Skip to content
Start here

Observability

ObservabilityTelemetry

List keys
POST/accounts/{account_id}/workers/observability/telemetry/keys
Run a query
POST/accounts/{account_id}/workers/observability/telemetry/query
List values
POST/accounts/{account_id}/workers/observability/telemetry/values
Prepare live tail
POST/accounts/{account_id}/workers/observability/telemetry/live-tail
Live tail heartbeat
POST/accounts/{account_id}/workers/observability/telemetry/live-tail/heartbeat
ModelsExpand Collapse
TelemetryKeysResponse object { key, lastSeenAt, type }
key: string
lastSeenAt: number
type: "string" or "boolean" or "number"
One of the following:
"string"
"boolean"
"number"
TelemetryQueryResponse object { run, statistics, agents, 6 more }

Complete results of a query run. The populated fields depend on the requested view type (events, calculations, invocations, traces, or agents).

run: object { id, accountId, dry, 8 more }

Represents a single execution of a query against Workers Observability data, including the query definition, execution status, and performance statistics.

id: string

Unique identifier for this query run.

accountId: string

Cloudflare account ID that owns this query run.

dry: boolean

Whether this was a dry run (results not persisted).

granularity: number

Number of time-series buckets used for the query. Higher values produce more detailed series data.

query: object { id, adhoc, created, 6 more }

A saved query definition with its parameters, metadata, and ownership information.

id: string
adhoc: boolean

If the query wasn’t explcitly saved

created: string or string
formatdate-time
One of the following:
string
string
createdBy: string
description: string
maxLength1000
name: string

Query name

maxLength250
minLength1
parameters: object { calculations, datasets, filterCombination, 6 more }
calculations: optional array of object { operator, alias, key, keyType } or object { key, operator, alias, keyType }

Create Calculations to compute as part of the query.

One of the following:
object { operator, alias, key, keyType }
operator: "count" or "COUNT"
One of the following:
"count"
"COUNT"
alias: optional string
key: optional string
keyType: optional "string" or "number" or "boolean"
One of the following:
"string"
"number"
"boolean"
object { key, operator, alias, keyType }
key: string
operator: "uniq" or "max" or "min" or 33 more
One of the following:
"uniq"
"max"
"min"
"sum"
"avg"
"median"
"p001"
"p01"
"p05"
"p10"
"p25"
"p75"
"p90"
"p95"
"p99"
"p999"
"stddev"
"variance"
"COUNT_DISTINCT"
"MAX"
"MIN"
"SUM"
"AVG"
"MEDIAN"
"P001"
"P01"
"P05"
"P10"
"P25"
"P75"
"P90"
"P95"
"P99"
"P999"
"STDDEV"
"VARIANCE"
alias: optional string
keyType: optional "string" or "number" or "boolean"
One of the following:
"string"
"number"
"boolean"
datasets: optional array of string

Set the Datasets to query. Leave it empty to query all the datasets.

filterCombination: optional "and" or "or" or "AND" or "OR"

Set a Flag to describe how to combine the filters on the query.

One of the following:
"and"
"or"
"AND"
"OR"
filters: optional array of object { filterCombination, filters, kind } or object { key, operation, type, 2 more }

Configure the Filters to apply to the query. Supports nested groups via kind: ‘group’.

One of the following:
object { filterCombination, filters, kind }
filterCombination: "and" or "or" or "AND" or "OR"
One of the following:
"and"
"or"
"AND"
"OR"
filters: array of unknown
kind: "group"
WorkersObservabilityFilterLeaf object { key, operation, type, 2 more }

A filter condition applied to query results. Use the keys and values endpoints to discover available fields and their values before constructing filters.

key: string

Filter field name. Use verified keys from previous query results or the keys endpoint. Common keys include $metadata.service, $metadata.origin, $metadata.trigger, $metadata.message, and $metadata.error.

operation: "includes" or "not_includes" or "starts_with" or 27 more

Comparison operator. String operators: includes, not_includes, starts_with, ends_with, regex. Existence: exists, is_null. Set membership: in, not_in (comma-separated values). Numeric: eq, neq, gt, gte, lt, lte.

One of the following:
"includes"
"not_includes"
"starts_with"
"ends_with"
"regex"
"exists"
"is_null"
"in"
"not_in"
"eq"
"neq"
"gt"
"gte"
"lt"
"lte"
"="
"!="
">"
">="
"<"
"<="
"INCLUDES"
"DOES_NOT_INCLUDE"
"MATCH_REGEX"
"EXISTS"
"DOES_NOT_EXIST"
"IN"
"NOT_IN"
"STARTS_WITH"
"ENDS_WITH"
type: "string" or "number" or "boolean"

Data type of the filter field. Must match the actual type of the key being filtered.

One of the following:
"string"
"number"
"boolean"
kind: optional "filter"

Discriminator for leaf filter nodes. Always ‘filter’ when present; may be omitted.

value: optional string or number or boolean

Comparison value. Must match actual values in your data — verify with the values endpoint. Ensure the value type (string/number/boolean) matches the field type. String comparisons are case-sensitive. Regex uses RE2 syntax (no lookaheads/lookbehinds).

One of the following:
string
number
boolean
groupBys: optional array of object { type, value }

Define how to group the results of the query.

type: "string" or "number" or "boolean"
One of the following:
"string"
"number"
"boolean"
value: string
havings: optional array of object { key, operation, value }

Configure the Having clauses that filter on calculations in the query result.

key: string
operation: "eq" or "neq" or "gt" or 3 more
One of the following:
"eq"
"neq"
"gt"
"gte"
"lt"
"lte"
value: number
limit: optional number

Set a limit on the number of results / records returned by the query

maximum100
minimum0
needle: optional object { value, isRegex, matchCase }

Define an expression to search using full-text search.

value:
isRegex: optional boolean
matchCase: optional boolean
orderBy: optional object { value, order }

Configure the order of the results returned by the query.

value: string

Configure which Calculation to order the results by.

order: optional "asc" or "desc"

Set the order of the results

One of the following:
"asc"
"desc"
updated: string or string
formatdate-time
One of the following:
string
string
updatedBy: string
status: "STARTED" or "COMPLETED"

Current execution status of the query run.

One of the following:
"STARTED"
"COMPLETED"
timeframe: object { from, to }

Time range for the query execution. ‘from’ must be earlier than ‘to’. No fractional milliseconds.

from: number

Start timestamp for the query timeframe. Unix timestamp in milliseconds

maximum253402300799999
minimum0
to: number

End timestamp for the query timeframe. Unix timestamp in milliseconds

maximum253402300799999
minimum0
userId: string

ID of the user who initiated the query run.

created: optional string

ISO-8601 timestamp when the query run was created.

statistics: optional object { bytes_read, elapsed, rows_read, abr_level }

Query performance statistics from the database (does not include network latency).

bytes_read: number

Number of uncompressed bytes read from the table.

elapsed: number

Time in seconds for the query to run.

rows_read: number

Number of rows scanned from the table.

abr_level: optional number

The level of Adaptive Bit Rate (ABR) sampling used for the query. If empty the ABR level is 1

updated: optional string

ISO-8601 timestamp when the query run was last updated.

statistics: object { bytes_read, elapsed, rows_read, abr_level }

Query performance statistics from the database. Includes execution time, rows scanned, and bytes read. Does not include network latency.

bytes_read: number

Number of uncompressed bytes read from the table.

elapsed: number

Time in seconds for the query to run.

rows_read: number

Number of rows scanned from the table.

abr_level: optional number

The level of Adaptive Bit Rate (ABR) sampling used for the query. If empty the ABR level is 1

agents: optional array of object { id, errors, models, 13 more }

Agent run summaries. Present when the query view is ‘agents’. Each entry represents one trace containing at least one agent invocation.

id: string

Stable pagination cursor for this agent run.

errors: array of string

Distinct errors reported by spans in the run.

models: array of string

Distinct models reported by chat spans across the run’s trace.

providers: array of string

Distinct GenAI providers reported by chat spans in the run.

services: array of string

Worker services represented in the run’s trace.

spans: number

Number of spans in the run’s trace.

status: "completed" or "error"

Observed run status.

One of the following:
"completed"
"error"
traceDurationMs: number

Total trace duration in milliseconds.

traceEndMs: number

End of the run’s trace as a Unix epoch in milliseconds.

traceId: string

Trace identifier for this agent run.

traceStartMs: number

Start of the run’s trace as a Unix epoch in milliseconds.

agentId: optional string

ID from the earliest agent invocation that provides one.

agentName: optional string

Name from the earliest agent invocation that provides one.

conversationId: optional string

Conversation ID from the earliest invocation that provides one.

inputTokens: optional number

Input tokens summed across chat spans in the run’s trace; informational, not billing data.

outputTokens: optional number

Output tokens summed across chat spans in the run’s trace; informational, not billing data.

calculations: optional array of object { aggregates, calculation, series, alias }

Aggregated calculation results. Present when the query view is ‘calculations’. Contains computed metrics (count, avg, p99, etc.) with optional group-by breakdowns and time-series data.

aggregates: array of object { count, interval, sampleInterval, 2 more }
count: number

Estimated number of matching events: the sum of the sample intervals of the stored events. It equals the number of stored events when sampleInterval is 1.

Deprecatedinterval: number

Deprecated alias of sampleInterval. Always has the same value; use sampleInterval instead.

sampleInterval: number

Average sample interval of the matched events. Each stored event has a sample interval of 1 / (the sampling rate applied when it was ingested): the Worker’s head_sampling_rate multiplied by any platform sampling applied to the account or script. A value of 1 means none of the matched events were sampled. A value above 1 means count and value are estimated from sampled data, not exact. This is independent of statistics.abr_level.

value: number

Result of the calculation. count, sum, avg, median, and percentiles are weighted by each event’s sample interval

groups: optional array of object { key, value }
key: string
value: string or number or boolean
One of the following:
string
number
boolean
calculation: string
series: array of object { data, time }
data: array of object { count, interval, sampleInterval, 4 more }
count: number

Estimated number of matching events: the sum of the sample intervals of the stored events. It equals the number of stored events when sampleInterval is 1.

Deprecatedinterval: number

Deprecated alias of sampleInterval. Always has the same value; use sampleInterval instead.

sampleInterval: number

Average sample interval of the matched events. Each stored event has a sample interval of 1 / (the sampling rate applied when it was ingested): the Worker’s head_sampling_rate multiplied by any platform sampling applied to the account or script. A value of 1 means none of the matched events were sampled. A value above 1 means count and value are estimated from sampled data, not exact. This is independent of statistics.abr_level.

value: number

Result of the calculation. count, sum, avg, median, and percentiles are weighted by each event’s sample interval

firstSeen: optional string
groups: optional array of object { key, value }
key: string
value: string or number or boolean
One of the following:
string
number
boolean
lastSeen: optional string
time: string
alias: optional string
compare: optional array of object { aggregates, calculation, series, alias }

Comparison calculation results from the previous time period. Present when the compare option is enabled. Same structure as calculations.

aggregates: array of object { count, interval, sampleInterval, 2 more }
count: number

Estimated number of matching events: the sum of the sample intervals of the stored events. It equals the number of stored events when sampleInterval is 1.

