Manage datasets

Log Explorer allows you to enable, disable, or delete datasets available to query in Log Search.

Log Explorer currently supports the following datasets:

• HTTP Requests (http_requests)
• Firewall Events (firewall_events)
• DNS Logs (dns_logs)
• NEL Reports (nel_reports)
• Page Shield Events (page_shield_events) (events for client-side security)
• Spectrum Events (spectrum_events)
• Zaraz Events (zaraz_events)

• Access requests (access_requests)
• CASB findings (casb_findings)
• Device posture results (device_posture_results)
• Gateway DNS (gateway_dns)
• Gateway HTTP (gateway_http)
• Gateway Network (gateway_network)
• Zero Trust Network Session Logs (zero_trust_network_sessions)
• Audit Logs (audit_logs)
• Audit_logs_v2 (audit_logs_v2)
• Browser Isolation User Actions (biso_user_actions)
• DNS firewall logs (dns_firewall_logs)
• Email security alerts (email_security_alerts)
• Magic BGP Logs (magic_bgp_logs)
• Magic IDS Detections (magic_ids_detections)
• Network Analytics (network_analytics_logs)
• Sinkhole HTTP Logs (sinkhole_http_logs)
• IP Sec Logs (ipsec_logs)

To begin storing logs, enable the desired datasets through the dashboard or API.

Use Select fields to control which data points Log Explorer stores. Fields are grouped by category, and each category shows its selected field count. Select a category to add or remove all fields in that group, or expand the category to select individual fields. Each field shows its data type.

Required fields remain selected and are marked Required. Fields that Cloudflare no longer recommends are marked Deprecated. Select Select all to include every available field, or Reset to default to restore the dataset defaults.

Use Filter logs to ingest All events or Only events matching a filter. A filter condition consists of a field, an operator, and a value. All conditions within a group must match. An event can match any filter group.

To change the fields or filter for an enabled dataset, go to Log Explorer > Manage datasets. Find the dataset, select Actions > Edit, update the configuration, and select Update.

Use the Log Explorer API to enable each dataset you want to store. It may take a few minutes after a log stream is enabled before you can view the logs.

The following curl command is an example for enabling the zone-level dataset http_requests, as well as the expected response when the command succeeds.

curl https://api.cloudflare.com/client/v4/zones/{zone_id}/logs/explorer/datasets \
--header "Authorization: Bearer <API_TOKEN>" \
--json '{
  "dataset": "http_requests"
}'

{
	"result": {
		"dataset": "http_requests",
		"object_type": "zone",
		"object_id": "<ZONE ID>",
		"created_at": "2025-06-03T14:33:16Z",
		"updated_at": "2025-06-03T14:33:16Z",
		"dataset_id": "01973635f7e273a1964a02f4d4502499",
		"enabled": true,
		"deletion_protection": true
	},
	"success": true,
	"errors": [],
	"messages": []
}

To enable an account-level dataset, replace zones/{zone_id} with accounts/{account_id} in the curl command. For example:

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/logs/explorer/datasets \
--header "Authorization: Bearer <API_TOKEN>" \
--json '{
  "dataset": "access_requests"
}'

Deleting a dataset permanently removes the dataset and its stored data. Deletion runs asynchronously. You cannot recreate the same dataset for the account or zone while deletion is in progress.