse

LogpushTransformersVersions

ModelsExpand Collapse

LogpushValidate

ModelsExpand Collapse