Deprecatedinterval: number

Deprecated alias of sampleInterval. Always has the same value; use sampleInterval instead.

sampleInterval: number

Average sample interval of the matched events. Each stored event has a sample interval of 1 / (the sampling rate applied when it was ingested): the Worker’s head_sampling_rate multiplied by any platform sampling applied to the account or script. A value of 1 means none of the matched events were sampled. A value above 1 means count and value are estimated from sampled data, not exact. This is independent of statistics.abr_level.

value: number

Result of the calculation. count, sum, avg, median, and percentiles are weighted by each event’s sample interval

groups: optional array of object { key, value }
key: string
value: string or number or boolean
One of the following:
string
number
boolean
calculation: string
series: array of object { data, time }
data: array of object { count, interval, sampleInterval, 4 more }
count: number

Estimated number of matching events: the sum of the sample intervals of the stored events. It equals the number of stored events when sampleInterval is 1.

Deprecatedinterval: number

Deprecated alias of sampleInterval. Always has the same value; use sampleInterval instead.

sampleInterval: number

Average sample interval of the matched events. Each stored event has a sample interval of 1 / (the sampling rate applied when it was ingested): the Worker’s head_sampling_rate multiplied by any platform sampling applied to the account or script. A value of 1 means none of the matched events were sampled. A value above 1 means count and value are estimated from sampled data, not exact. This is independent of statistics.abr_level.

value: number

Result of the calculation. count, sum, avg, median, and percentiles are weighted by each event’s sample interval

firstSeen: optional string
groups: optional array of object { key, value }
key: string
value: string or number or boolean
One of the following:
string
number
boolean
lastSeen: optional string
time: string
alias: optional string
distribution: optional object { bins, bucketBoundaries, bucketMode, 2 more }

Bucketed 2D histogram of a numeric field over time. Present when chartType is ‘distribution’.

bins: array of string

Time-bucket labels (ISO-8601 strings), one per matrix column.

bucketBoundaries: array of number

Raw bucket edges in the value’s native unit, length buckets.length + 1. Used for the colour scale and percentile mapping.

bucketMode: "log" or "linear"

Bucketing scheme used to derive the boundaries. ‘log’ produces geometric edges; ‘linear’ produces fixed-width edges.

One of the following:
"log"
"linear"
buckets: array of string

Value-range labels, one per matrix row (e.g. ‘50–100ms’).

matrix: array of array of number

Sampling-corrected counts. matrix[bucketIdx][binIdx] is the estimated number of events in value-bucket ‘bucketIdx’ during time-bin ‘binIdx’.

events: optional object { count, events, fields, series }

Individual event results. Present when the query view is ‘events’. Contains the matching log lines and their metadata.

count: optional number

Total number of events matching the query (may exceed the number returned due to limits).

events: optional array of object { "$metadata", dataset, source, 3 more }

List of individual telemetry events matching the query.

"$metadata": object { id, account, cloudService, 35 more }

Structured metadata extracted from the event. These fields are indexed and available for filtering and aggregation.

id: string

Unique event ID. Use as the cursor value for offset-based pagination.

account: optional string

Cloudflare account identifier.

cloudService: optional string

Cloudflare product that generated this event (e.g. workers, pages).

coldStart: optional number
exclusiveMinimum
minimum0
cost: optional number

Estimated cost units for this invocation.

exclusiveMinimum
minimum0
duration: optional number

Span duration in milliseconds.

exclusiveMinimum
minimum0
endTime: optional number

Span end time as a Unix epoch in milliseconds.

minimum0
endTimeNs: optional string

Span end time as a Unix epoch in nanoseconds.

error: optional string

Error message, present when the log represents an error.

errorTemplate: optional string

Templatized version of the error message used for grouping similar errors.

eventSize: optional number

Size of the stored telemetry event in bytes.

minimum0
fingerprint: optional string

Content-based fingerprint used to group similar events.

level: optional string

Log level (e.g. log, debug, info, warn, error).

message: optional string

Log message text.

messageTemplate: optional string

Templatized version of the log message used for grouping similar messages.

metricName: optional string

Metric name when the event represents a metric data point.

origin: optional string

Origin of the event (e.g. fetch, scheduled, queue).

parentSpanId: optional string

Span ID of the parent span in the trace hierarchy.

provider: optional string

Infrastructure provider identifier.

rayId: optional string

Cloudflare Ray ID from the cf-ray header of the request that triggered the invocation.

region: optional string

Cloudflare data center / region that handled the request.

requestId: optional string

Cloudflare request ID that ties all logs from a single invocation together.

service: optional string

Worker script name that produced this event.

spanId: optional string

Span ID for this individual unit of work within a trace.

spanName: optional string

Human-readable name for this span.

spanStatus: optional "unset" or "ok" or "error"

OpenTelemetry span status. Present only on spans. unset when the span did not set a status, including spans recorded before status was captured.

One of the following:
"unset"
"ok"
"error"
spanStatusMessage: optional string

OpenTelemetry span status message. Present only on spans when the status is error and a message was set.

stackId: optional string

Stack / deployment identifier.

startTime: optional number

Span start time as a Unix epoch in milliseconds.

minimum0
startTimeNs: optional string

Span start time as a Unix epoch in nanoseconds.

statusCode: optional number

HTTP response status code returned by the Worker.

exclusiveMinimum
minimum0
timestampNs: optional string

Event time as a Unix epoch in nanoseconds.

traceDuration: optional number

Total duration of the entire trace in milliseconds.

exclusiveMinimum
minimum0
traceId: optional string

Distributed trace ID linking spans across services.

transactionName: optional string

Logical transaction name for this request.

trigger: optional string

What triggered the invocation (e.g. GET /users, POST /orders, queue message).

type: optional string

Event type classifier (e.g. cf-worker-event, cf-worker-log).

url: optional string

Request URL that triggered the Worker invocation.

dataset: string

The dataset this event belongs to (e.g. cloudflare-workers).

source: string or map[unknown]

Raw log payload. May be a string or a structured object depending on how the log was emitted.

One of the following:
string
map[unknown]
timestamp: number

Event timestamp as a Unix epoch in milliseconds.

minimum0
"$containers": optional map[unknown]

Cloudflare Containers event information that enriches your logs for identifying and debugging issues.

"$workers": optional object { eventType, scriptName, durableObjectId, 11 more } or object { cpuTimeMs, eventType, outcome, 15 more }

Cloudflare Workers event information that enriches your logs for identifying and debugging issues.

One of the following:
object { eventType, scriptName, durableObjectId, 11 more }
eventType: "fetch" or "scheduled" or "alarm" or 9 more
One of the following:
"fetch"
"scheduled"
"alarm"
"cron"
"queue"
"email"
"tail"
"rpc"
"jsrpc"
"websocket"
"workflow"
"unknown"
scriptName: string
durableObjectId: optional string
entrypoint: optional string
event: optional map[unknown]
executionModel: optional "durableObject" or "stateless"
One of the following:
"durableObject"
"stateless"
gateway: optional object { requestId }
requestId: string
outcome: optional string
preview: optional object { id, name, slug }
id: optional string
name: optional string
slug: optional string
requestId: optional string
scriptVersion: optional object { id, message, tag }
id: optional string
message: optional string
tag: optional string
spanId: optional string
traceId: optional string
truncated: optional boolean
object { cpuTimeMs, eventType, outcome, 15 more }
cpuTimeMs: number
eventType: "fetch" or "scheduled" or "alarm" or 9 more
One of the following:
"fetch"
"scheduled"
"alarm"
"cron"
"queue"
"email"
"tail"
"rpc"
"jsrpc"
"websocket"
"workflow"
"unknown"
outcome: string
scriptName: string
wallTimeMs: number
diagnosticsChannelEvents: optional array of object { channel, message, timestamp }
channel: string
message: string
timestamp: number
dispatchNamespace: optional string
durableObjectId: optional string
entrypoint: optional string
event: optional map[unknown]
executionModel: optional "durableObject" or "stateless"
One of the following:
"durableObject"
"stateless"
gateway: optional object { requestId }
requestId: string
preview: optional object { id, name, slug }
id: optional string
name: optional string
slug: optional string
requestId: optional string
scriptVersion: optional object { id, message, tag }
id: optional string
message: optional string
tag: optional string
spanId: optional string
traceId: optional string
truncated: optional boolean
fields: optional array of object { key, type }

List of fields discovered in the matched events. Useful for building dynamic UIs.

key: string

Field name present in the matched events.

type: string

Data type of the field (string, number, or boolean).

series: optional array of object { data, time }

Time-series data for the matched events, bucketed by the query granularity.

data: array of object { aggregates, count, interval, 3 more }
aggregates: object { _count, _interval, _firstSeen, 2 more }
Deprecated_count: number
exclusiveMinimum
minimum0
Deprecated_interval: number
exclusiveMinimum
minimum0
Deprecated_firstSeen: optional string
Deprecated_lastSeen: optional string
Deprecatedbin: optional unknown
count: number

Estimated number of matching events: the sum of the sample intervals of the stored events. It equals the number of stored events when sampleInterval is 1.

Deprecatedinterval: number

Deprecated alias of sampleInterval. Always has the same value; use sampleInterval instead.

sampleInterval: number

Average sample interval of the matched events. Each stored event has a sample interval of 1 / (the sampling rate applied when it was ingested): the Worker’s head_sampling_rate multiplied by any platform sampling applied to the account or script. A value of 1 means none of the matched events were sampled. A value above 1 means count and value are estimated from sampled data, not exact. This is independent of statistics.abr_level.

errors: optional number
groups: optional map[string or number or boolean]

Groups in the query results.

One of the following:
string
number
boolean
time: string
invocations: optional map[array of object { "$metadata", dataset, source, 3 more } ]

Events grouped by invocation (request ID). Present when the query view is ‘invocations’. Each key is a request ID mapping to all events from that invocation.

"$metadata": object { id, account, cloudService, 35 more }

Structured metadata extracted from the event. These fields are indexed and available for filtering and aggregation.

id: string

Unique event ID. Use as the cursor value for offset-based pagination.

account: optional string

Cloudflare account identifier.

cloudService: optional string

Cloudflare product that generated this event (e.g. workers, pages).

coldStart: optional number
exclusiveMinimum
minimum0
cost: optional number

Estimated cost units for this invocation.

exclusiveMinimum
minimum0
duration: optional number

Span duration in milliseconds.

exclusiveMinimum
minimum0
endTime: optional number

Span end time as a Unix epoch in milliseconds.

minimum0
endTimeNs: optional string

Span end time as a Unix epoch in nanoseconds.

error: optional string

Error message, present when the log represents an error.

errorTemplate: optional string

Templatized version of the error message used for grouping similar errors.

eventSize: optional number

Size of the stored telemetry event in bytes.

minimum0
fingerprint: optional string

Content-based fingerprint used to group similar events.

level: optional string

Log level (e.g. log, debug, info, warn, error).

message: optional string

Log message text.

messageTemplate: optional string

Templatized version of the log message used for grouping similar messages.

metricName: optional string

Metric name when the event represents a metric data point.

origin: optional string

Origin of the event (e.g. fetch, scheduled, queue).

parentSpanId: optional string

Span ID of the parent span in the trace hierarchy.

provider: optional string

Infrastructure provider identifier.

rayId: optional string

Cloudflare Ray ID from the cf-ray header of the request that triggered the invocation.

region: optional string

Cloudflare data center / region that handled the request.

requestId: optional string

Cloudflare request ID that ties all logs from a single invocation together.

service: optional string

Worker script name that produced this event.

spanId: optional string

Span ID for this individual unit of work within a trace.

spanName: optional string

Human-readable name for this span.

spanStatus: optional "unset" or "ok" or "error"

OpenTelemetry span status. Present only on spans. unset when the span did not set a status, including spans recorded before status was captured.

One of the following:
"unset"
"ok"
"error"
spanStatusMessage: optional string

OpenTelemetry span status message. Present only on spans when the status is error and a message was set.

stackId: optional string

Stack / deployment identifier.

startTime: optional number

Span start time as a Unix epoch in milliseconds.

minimum0
startTimeNs: optional string

Span start time as a Unix epoch in nanoseconds.

statusCode: optional number

HTTP response status code returned by the Worker.

exclusiveMinimum
minimum0
timestampNs: optional string

Event time as a Unix epoch in nanoseconds.

traceDuration: optional number

Total duration of the entire trace in milliseconds.

exclusiveMinimum
minimum0
traceId: optional string

Distributed trace ID linking spans across services.

transactionName: optional string

Logical transaction name for this request.

trigger: optional string

What triggered the invocation (e.g. GET /users, POST /orders, queue message).

type: optional string

Event type classifier (e.g. cf-worker-event, cf-worker-log).

url: optional string

Request URL that triggered the Worker invocation.

dataset: string

The dataset this event belongs to (e.g. cloudflare-workers).

source: string or map[unknown]

Raw log payload. May be a string or a structured object depending on how the log was emitted.

One of the following:
string
map[unknown]
timestamp: number

Event timestamp as a Unix epoch in milliseconds.

minimum0
"$containers": optional map[unknown]

Cloudflare Containers event information that enriches your logs for identifying and debugging issues.

"$workers": optional object { eventType, scriptName, durableObjectId, 11 more } or object { cpuTimeMs, eventType, outcome, 15 more }

Cloudflare Workers event information that enriches your logs for identifying and debugging issues.

One of the following:
object { eventType, scriptName, durableObjectId, 11 more }
eventType: "fetch" or "scheduled" or "alarm" or 9 more
One of the following:
"fetch"
"scheduled"
"alarm"
"cron"
"queue"
"email"
"tail"
"rpc"
"jsrpc"
"websocket"
"workflow"
"unknown"
scriptName: string
durableObjectId: optional string
entrypoint: optional string
event: optional map[unknown]
executionModel: optional "durableObject" or "stateless"
One of the following:
"durableObject"
"stateless"
gateway: optional object { requestId }
requestId: string
outcome: optional string
preview: optional object { id, name, slug }
id: optional string
name: optional string
slug: optional string
requestId: optional string
scriptVersion: optional object { id, message, tag }
id: optional string
message: optional string
tag: optional string
spanId: optional string
traceId: optional string
truncated: optional boolean
object { cpuTimeMs, eventType, outcome, 15 more }
cpuTimeMs: number
eventType: "fetch" or "scheduled" or "alarm" or 9 more
One of the following:
"fetch"
"scheduled"
"alarm"
"cron"
"queue"
"email"
"tail"
"rpc"
"jsrpc"
"websocket"
"workflow"
"unknown"
outcome: string
scriptName: string
wallTimeMs: number
diagnosticsChannelEvents: optional array of object { channel, message, timestamp }
channel: string
message: string
timestamp: number
dispatchNamespace: optional string
durableObjectId: optional string
entrypoint: optional string
event: optional map[unknown]
executionModel: optional "durableObject" or "stateless"
One of the following:
"durableObject"
"stateless"
gateway: optional object { requestId }
requestId: string
preview: optional object { id, name, slug }
id: optional string
name: optional string
slug: optional string
requestId: optional string
scriptVersion: optional object { id, message, tag }
id: optional string
message: optional string
tag: optional string
spanId: optional string
traceId: optional string
truncated: optional boolean
traces: optional array of object { rootSpanName, rootTransactionName, service, 6 more }

Trace summaries matching the query. Present when the query view is ‘traces’. Each entry represents a distributed trace with its spans, duration, and services involved.

rootSpanName: string

Name of the root span that initiated the trace.

rootTransactionName: string

Logical transaction name for the root span.

service: array of string

List of Worker services involved in the trace.

spans: number

Total number of spans in the trace.

traceDurationMs: number

Total duration of the trace in milliseconds.

traceEndMs: number

Trace end time as a Unix epoch in milliseconds.

traceId: string

Unique identifier for the distributed trace.

traceStartMs: number

Trace start time as a Unix epoch in milliseconds.

errors: optional array of string

Error messages encountered during the trace, if any.

TelemetryValuesResponse object { dataset, key, type, value }
dataset: string
key: string
type: "string" or "boolean" or "number"
One of the following:
"string"
"boolean"
"number"
value: string or number or boolean
One of the following:
string
number
boolean
TelemetryLiveTailResponse object { wsUrl }
wsUrl: string

WebSocket URL clients connect to in order to stream live tail events.

formaturi
TelemetryLiveTailHeartbeatResponse = unknown

ObservabilityAgents

ObservabilityAgentsTraces

List Agent Traces
GET/accounts/{account_id}/workers/observability/agents/traces
Get an Agent Trace
GET/accounts/{account_id}/workers/observability/agents/traces/{traceId}
List Agent Trace events
GET/accounts/{account_id}/workers/observability/agents/traces/{traceId}/events
ModelsExpand Collapse
TraceListResponse object { agents, conversationIds, errorCount, 19 more }
agents: array of string

Sorted distinct gen_ai.agent.name values of authorized Agent invocations in the Trace within the effective window. Includes every Agent in the Trace, not only those matching the agent filter.

conversationIds: array of string

Sorted distinct gen_ai.conversation.id values of authorized Agent invocations in the Trace within the effective window. Empty when none are recorded.

errorCount: number

Recorded spans with a nonempty error or ERROR status. Counts spans, not distinct messages or incidents.

minimum0
inputTokens: number

Input tokens reported by chat spans in the authorized Trace window; null when none report input usage. Informational, not billing data.

minimum0
lastActivityMs: number

Latest start of an authorized Agent invocation in the Trace within the effective window, as Unix epoch milliseconds. The Trace list is ordered by this value, newest first.

minimum0
llmCallCount: number

Recorded chat spans in the authorized Trace window.

minimum0
llmErrorCount: number

Recorded chat spans with a nonempty error or ERROR status.

minimum0
models: array of string

Sorted distinct response models, falling back to request models, from chat spans in the authorized Trace window.

outputTokens: number

Output tokens reported by chat spans in the authorized Trace window; null when none report output usage. Informational, not billing data.

minimum0
providers: array of string

Sorted distinct GenAI providers from chat spans in the authorized Trace window.

rootSpanName: string

Name of the root span that initiated the trace.

rootTransactionName: string

Logical transaction name for the root span.

services: array of string

Authorized Worker services represented in the trace.

spans: number

Total number of spans in the trace.

toolCallCount: number

Recorded execute_tool spans in the authorized Trace window. Custom-named approval spans are not counted.

minimum0
toolErrorCount: number

Recorded execute_tool spans with a nonempty error or ERROR status.

minimum0
totalTokens: number

Input plus output tokens; null if either direction is unreported. Does not add cache or reasoning breakdowns.

minimum0
traceDurationMs: number

Total duration of the trace in milliseconds.

traceEndMs: number

Trace end time as a Unix epoch in milliseconds.

traceId: string

Unique identifier for the distributed trace.

traceStartMs: number

Trace start time as a Unix epoch in milliseconds.

errors: optional array of string

Error messages encountered during the trace, if any.

TraceGetResponse object { agents, conversationIds, errorCount, 19 more }
agents: array of string

Sorted distinct gen_ai.agent.name values of authorized Agent invocations in the Trace within the effective window. Includes every Agent in the Trace, not only those matching the agent filter.

conversationIds: array of string

Sorted distinct gen_ai.conversation.id values of authorized Agent invocations in the Trace within the effective window. Empty when none are recorded.

errorCount: number

Recorded spans with a nonempty error or ERROR status. Counts spans, not distinct messages or incidents.

minimum0
inputTokens: number

Input tokens reported by chat spans in the authorized Trace window; null when none report input usage. Informational, not billing data.

minimum0
lastActivityMs: number

Latest start of an authorized Agent invocation in the Trace within the effective window, as Unix epoch milliseconds. The Trace list is ordered by this value, newest first.

minimum0
llmCallCount: number

Recorded chat spans in the authorized Trace window.

minimum0
llmErrorCount: number

Recorded chat spans with a nonempty error or ERROR status.

minimum0
models: array of string

Sorted distinct response models, falling back to request models, from chat spans in the authorized Trace window.

outputTokens: number

Output tokens reported by chat spans in the authorized Trace window; null when none report output usage. Informational, not billing data.

minimum0
providers: array of string

Sorted distinct GenAI providers from chat spans in the authorized Trace window.

rootSpanName: string

Name of the root span that initiated the trace.

rootTransactionName: string

Logical transaction name for the root span.

services: array of string

Authorized Worker services represented in the trace.

spans: number

Total number of spans in the trace.

toolCallCount: number

Recorded execute_tool spans in the authorized Trace window. Custom-named approval spans are not counted.

minimum0
toolErrorCount: number

Recorded execute_tool spans with a nonempty error or ERROR status.

minimum0
totalTokens: number

Input plus output tokens; null if either direction is unreported. Does not add cache or reasoning breakdowns.

minimum0
traceDurationMs: number

Total duration of the trace in milliseconds.

traceEndMs: number

Trace end time as a Unix epoch in milliseconds.

traceId: string

Unique identifier for the distributed trace.

traceStartMs: number

Trace start time as a Unix epoch in milliseconds.

errors: optional array of string

Error messages encountered during the trace, if any.

TraceEventsResponse = array of object { "$metadata", dataset, source, 3 more }
"$metadata": object { id, account, cloudService, 35 more }

Structured metadata extracted from the event. These fields are indexed and available for filtering and aggregation.

id: string

Unique event ID. Use as the cursor value for offset-based pagination.

account: optional string

Cloudflare account identifier.

cloudService: optional string

Cloudflare product that generated this event (e.g. workers, pages).

coldStart: optional number
exclusiveMinimum
minimum0
cost: optional number

Estimated cost units for this invocation.

exclusiveMinimum
minimum0
duration: optional number

Span duration in milliseconds.

exclusiveMinimum
minimum0
endTime: optional number

Span end time as a Unix epoch in milliseconds.

minimum0
endTimeNs: optional string

Span end time as a Unix epoch in nanoseconds.

error: optional string

Error message, present when the log represents an error.

errorTemplate: optional string

Templatized version of the error message used for grouping similar errors.

eventSize: optional number

Size of the stored telemetry event in bytes.

minimum0
fingerprint: optional string

Content-based fingerprint used to group similar events.

level: optional string

Log level (e.g. log, debug, info, warn, error).

message: optional string

Log message text.

messageTemplate: optional string

Templatized version of the log message used for grouping similar messages.

metricName: optional string

Metric name when the event represents a metric data point.

origin: optional string

Origin of the event (e.g. fetch, scheduled, queue).

parentSpanId: optional string

Span ID of the parent span in the trace hierarchy.

provider: optional string

Infrastructure provider identifier.

rayId: optional string

Cloudflare Ray ID from the cf-ray header of the request that triggered the invocation.

region: optional string

Cloudflare data center / region that handled the request.

requestId: optional string

Cloudflare request ID that ties all logs from a single invocation together.

service: optional string

Worker script name that produced this event.

spanId: optional string

Span ID for this individual unit of work within a trace.

spanName: optional string

Human-readable name for this span.

spanStatus: optional "unset" or "ok" or "error"

OpenTelemetry span status. Present only on spans. unset when the span did not set a status, including spans recorded before status was captured.

One of the following:
"unset"
"ok"
"error"
spanStatusMessage: optional string

OpenTelemetry span status message. Present only on spans when the status is error and a message was set.

stackId: optional string

Stack / deployment identifier.

startTime: optional number

Span start time as a Unix epoch in milliseconds.

minimum0
startTimeNs: optional string

Span start time as a Unix epoch in nanoseconds.

statusCode: optional number

HTTP response status code returned by the Worker.

exclusiveMinimum
minimum0
timestampNs: optional string

Event time as a Unix epoch in nanoseconds.

traceDuration: optional number

Total duration of the entire trace in milliseconds.

exclusiveMinimum
minimum0
traceId: optional string

Distributed trace ID linking spans across services.

transactionName: optional string

Logical transaction name for this request.

trigger: optional string

What triggered the invocation (e.g. GET /users, POST /orders, queue message).

type: optional string

Event type classifier (e.g. cf-worker-event, cf-worker-log).

url: optional string

Request URL that triggered the Worker invocation.

dataset: string

The dataset this event belongs to (e.g. cloudflare-workers).

source: string or map[unknown]

Raw log payload. May be a string or a structured object depending on how the log was emitted.

One of the following:
string
map[unknown]
timestamp: number

Event timestamp as a Unix epoch in milliseconds.

minimum0
"$containers": optional map[unknown]

Cloudflare Containers event information that enriches your logs for identifying and debugging issues.

"$workers": optional object { eventType, scriptName, durableObjectId, 11 more } or object { cpuTimeMs, eventType, outcome, 15 more }

Cloudflare Workers event information that enriches your logs for identifying and debugging issues.

One of the following:
object { eventType, scriptName, durableObjectId, 11 more }
eventType: "fetch" or "scheduled" or "alarm" or 9 more
One of the following:
"fetch"
"scheduled"
"alarm"
"cron"
"queue"
"email"
"tail"
"rpc"
"jsrpc"
"websocket"
"workflow"
"unknown"
scriptName: string
durableObjectId: optional string
entrypoint: optional string
event: optional map[unknown]
executionModel: optional "durableObject" or "stateless"
One of the following:
"durableObject"
"stateless"
gateway: optional object { requestId }
requestId: string
outcome: optional string
preview: optional object { id, name, slug }
id: optional string
name: optional string
slug: optional string
requestId: optional string
scriptVersion: optional object { id, message, tag }
id: optional string
message: optional string
tag: optional string
spanId: optional string
traceId: optional string
truncated: optional boolean
object { cpuTimeMs, eventType, outcome, 15 more }
cpuTimeMs: number
eventType: "fetch" or "scheduled" or "alarm" or 9 more
One of the following:
"fetch"
"scheduled"
"alarm"
"cron"
"queue"
"email"
"tail"
"rpc"
"jsrpc"
"websocket"
"workflow"
"unknown"
outcome: string
scriptName: string
wallTimeMs: number
diagnosticsChannelEvents: optional array of object { channel, message, timestamp }
channel: string
message: string
timestamp: number
dispatchNamespace: optional string
durableObjectId: optional string
entrypoint: optional string
event: optional map[unknown]
executionModel: optional "durableObject" or "stateless"
One of the following:
"durableObject"
"stateless"
gateway: optional object { requestId }
requestId: string
preview: optional object { id, name, slug }
id: optional string
name: optional string
slug: optional string
requestId: optional string
scriptVersion: optional object { id, message, tag }
id: optional string
message: optional string
tag: optional string
spanId: optional string
traceId: optional string
truncated: optional boolean

ObservabilityIssues

List detected issues
GET/accounts/{account_id}/workers/observability/issues
Get an issue
GET/accounts/{account_id}/workers/observability/issues/{issueId}
Modify an issue
PATCH/accounts/{account_id}/workers/observability/issues/{issueId}
Summarize detected issues
GET/accounts/{account_id}/workers/observability/issues/summary
Create an issue group
POST/accounts/{account_id}/workers/observability/issues/groups
Dissolve an issue group
DELETE/accounts/{account_id}/workers/observability/issues/groups/{groupId}
Add issue group members
POST/accounts/{account_id}/workers/observability/issues/groups/{groupId}/members
Remove an issue group member
DELETE/accounts/{account_id}/workers/observability/issues/groups/{groupId}/members/{issueId}
Notify about an issue
POST/accounts/{account_id}/workers/observability/issues/{issueId}/notification-runs
List issue occurrences
GET/accounts/{account_id}/workers/observability/issues/{issueId}/occurrences
ModelsExpand Collapse
IssueListResponse object { id, activity, count, 11 more }
id: string
activity: array of object { id, created, inactivitySeconds, 14 more }
id: string
created: number
inactivitySeconds: number
initiatedBy: "automatic" or "manual"
One of the following:
"automatic"
"manual"
issueCount: number
issueId: string
lastError: string
policyId: string
status: "pending" or "succeeded" or "failed"
One of the following:
"pending"
"succeeded"
"failed"
terminalAt: number
threshold: number
type: "notification"
automationId: optional string
automationName: optional string
automationRevision: optional number
scope: optional "account" or "service"
One of the following:
"account"
"service"
triggerType: optional "occurrence_threshold" or "recurrence_after_inactivity"
One of the following:
"occurrence_threshold"
"recurrence_after_inactivity"
count: number
created: number
firstObserved: number
lastObserved: number
service: string
status: "active" or "resolved" or "ignored"
One of the following:
"active"
"resolved"
"ignored"
statusUpdated: number
title: string
updated: number
fingerprint: optional string
members: optional array of object { fingerprint, issueId, title }
fingerprint: string
issueId: string
title: string
type: optional string
IssueGetResponse object { issue }
issue: object { id, activity, count, 11 more }
id: string
activity: array of object { id, created, inactivitySeconds, 14 more }
id: string
created: number
inactivitySeconds: number
initiatedBy: "automatic" or "manual"
One of the following:
"automatic"
"manual"
issueCount: number
issueId: string
lastError: string
policyId: string
status: "pending" or "succeeded" or "failed"
One of the following:
"pending"
"succeeded"
"failed"
terminalAt: number
threshold: number
type: "notification"
automationId: optional string
automationName: optional string
automationRevision: optional number
scope: optional "account" or "service"
One of the following:
"account"
"service"
triggerType: optional "occurrence_threshold" or "recurrence_after_inactivity"
One of the following:
"occurrence_threshold"
"recurrence_after_inactivity"
count: number
created: number
firstObserved: number
lastObserved: number
service: string
status: "active" or "resolved" or "ignored"
One of the following:
"active"
"resolved"
"ignored"
statusUpdated: number
title: string
updated: number
fingerprint: optional string
members: optional array of object { fingerprint, issueId, title }
fingerprint: string
issueId: string
title: string
type: optional string
IssueUpdateResponse object { id, count, created, 10 more }
id: string
count: number
created: number
firstObserved: number
lastObserved: number
service: string
status: "active" or "resolved" or "ignored"
One of the following:
"active"
"resolved"
"ignored"
statusUpdated: number
title: string
updated: number
fingerprint: optional string
members: optional array of object { fingerprint, issueId, title }
fingerprint: string
issueId: string
title: string
type: optional string
IssueSummaryResponse object { activeIssues, activeOccurrences, lastIssue, resolvedIssues }
activeIssues: number
activeOccurrences: number
lastIssue: number
resolvedIssues: number
IssueGroupResponse object { id, count, created, 10 more }
id: string
count: number
created: number
firstObserved: number
lastObserved: number
service: string
status: "active" or "resolved" or "ignored"
One of the following:
"active"
"resolved"
"ignored"
statusUpdated: number
title: string
updated: number
fingerprint: optional string
members: optional array of object { fingerprint, issueId, title }
fingerprint: string
issueId: string
title: string
type: optional string
IssueUngroupResponse object { deleted }
deleted: true
IssueAddResponse object { id, count, created, 10 more }
id: string
count: number
created: number
firstObserved: number
lastObserved: number
service: string
status: "active" or "resolved" or "ignored"
One of the following:
"active"
"resolved"
"ignored"
statusUpdated: number
title: string
updated: number
fingerprint: optional string
members: optional array of object { fingerprint, issueId, title }
fingerprint: string
issueId: string
title: string
type: optional string
IssueRemoveResponse object { id, count, created, 10 more }
id: string
count: number
created: number
firstObserved: number
lastObserved: number
service: string
status: "active" or "resolved" or "ignored"
One of the following:
"active"
"resolved"
"ignored"
statusUpdated: number
title: string
updated: number
fingerprint: optional string
members: optional array of object { fingerprint, issueId, title }
fingerprint: string
issueId: string
title: string
type: optional string
IssueNotifyResponse object { run }
run: object { id, created, inactivitySeconds, 13 more }
id: string
created: number
inactivitySeconds: number
initiatedBy: "automatic" or "manual"
One of the following:
"automatic"
"manual"
issueCount: number
issueId: string
lastError: string
policyId: string
status: "pending" or "succeeded" or "failed"
One of the following:
"pending"
"succeeded"
"failed"
terminalAt: number
threshold: number
automationId: optional string
automationName: optional string
automationRevision: optional number
scope: optional "account" or "service"
One of the following:
"account"
"service"
triggerType: optional "occurrence_threshold" or "recurrence_after_inactivity"
One of the following:
"occurrence_threshold"
"recurrence_after_inactivity"
IssueOccurrencesResponse = array of object { id, error, invocation, 5 more }
id: string

Unique occurrence ID.

error: object { handled, mechanism, message, 3 more }
handled: boolean
mechanism: "structured-log" or "error-log" or "stack-log" or 3 more
One of the following:
"structured-log"
"error-log"
"stack-log"
"http-status"
"exception"
"outcome"
message: string
name: string
signature: string
stack: optional string
invocation: object { id, traceId, type, 16 more }
id: string

Worker invocation request ID.

traceId: string
type: string
batchSize: optional number
cron: optional string
jsrpcMethod: optional string
mailFrom: optional string
method: optional string
path: optional string
queue: optional string
rawSize: optional number
rayId: optional string
rcptTo: optional string
scheduledTime: optional number
spanId: optional string
statusCode: optional number
minimum0
url: optional string

Redacted request URL without query parameters.

websocketCloseCode: optional number
websocketEvent: optional string
timestamp: number

Occurrence timestamp as Unix epoch milliseconds.

trail: array of object { level, message, timestamp, type } or object { name, ongoing, spanId, 3 more }
One of the following:
object { level, message, timestamp, type }
level: string
message: string
timestamp: number
type: "log"
object { name, ongoing, spanId, 3 more }
name: string
ongoing: boolean
spanId: string
timestamp: number
type: "span"
parentSpanId: optional string
worker: object { executionModel, scriptName, scriptTags, 3 more }
executionModel: string
scriptName: string
scriptTags: array of string
dispatchNamespace: optional string
entrypoint: optional string
scriptVersion: optional object { id, tag }
id: string
tag: optional string
context: optional object { account, session, user }
account: optional string
session: optional string
user: optional string
request: optional object { headers }
headers: map[string]

ObservabilityIssuesAutomations

List issue automations
GET/accounts/{account_id}/workers/observability/issues/automations
Get an issue automation
GET/accounts/{account_id}/workers/observability/issues/automations/{automationId}
Create an issue automation
POST/accounts/{account_id}/workers/observability/issues/automations
Update an issue automation
PUT/accounts/{account_id}/workers/observability/issues/automations/{automationId}
Delete an issue automation
DELETE/accounts/{account_id}/workers/observability/issues/automations/{automationId}
ModelsExpand Collapse
AutomationListResponse object { automations }
automations: array of object { id, ansPolicyId, created, 12 more }
id: string
ansPolicyId: string
created: number
createdByUserId: string
enabled: boolean
inactivitySeconds: number
name: string
revision: number
scope: "account" or "service"
One of the following:
"account"
"service"
service: string
serviceType: string
threshold: number
triggerType: "occurrence_threshold" or "recurrence_after_inactivity"
One of the following:
"occurrence_threshold"
"recurrence_after_inactivity"
updated: number
updatedByUserId: string
AutomationGetResponse object { automation }
automation: object { id, ansPolicyId, created, 12 more }
id: string
ansPolicyId: string
created: number
createdByUserId: string
enabled: boolean
inactivitySeconds: number
name: string
revision: number
scope: "account" or "service"
One of the following:
"account"
"service"
service: string
serviceType: string
threshold: number
triggerType: "occurrence_threshold" or "recurrence_after_inactivity"
One of the following:
"occurrence_threshold"
"recurrence_after_inactivity"
updated: number
updatedByUserId: string
AutomationCreateResponse object { automation }
automation: object { id, ansPolicyId, created, 12 more }
id: string
ansPolicyId: string
created: number
createdByUserId: string
enabled: boolean
inactivitySeconds: number
name: string
revision: number
scope: "account" or "service"
One of the following:
"account"
"service"
service: string
serviceType: string
threshold: number
triggerType: "occurrence_threshold" or "recurrence_after_inactivity"
One of the following:
"occurrence_threshold"
"recurrence_after_inactivity"
updated: number
updatedByUserId: string
AutomationUpdateResponse object { automation }
automation: object { id, ansPolicyId, created, 12 more }
id: string
ansPolicyId: string
created: number
createdByUserId: string
enabled: boolean
inactivitySeconds: number
name: string
revision: number
scope: "account" or "service"
One of the following:
"account"
"service"
service: string
serviceType: string
threshold: number
triggerType: "occurrence_threshold" or "recurrence_after_inactivity"
One of the following:
"occurrence_threshold"
"recurrence_after_inactivity"
updated: number
updatedByUserId: string
AutomationDeleteResponse object { automation }
automation: object { id, ansPolicyId, created, 12 more }
id: string
ansPolicyId: string
created: number
createdByUserId: string
enabled: boolean
inactivitySeconds: number
name: string
revision: number
scope: "account" or "service"
One of the following:
"account"
"service"
service: string
serviceType: string
threshold: number
triggerType: "occurrence_threshold" or "recurrence_after_inactivity"
One of the following:
"occurrence_threshold"
"recurrence_after_inactivity"
updated: number
updatedByUserId: string

ObservabilityDestinations

Get Destinations
GET/accounts/{account_id}/workers/observability/destinations
Create Destination
POST/accounts/{account_id}/workers/observability/destinations
Update Destination
PATCH/accounts/{account_id}/workers/observability/destinations/{slug}
Delete Destination
DELETE/accounts/{account_id}/workers/observability/destinations/{slug}
ModelsExpand Collapse
DestinationListResponse object { configuration, enabled, name, 2 more }
configuration: object { headers, jobStatus, logpushDataset, 2 more }
headers: map[string]
jobStatus: object { error_message, last_complete, last_error }
error_message: string
last_complete: string
last_error: string
logpushDataset: "opentelemetry-traces" or "opentelemetry-logs" or "opentelemetry-metrics"
One of the following:
"opentelemetry-traces"
"opentelemetry-logs"
"opentelemetry-metrics"
type: "logpush"
url: string
enabled: boolean
name: string
scripts: array of string
slug: string
DestinationCreateResponse object { configuration, enabled, name, 2 more }
configuration: object { headers, jobStatus, logpushDataset, 2 more }
headers: map[string]
jobStatus: object { error_message, last_complete, last_error }
error_message: string
last_complete: string
last_error: string
logpushDataset: "opentelemetry-traces" or "opentelemetry-logs" or "opentelemetry-metrics"
One of the following:
"opentelemetry-traces"
"opentelemetry-logs"
"opentelemetry-metrics"
type: "logpush"
url: string
enabled: boolean
name: string
scripts: array of string
slug: string
DestinationUpdateResponse object { configuration, enabled, name, 2 more }
configuration: object { headers, jobStatus, logpushDataset, 2 more }
headers: map[string]
jobStatus: object { error_message, last_complete, last_error }
error_message: string
last_complete: string
last_error: string
logpushDataset: "opentelemetry-traces" or "opentelemetry-logs" or "opentelemetry-metrics"
One of the following:
"opentelemetry-traces"
"opentelemetry-logs"
"opentelemetry-metrics"
type: "logpush"
url: string
enabled: boolean
name: string
scripts: array of string
slug: string
DestinationDeleteResponse object { configuration, enabled, name, 2 more }
configuration: object { headers, jobStatus, logpushDataset, 2 more }
headers: map[string]
jobStatus: object { error_message, last_complete, last_error }
error_message: string
last_complete: string
last_error: string
logpushDataset: "opentelemetry-traces" or "opentelemetry-logs" or "opentelemetry-metrics"
One of the following:
"opentelemetry-traces"
"opentelemetry-logs"
"opentelemetry-metrics"
type: "logpush"
url: string
enabled: boolean
name: string
scripts: array of string
slug: string

ObservabilityQueries

Save query
POST/accounts/{account_id}/workers/observability/queries
List queries
GET/accounts/{account_id}/workers/observability/queries
ModelsExpand Collapse
QueryCreateResponse object { id, adhoc, created, 6 more }
id: string
adhoc: boolean

If the query wasn’t explcitly saved

created: string
formatdate-time
createdBy: string
description: string
maxLength1000
name: string

Query name

maxLength250
minLength1
parameters: object { calculations, datasets, filterCombination, 6 more }
calculations: optional array of object { operator, alias, key, keyType } or object { key, operator, alias, keyType }

Create Calculations to compute as part of the query.

One of the following:
object { operator, alias, key, keyType }
operator: "count" or "COUNT"
One of the following:
"count"
"COUNT"
alias: optional string
key: optional string
keyType: optional "string" or "number" or "boolean"
One of the following:
"string"
"number"
"boolean"
object { key, operator, alias, keyType }
key: string
operator: "uniq" or "max" or "min" or 33 more
One of the following:
"uniq"
"max"
"min"
"sum"
"avg"
"median"
"p001"
"p01"
"p05"
"p10"
"p25"
"p75"
"p90"
"p95"
"p99"
"p999"
"stddev"
"variance"
"COUNT_DISTINCT"
"MAX"
"MIN"
"SUM"
"AVG"
"MEDIAN"
"P001"
"P01"
"P05"
"P10"
"P25"
"P75"
"P90"
"P95"
"P99"
"P999"
"STDDEV"
"VARIANCE"
alias: optional string
keyType: optional "string" or "number" or "boolean"
One of the following:
"string"
"number"
"boolean"
datasets: optional array of string

Set the Datasets to query. Leave it empty to query all the datasets.

filterCombination: optional "and" or "or" or "AND" or "OR"

Set a Flag to describe how to combine the filters on the query.

One of the following:
"and"
"or"
"AND"
"OR"
filters: optional array of object { filterCombination, filters, kind } or object { key, operation, type, 2 more }

Configure the Filters to apply to the query. Supports nested groups via kind: ‘group’.

One of the following:
object { filterCombination, filters, kind }
filterCombination: "and" or "or" or "AND" or "OR"
One of the following:
"and"
"or"
"AND"
"OR"
filters: array of unknown
kind: "group"
WorkersObservabilityFilterLeaf object { key, operation, type, 2 more }

A filter condition applied to query results. Use the keys and values endpoints to discover available fields and their values before constructing filters.

key: string

Filter field name. Use verified keys from previous query results or the keys endpoint. Common keys include $metadata.service, $metadata.origin, $metadata.trigger, $metadata.message, and $metadata.error.

operation: "includes" or "not_includes" or "starts_with" or 27 more

Comparison operator. String operators: includes, not_includes, starts_with, ends_with, regex. Existence: exists, is_null. Set membership: in, not_in (comma-separated values). Numeric: eq, neq, gt, gte, lt, lte.

One of the following:
"includes"
"not_includes"
"starts_with"
"ends_with"
"regex"
"exists"
"is_null"
"in"
"not_in"
"eq"
"neq"
"gt"
"gte"
"lt"
"lte"
"="
"!="
">"
">="
"<"
"<="
"INCLUDES"
"DOES_NOT_INCLUDE"
"MATCH_REGEX"
"EXISTS"
"DOES_NOT_EXIST"
"IN"
"NOT_IN"
"STARTS_WITH"
"ENDS_WITH"
type: "string" or "number" or "boolean"

Data type of the filter field. Must match the actual type of the key being filtered.

One of the following:
"string"
"number"
"boolean"
kind: optional "filter"

Discriminator for leaf filter nodes. Always ‘filter’ when present; may be omitted.

value: optional string or number or boolean

Comparison value. Must match actual values in your data — verify with the values endpoint. Ensure the value type (string/number/boolean) matches the field type. String comparisons are case-sensitive. Regex uses RE2 syntax (no lookaheads/lookbehinds).

One of the following:
string
number
boolean
groupBys: optional array of object { type, value }

Define how to group the results of the query.

type: "string" or "number" or "boolean"
One of the following:
"string"
"number"
"boolean"
value: string
havings: optional array of object { key, operation, value }

Configure the Having clauses that filter on calculations in the query result.

key: string
operation: "eq" or "neq" or "gt" or 3 more
One of the following:
"eq"
"neq"
"gt"
"gte"
"lt"
"lte"
value: number
limit: optional number

Set a limit on the number of results / records returned by the query

maximum100
minimum0
needle: optional object { value, isRegex, matchCase }

Define an expression to search using full-text search.

value: string or number or boolean
maxLength1000
One of the following:
string
number
boolean
isRegex: optional boolean
matchCase: optional boolean
orderBy: optional object { value, order }

Configure the order of the results returned by the query.

value: string

Configure which Calculation to order the results by.

order: optional "asc" or "desc"

Set the order of the results

One of the following:
"asc"
"desc"
updated: string
formatdate-time
updatedBy: string
QueryListResponse object { id, adhoc, created, 6 more }
id: string
adhoc: boolean

If the query wasn’t explcitly saved

created: string
formatdate-time
createdBy: string
description: string
maxLength1000
name: string

Query name

maxLength250
minLength1
parameters: object { calculations, datasets, filterCombination, 6 more }
calculations: optional array of object { operator, alias, key, keyType } or object { key, operator, alias, keyType }

Create Calculations to compute as part of the query.

One of the following:
object { operator, alias, key, keyType }
operator: "count" or "COUNT"
One of the following:
"count"
"COUNT"
alias: optional string
key: optional string
keyType: optional "string" or "number" or "boolean"
One of the following:
"string"
"number"
"boolean"
object { key, operator, alias, keyType }
key: string
operator: "uniq" or "max" or "min" or 33 more
One of the following:
"uniq"
"max"
"min"
"sum"
"avg"
"median"
"p001"
"p01"
"p05"
"p10"
"p25"
"p75"
"p90"
"p95"
"p99"
"p999"
"stddev"
"variance"
"COUNT_DISTINCT"
"MAX"
"MIN"
"SUM"
"AVG"
"MEDIAN"
"P001"
"P01"
"P05"
"P10"
"P25"
"P75"
"P90"
"P95"
"P99"
"P999"
"STDDEV"
"VARIANCE"
alias: optional string
keyType: optional "string" or "number" or "boolean"
One of the following:
"string"
"number"
"boolean"
datasets: optional array of string

Set the Datasets to query. Leave it empty to query all the datasets.

filterCombination: optional "and" or "or" or "AND" or "OR"

Set a Flag to describe how to combine the filters on the query.

One of the following:
"and"
"or"
"AND"
"OR"
filters: optional array of object { filterCombination, filters, kind } or object { key, operation, type, 2 more }

Configure the Filters to apply to the query. Supports nested groups via kind: ‘group’.

One of the following:
object { filterCombination, filters, kind }
filterCombination: "and" or "or" or "AND" or "OR"
One of the following:
"and"
"or"
"AND"
"OR"
filters: array of unknown
kind: "group"
WorkersObservabilityFilterLeaf object { key, operation, type, 2 more }

A filter condition applied to query results. Use the keys and values endpoints to discover available fields and their values before constructing filters.

key: string

Filter field name. Use verified keys from previous query results or the keys endpoint. Common keys include $metadata.service, $metadata.origin, $metadata.trigger, $metadata.message, and $metadata.error.

operation: "includes" or "not_includes" or "starts_with" or 27 more

Comparison operator. String operators: includes, not_includes, starts_with, ends_with, regex. Existence: exists, is_null. Set membership: in, not_in (comma-separated values). Numeric: eq, neq, gt, gte, lt, lte.

One of the following:
"includes"
"not_includes"
"starts_with"
"ends_with"
"regex"
"exists"
"is_null"
"in"
"not_in"
"eq"
"neq"
"gt"
"gte"
"lt"
"lte"
"="
"!="
">"
">="
"<"
"<="
"INCLUDES"
"DOES_NOT_INCLUDE"
"MATCH_REGEX"
"EXISTS"
"DOES_NOT_EXIST"
"IN"
"NOT_IN"
"STARTS_WITH"
"ENDS_WITH"
type: "string" or "number" or "boolean"

Data type of the filter field. Must match the actual type of the key being filtered.

One of the following:
"string"
"number"
"boolean"
kind: optional "filter"

Discriminator for leaf filter nodes. Always ‘filter’ when present; may be omitted.

value: optional string or number or boolean

Comparison value. Must match actual values in your data — verify with the values endpoint. Ensure the value type (string/number/boolean) matches the field type. String comparisons are case-sensitive. Regex uses RE2 syntax (no lookaheads/lookbehinds).

One of the following:
string
number
boolean
groupBys: optional array of object { type, value }

Define how to group the results of the query.

type: "string" or "number" or "boolean"
One of the following:
"string"
"number"
"boolean"
value: string
havings: optional array of object { key, operation, value }

Configure the Having clauses that filter on calculations in the query result.

key: string
operation: "eq" or "neq" or "gt" or 3 more
One of the following:
"eq"
"neq"
"gt"
"gte"
"lt"
"lte"
value: number
limit: optional number

Set a limit on the number of results / records returned by the query

maximum100
minimum0
needle: optional object { value, isRegex, matchCase }

Define an expression to search using full-text search.

value: string or number or boolean
maxLength1000
One of the following:
string
number
boolean
isRegex: optional boolean
matchCase: optional boolean
orderBy: optional object { value, order }

Configure the order of the results returned by the query.

value: string

Configure which Calculation to order the results by.

order: optional "asc" or "desc"

Set the order of the results

One of the following:
"asc"
"desc"
updated: string
formatdate-time
updatedBy: string

ObservabilityShared Queries

Create a sharable link to a query result
POST/accounts/{account_id}/workers/observability/shared/query
View a query that has been shared
GET/accounts/{account_id}/workers/observability/shared/query/{id}
ModelsExpand Collapse
SharedQueryCreateResponse object { id }
id: string

Specify the ID of the shared query.

SharedQueryGetResponse object { run, statistics, agents, 6 more }

Complete results of a query run. The populated fields depend on the requested view type (events, calculations, invocations, traces, or agents).

run: object { id, accountId, dry, 8 more }

Represents a single execution of a query against Workers Observability data, including the query definition, execution status, and performance statistics.

id: string

Unique identifier for this query run.

accountId: string

Cloudflare account ID that owns this query run.

dry: boolean

Whether this was a dry run (results not persisted).

granularity: number

Number of time-series buckets used for the query. Higher values produce more detailed series data.

query: object { id, adhoc, created, 6 more }

A saved query definition with its parameters, metadata, and ownership information.

id: string
adhoc: boolean

If the query wasn’t explcitly saved

created: string or string
formatdate-time
One of the following:
string
string
createdBy: string
description: string
maxLength1000
name: string

Query name

maxLength250
minLength1
parameters: object { calculations, datasets, filterCombination, 6 more }
calculations: optional array of object { operator, alias, key, keyType } or object { key, operator, alias, keyType }

Create Calculations to compute as part of the query.

One of the following:
object { operator, alias, key, keyType }
operator: "count" or "COUNT"
One of the following:
"count"
"COUNT"
alias: optional string
key: optional string
keyType: optional "string" or "number" or "boolean"
One of the following:
"string"
"number"
"boolean"
object { key, operator, alias, keyType }
key: string
operator: "uniq" or "max" or "min" or 33 more
One of the following:
"uniq"
"max"
"min"
"sum"
"avg"
"median"
"p001"
"p01"
"p05"
"p10"
"p25"
"p75"
"p90"
"p95"
"p99"
"p999"
"stddev"
"variance"
"COUNT_DISTINCT"
"MAX"
"MIN"
"SUM"
"AVG"
"MEDIAN"
"P001"
"P01"
"P05"
"P10"
"P25"
"P75"
"P90"
"P95"
"P99"
"P999"
"STDDEV"
"VARIANCE"
alias: optional string
keyType: optional "string" or "number" or "boolean"
One of the following:
"string"
"number"
"boolean"
datasets: optional array of string

Set the Datasets to query. Leave it empty to query all the datasets.

filterCombination: optional "and" or "or" or "AND" or "OR"

Set a Flag to describe how to combine the filters on the query.

One of the following:
"and"
"or"
"AND"
"OR"
filters: optional array of object { filterCombination, filters, kind } or object { key, operation, type, 2 more }

Configure the Filters to apply to the query. Supports nested groups via kind: ‘group’.

One of the following:
object { filterCombination, filters, kind }
filterCombination: "and" or "or" or "AND" or "OR"
One of the following:
"and"
"or"
"AND"
"OR"
filters: array of unknown
kind: "group"
WorkersObservabilityFilterLeaf object { key, operation, type, 2 more }

A filter condition applied to query results. Use the keys and values endpoints to discover available fields and their values before constructing filters.

key: string

Filter field name. Use verified keys from previous query results or the keys endpoint. Common keys include $metadata.service, $metadata.origin, $metadata.trigger, $metadata.message, and $metadata.error.

operation: "includes" or "not_includes" or "starts_with" or 27 more

Comparison operator. String operators: includes, not_includes, starts_with, ends_with, regex. Existence: exists, is_null. Set membership: in, not_in (comma-separated values). Numeric: eq, neq, gt, gte, lt, lte.

One of the following:
"includes"
"not_includes"
"starts_with"
"ends_with"
"regex"
"exists"
"is_null"
"in"
"not_in"
"eq"
"neq"
"gt"
"gte"
"lt"
"lte"
"="
"!="
">"
">="
"<"
"<="
"INCLUDES"
"DOES_NOT_INCLUDE"
"MATCH_REGEX"
"EXISTS"
"DOES_NOT_EXIST"
"IN"
"NOT_IN"
"STARTS_WITH"
"ENDS_WITH"
type: "string" or "number" or "boolean"

Data type of the filter field. Must match the actual type of the key being filtered.

One of the following:
"string"
"number"
"boolean"
kind: optional "filter"

Discriminator for leaf filter nodes. Always ‘filter’ when present; may be omitted.

value: optional string or number or boolean

Comparison value. Must match actual values in your data — verify with the values endpoint. Ensure the value type (string/number/boolean) matches the field type. String comparisons are case-sensitive. Regex uses RE2 syntax (no lookaheads/lookbehinds).

One of the following:
string
number
boolean
groupBys: optional array of object { type, value }

Define how to group the results of the query.

type: "string" or "number" or "boolean"
One of the following:
"string"
"number"
"boolean"
value: string
havings: optional array of object { key, operation, value }

Configure the Having clauses that filter on calculations in the query result.

key: string
operation: "eq" or "neq" or "gt" or 3 more
One of the following:
"eq"
"neq"
"gt"
"gte"
"lt"
"lte"
value: number
limit: optional number

Set a limit on the number of results / records returned by the query

maximum100
minimum0
needle: optional object { value, isRegex, matchCase }

Define an expression to search using full-text search.

value:
isRegex: optional boolean
matchCase: optional boolean
orderBy: optional object { value, order }

Configure the order of the results returned by the query.

value: string

Configure which Calculation to order the results by.

order: optional "asc" or "desc"

Set the order of the results

One of the following:
"asc"
"desc"
updated: string or string
formatdate-time
One of the following:
string
string
updatedBy: string
status: "STARTED" or "COMPLETED"

Current execution status of the query run.

One of the following:
"STARTED"
"COMPLETED"
timeframe: object { from, to }

Time range for the query execution. ‘from’ must be earlier than ‘to’. No fractional milliseconds.

from: number

Start timestamp for the query timeframe. Unix timestamp in milliseconds

maximum253402300799999
minimum0
to: number

End timestamp for the query timeframe. Unix timestamp in milliseconds

maximum253402300799999
minimum0
userId: string

ID of the user who initiated the query run.

created: optional string

ISO-8601 timestamp when the query run was created.

statistics: optional object { bytes_read, elapsed, rows_read, abr_level }

Query performance statistics from the database (does not include network latency).

bytes_read: number

Number of uncompressed bytes read from the table.

elapsed: number

Time in seconds for the query to run.

rows_read: number

Number of rows scanned from the table.

abr_level: optional number

The level of Adaptive Bit Rate (ABR) sampling used for the query. If empty the ABR level is 1

updated: optional string

ISO-8601 timestamp when the query run was last updated.

statistics: object { bytes_read, elapsed, rows_read, abr_level }

Query performance statistics from the database. Includes execution time, rows scanned, and bytes read. Does not include network latency.

bytes_read: number

Number of uncompressed bytes read from the table.

elapsed: number

Time in seconds for the query to run.

rows_read: number

Number of rows scanned from the table.

abr_level: optional number

The level of Adaptive Bit Rate (ABR) sampling used for the query. If empty the ABR level is 1

agents: optional array of object { id, errors, models, 13 more }

Agent run summaries. Present when the query view is ‘agents’. Each entry represents one trace containing at least one agent invocation.

id: string

Stable pagination cursor for this agent run.

errors: array of string

Distinct errors reported by spans in the run.

models: array of string

Distinct models reported by chat spans across the run’s trace.

providers: array of string

Distinct GenAI providers reported by chat spans in the run.

services: array of string

Worker services represented in the run’s trace.

spans: number

Number of spans in the run’s trace.

status: "completed" or "error"

Observed run status.

One of the following:
"completed"
"error"
traceDurationMs: number

Total trace duration in milliseconds.

traceEndMs: number

End of the run’s trace as a Unix epoch in milliseconds.

traceId: string

Trace identifier for this agent run.

traceStartMs: number

Start of the run’s trace as a Unix epoch in milliseconds.

agentId: optional string

ID from the earliest agent invocation that provides one.

agentName: optional string

Name from the earliest agent invocation that provides one.

conversationId: optional string

Conversation ID from the earliest invocation that provides one.

inputTokens: optional number

Input tokens summed across chat spans in the run’s trace; informational, not billing data.

outputTokens: optional number

Output tokens summed across chat spans in the run’s trace; informational, not billing data.

calculations: optional array of object { aggregates, calculation, series, alias }

Aggregated calculation results. Present when the query view is ‘calculations’. Contains computed metrics (count, avg, p99, etc.) with optional group-by breakdowns and time-series data.

aggregates: array of object { count, interval, sampleInterval, 2 more }
count: number

Estimated number of matching events: the sum of the sample intervals of the stored events. It equals the number of stored events when sampleInterval is 1.

Deprecatedinterval: number

Deprecated alias of sampleInterval. Always has the same value; use sampleInterval instead.

sampleInterval: number

Average sample interval of the matched events. Each stored event has a sample interval of 1 / (the sampling rate applied when it was ingested): the Worker’s head_sampling_rate multiplied by any platform sampling applied to the account or script. A value of 1 means none of the matched events were sampled. A value above 1 means count and value are estimated from sampled data, not exact. This is independent of statistics.abr_level.

value: number

Result of the calculation. count, sum, avg, median, and percentiles are weighted by each event’s sample interval

groups: optional array of object { key, value }
key: string
value: string or number or boolean
One of the following:
string
number
boolean
calculation: string
series: array of object { data, time }
data: array of object { count, interval, sampleInterval, 4 more }
count: number

Estimated number of matching events: the sum of the sample intervals of the stored events. It equals the number of stored events when sampleInterval is 1.

Deprecatedinterval: number

Deprecated alias of sampleInterval. Always has the same value; use sampleInterval instead.

sampleInterval: number

Average sample interval of the matched events. Each stored event has a sample interval of 1 / (the sampling rate applied when it was ingested): the Worker’s head_sampling_rate multiplied by any platform sampling applied to the account or script. A value of 1 means none of the matched events were sampled. A value above 1 means count and value are estimated from sampled data, not exact. This is independent of statistics.abr_level.

value: number

Result of the calculation. count, sum, avg, median, and percentiles are weighted by each event’s sample interval

firstSeen: optional string
groups: optional array of object { key, value }
key: string
value: string or number or boolean
One of the following:
string
number
boolean
lastSeen: optional string
time: string
alias: optional string
compare: optional array of object { aggregates, calculation, series, alias }

Comparison calculation results from the previous time period. Present when the compare option is enabled. Same structure as calculations.

aggregates: array of object { count, interval, sampleInterval, 2 more }
count: number

Estimated number of matching events: the sum of the sample intervals of the stored events. It equals the number of stored events when sampleInterval is 1.

Deprecatedinterval: number

Deprecated alias of sampleInterval. Always has the same value; use sampleInterval instead.

sampleInterval: number

Average sample interval of the matched events. Each stored event has a sample interval of 1 / (the sampling rate applied when it was ingested): the Worker’s head_sampling_rate multiplied by any platform sampling applied to the account or script. A value of 1 means none of the matched events were sampled. A value above 1 means count and value are estimated from sampled data, not exact. This is independent of statistics.abr_level.

value: number

Result of the calculation. count, sum, avg, median, and percentiles are weighted by each event’s sample interval

groups: optional array of object { key, value }
key: string
value: string or number or boolean
One of the following:
string
number
boolean
calculation: string
series: array of object { data, time }
data: array of object { count, interval, sampleInterval, 4 more }
count: number

Estimated number of matching events: the sum of the sample intervals of the stored events. It equals the number of stored events when sampleInterval is 1.

Deprecatedinterval: number

Deprecated alias of sampleInterval. Always has the same value; use sampleInterval instead.

sampleInterval: number

Average sample interval of the matched events. Each stored event has a sample interval of 1 / (the sampling rate applied when it was ingested): the Worker’s head_sampling_rate multiplied by any platform sampling applied to the account or script. A value of 1 means none of the matched events were sampled. A value above 1 means count and value are estimated from sampled data, not exact. This is independent of statistics.abr_level.

value: number

Result of the calculation. count, sum, avg, median, and percentiles are weighted by each event’s sample interval

firstSeen: optional string
groups: optional array of object { key, value }
key: string
value: string or number or boolean
One of the following:
string
number
boolean
lastSeen: optional string
time: string
alias: optional string
distribution: optional object { bins, bucketBoundaries, bucketMode, 2 more }

Bucketed 2D histogram of a numeric field over time. Present when chartType is ‘distribution’.

bins: array of string

Time-bucket labels (ISO-8601 strings), one per matrix column.

bucketBoundaries: array of number

Raw bucket edges in the value’s native unit, length buckets.length + 1. Used for the colour scale and percentile mapping.

bucketMode: "log" or "linear"

Bucketing scheme used to derive the boundaries. ‘log’ produces geometric edges; ‘linear’ produces fixed-width edges.

One of the following:
"log"
"linear"
buckets: array of string

Value-range labels, one per matrix row (e.g. ‘50–100ms’).

matrix: array of array of number

Sampling-corrected counts. matrix[bucketIdx][binIdx] is the estimated number of events in value-bucket ‘bucketIdx’ during time-bin ‘binIdx’.

events: optional object { count, events, fields, series }

Individual event results. Present when the query view is ‘events’. Contains the matching log lines and their metadata.

count: optional number

Total number of events matching the query (may exceed the number returned due to limits).

events: optional array of object { "$metadata", dataset, source, 3 more }

List of individual telemetry events matching the query.

"$metadata": object { id, account, cloudService, 35 more }

Structured metadata extracted from the event. These fields are indexed and available for filtering and aggregation.

id: string

Unique event ID. Use as the cursor value for offset-based pagination.

account: optional string

Cloudflare account identifier.

cloudService: optional string

Cloudflare product that generated this event (e.g. workers, pages).

coldStart: optional number
exclusiveMinimum
minimum0
cost: optional number

Estimated cost units for this invocation.

exclusiveMinimum
minimum0
duration: optional number

Span duration in milliseconds.

exclusiveMinimum
minimum0
endTime: optional number

Span end time as a Unix epoch in milliseconds.

minimum0
endTimeNs: optional string

Span end time as a Unix epoch in nanoseconds.

error: optional string

Error message, present when the log represents an error.

errorTemplate: optional string

Templatized version of the error message used for grouping similar errors.

eventSize: optional number

Size of the stored telemetry event in bytes.

minimum0
fingerprint: optional string

Content-based fingerprint used to group similar events.

level: optional string

Log level (e.g. log, debug, info, warn, error).

message: optional string

Log message text.

messageTemplate: optional string

Templatized version of the log message used for grouping similar messages.

metricName: optional string

Metric name when the event represents a metric data point.

origin: optional string

Origin of the event (e.g. fetch, scheduled, queue).

parentSpanId: optional string

Span ID of the parent span in the trace hierarchy.

provider: optional string

Infrastructure provider identifier.

rayId: optional string

Cloudflare Ray ID from the cf-ray header of the request that triggered the invocation.

region: optional string

Cloudflare data center / region that handled the request.

requestId: optional string

Cloudflare request ID that ties all logs from a single invocation together.

service: optional string

Worker script name that produced this event.

spanId: optional string

Span ID for this individual unit of work within a trace.

spanName: optional string

Human-readable name for this span.

spanStatus: optional "unset" or "ok" or "error"

OpenTelemetry span status. Present only on spans. unset when the span did not set a status, including spans recorded before status was captured.

One of the following:
"unset"
"ok"
"error"
spanStatusMessage: optional string

OpenTelemetry span status message. Present only on spans when the status is error and a message was set.

stackId: optional string

Stack / deployment identifier.

startTime: optional number

Span start time as a Unix epoch in milliseconds.

minimum0
startTimeNs: optional string

Span start time as a Unix epoch in nanoseconds.

statusCode: optional number

HTTP response status code returned by the Worker.

exclusiveMinimum
minimum0
timestampNs: optional string

Event time as a Unix epoch in nanoseconds.

traceDuration: optional number

Total duration of the entire trace in milliseconds.

exclusiveMinimum
minimum0
traceId: optional string

Distributed trace ID linking spans across services.

transactionName: optional string

Logical transaction name for this request.

trigger: optional string

What triggered the invocation (e.g. GET /users, POST /orders, queue message).

type: optional string

Event type classifier (e.g. cf-worker-event, cf-worker-log).

url: optional string

Request URL that triggered the Worker invocation.

dataset: string

The dataset this event belongs to (e.g. cloudflare-workers).

source: string or map[unknown]

Raw log payload. May be a string or a structured object depending on how the log was emitted.

One of the following:
string
map[unknown]
timestamp: number

Event timestamp as a Unix epoch in milliseconds.

minimum0
"$containers": optional map[unknown]

Cloudflare Containers event information that enriches your logs for identifying and debugging issues.

"$workers": optional object { eventType, scriptName, durableObjectId, 11 more } or object { cpuTimeMs, eventType, outcome, 15 more }

Cloudflare Workers event information that enriches your logs for identifying and debugging issues.

One of the following:
object { eventType, scriptName, durableObjectId, 11 more }
eventType: "fetch" or "scheduled" or "alarm" or 9 more
One of the following:
"fetch"
"scheduled"
"alarm"
"cron"
"queue"
"email"
"tail"
"rpc"
"jsrpc"
"websocket"
"workflow"
"unknown"
scriptName: string
durableObjectId: optional string
entrypoint: optional string
event: optional map[unknown]
executionModel: optional "durableObject" or "stateless"
One of the following:
"durableObject"
"stateless"
gateway: optional object { requestId }
requestId: string
outcome: optional string
preview: optional object { id, name, slug }
id: optional string
name: optional string
slug: optional string
requestId: optional string
scriptVersion: optional object { id, message, tag }
id: optional string
message: optional string
tag: optional string
spanId: optional string
traceId: optional string
truncated: optional boolean
object { cpuTimeMs, eventType, outcome, 15 more }
cpuTimeMs: number
eventType: "fetch" or "scheduled" or "alarm" or 9 more
One of the following:
"fetch"
"scheduled"
"alarm"
"cron"
"queue"
"email"
"tail"
"rpc"
"jsrpc"
"websocket"
"workflow"
"unknown"
outcome: string
scriptName: string
wallTimeMs: number
diagnosticsChannelEvents: optional array of object { channel, message, timestamp }
channel: string
message: string
timestamp: number
dispatchNamespace: optional string
durableObjectId: optional string
entrypoint: optional string
event: optional map[unknown]
executionModel: optional "durableObject" or "stateless"
One of the following:
"durableObject"
"stateless"
gateway: optional object { requestId }
requestId: string
preview: optional object { id, name, slug }
id: optional string
name: optional string
slug: optional string
requestId: optional string
scriptVersion: optional object { id, message, tag }
id: optional string
message: optional string
tag: optional string
spanId: optional string
traceId: optional string
truncated: optional boolean
fields: optional array of object { key, type }

List of fields discovered in the matched events. Useful for building dynamic UIs.

key: string

Field name present in the matched events.

type: string

Data type of the field (string, number, or boolean).

series: optional array of object { data, time }

Time-series data for the matched events, bucketed by the query granularity.

data: array of object { aggregates, count, interval, 3 more }
aggregates: object { _count, _interval, _firstSeen, 2 more }
Deprecated_count: number
exclusiveMinimum
minimum0
Deprecated_interval: number
exclusiveMinimum
minimum0
Deprecated_firstSeen: optional string
Deprecated_lastSeen: optional string
Deprecatedbin: optional unknown
count: number

Estimated number of matching events: the sum of the sample intervals of the stored events. It equals the number of stored events when sampleInterval is 1.

Deprecatedinterval: number

Deprecated alias of sampleInterval. Always has the same value; use sampleInterval instead.

sampleInterval: number

Average sample interval of the matched events. Each stored event has a sample interval of 1 / (the sampling rate applied when it was ingested): the Worker’s head_sampling_rate multiplied by any platform sampling applied to the account or script. A value of 1 means none of the matched events were sampled. A value above 1 means count and value are estimated from sampled data, not exact. This is independent of statistics.abr_level.

errors: optional number
groups: optional map[string or number or boolean]

Groups in the query results.

One of the following:
string
number
boolean
time: string
invocations: optional map[array of object { "$metadata", dataset, source, 3 more } ]

Events grouped by invocation (request ID). Present when the query view is ‘invocations’. Each key is a request ID mapping to all events from that invocation.

"$metadata": object { id, account, cloudService, 35 more }

Structured metadata extracted from the event. These fields are indexed and available for filtering and aggregation.

id: string

Unique event ID. Use as the cursor value for offset-based pagination.

account: optional string

Cloudflare account identifier.

cloudService: optional string

Cloudflare product that generated this event (e.g. workers, pages).

coldStart: optional number
exclusiveMinimum
minimum0
cost: optional number

Estimated cost units for this invocation.

exclusiveMinimum
minimum0
duration: optional number

Span duration in milliseconds.

exclusiveMinimum
minimum0
endTime: optional number

Span end time as a Unix epoch in milliseconds.

minimum0
endTimeNs: optional string

Span end time as a Unix epoch in nanoseconds.

error: optional string

Error message, present when the log represents an error.

errorTemplate: optional string

Templatized version of the error message used for grouping similar errors.

eventSize: optional number

Size of the stored telemetry event in bytes.

minimum0
fingerprint: optional string

Content-based fingerprint used to group similar events.

level: optional string

Log level (e.g. log, debug, info, warn, error).

message: optional string

Log message text.

messageTemplate: optional string

Templatized version of the log message used for grouping similar messages.

metricName: optional string

Metric name when the event represents a metric data point.

origin: optional string

Origin of the event (e.g. fetch, scheduled, queue).

parentSpanId: optional string

Span ID of the parent span in the trace hierarchy.

provider: optional string

Infrastructure provider identifier.

rayId: optional string

Cloudflare Ray ID from the cf-ray header of the request that triggered the invocation.

region: optional string

Cloudflare data center / region that handled the request.

requestId: optional string

Cloudflare request ID that ties all logs from a single invocation together.

service: optional string

Worker script name that produced this event.

spanId: optional string

Span ID for this individual unit of work within a trace.

spanName: optional string

Human-readable name for this span.

spanStatus: optional "unset" or "ok" or "error"

OpenTelemetry span status. Present only on spans. unset when the span did not set a status, including spans recorded before status was captured.

One of the following:
"unset"
"ok"
"error"
spanStatusMessage: optional string

OpenTelemetry span status message. Present only on spans when the status is error and a message was set.

stackId: optional string

Stack / deployment identifier.

startTime: optional number

Span start time as a Unix epoch in milliseconds.

minimum0
startTimeNs: optional string

Span start time as a Unix epoch in nanoseconds.

statusCode: optional number

HTTP response status code returned by the Worker.

exclusiveMinimum
minimum0
timestampNs: optional string

Event time as a Unix epoch in nanoseconds.

traceDuration: optional number

Total duration of the entire trace in milliseconds.

exclusiveMinimum
minimum0
traceId: optional string

Distributed trace ID linking spans across services.

transactionName: optional string

Logical transaction name for this request.

trigger: optional string

What triggered the invocation (e.g. GET /users, POST /orders, queue message).

type: optional string

Event type classifier (e.g. cf-worker-event, cf-worker-log).

url: optional string

Request URL that triggered the Worker invocation.

dataset: string

The dataset this event belongs to (e.g. cloudflare-workers).

source: string or map[unknown]

Raw log payload. May be a string or a structured object depending on how the log was emitted.

One of the following:
string
map[unknown]
timestamp: number

Event timestamp as a Unix epoch in milliseconds.

minimum0
"$containers": optional map[unknown]

Cloudflare Containers event information that enriches your logs for identifying and debugging issues.

"$workers": optional object { eventType, scriptName, durableObjectId, 11 more } or object { cpuTimeMs, eventType, outcome, 15 more }

Cloudflare Workers event information that enriches your logs for identifying and debugging issues.

One of the following:
object { eventType, scriptName, durableObjectId, 11 more }
eventType: "fetch" or "scheduled" or "alarm" or 9 more
One of the following:
"fetch"
"scheduled"
"alarm"
"cron"
"queue"
"email"
"tail"
"rpc"
"jsrpc"
"websocket"
"workflow"
"unknown"
scriptName: string
durableObjectId: optional string
entrypoint: optional string
event: optional map[unknown]
executionModel: optional "durableObject" or "stateless"
One of the following:
"durableObject"
"stateless"
gateway: optional object { requestId }
requestId: string
outcome: optional string
preview: optional object { id, name, slug }
id: optional string
name: optional string
slug: optional string
requestId: optional string
scriptVersion: optional object { id, message, tag }
id: optional string
message: optional string
tag: optional string
spanId: optional string
traceId: optional string
truncated: optional boolean
object { cpuTimeMs, eventType, outcome, 15 more }
cpuTimeMs: number
eventType: "fetch" or "scheduled" or "alarm" or 9 more
One of the following:
"fetch"
"scheduled"
"alarm"
"cron"
"queue"
"email"
"tail"
"rpc"
"jsrpc"
"websocket"
"workflow"
"unknown"
outcome: string
scriptName: string
wallTimeMs: number
diagnosticsChannelEvents: optional array of object { channel, message, timestamp }
channel: string
message: string
timestamp: number
dispatchNamespace: optional string
durableObjectId: optional string
entrypoint: optional string
event: optional map[unknown]
executionModel: optional "durableObject" or "stateless"
One of the following:
"durableObject"
"stateless"
gateway: optional object { requestId }
requestId: string
preview: optional object { id, name, slug }
id: optional string
name: optional string
slug: optional string
requestId: optional string
scriptVersion: optional object { id, message, tag }
id: optional string
message: optional string
tag: optional string
spanId: optional string
traceId: optional string
truncated: optional boolean
traces: optional array of object { rootSpanName, rootTransactionName, service, 6 more }

Trace summaries matching the query. Present when the query view is ‘traces’. Each entry represents a distributed trace with its spans, duration, and services involved.

rootSpanName: string

Name of the root span that initiated the trace.

rootTransactionName: string

Logical transaction name for the root span.

service: array of string

List of Worker services involved in the trace.

spans: number

Total number of spans in the trace.

traceDurationMs: number

Total duration of the trace in milliseconds.

traceEndMs: number

Trace end time as a Unix epoch in milliseconds.

traceId: string

Unique identifier for the distributed trace.

traceStartMs: number

Trace start time as a Unix epoch in milliseconds.

errors: optional array of string

Error messages encountered during the trace, if any.