--- title: Cloudflare description: Monitor your Cloudflare Web traffic, DNS queries, security threats, and more. breadcrumbs: Docs > Integrations > Cloudflare --- # Cloudflare Integration version1.2.3 Cloudflare Overview DashboardCloudflare Overview DashboardCloudflare Overview DashboardCloudflare Overview Dashboard ## Overview{% #overview %} Integrate with Cloudflare to get your zone metrics, including web traffic, DNS queries, and threat insights. The integration is based on [Cloudflare's analytics API](https://developers.cloudflare.com/analytics/graphql-api/). Learn more about what resources correspond with which metrics in [the Datadog documentation](https://docs.datadoghq.com/integrations/cloudflare/#metric-categories). **Log Collection**: In addition to these metrics, Cloudflare allows customers to push logs directly into Datadog using Cloudflare Logpush. These detailed logs contain metadata generated by Cloudflare products and are helpful for debugging and creating analytics, especially when combined with logs from other sources. [Enable Cloudflare log collection](https://docs.datadoghq.com/integrations/cloudflare/#log-collection) in combination with these metrics to get full visibility into your Cloudflare environment. The out-of-the-box dashboard improves the security and performance of your applications. This single pane of glass gives you visibility into: - security threats - HTTP request volume and error rates - load balancing, including round-trip time and any changes in traffic flow - performance issues in worker scripts With enriched logs and detailed metrics giving you deep insight into your Cloudflare infrastructure, you can build the context you need to resolve issues. The integration works with [Datadog Cloud SIEM](https://docs.datadoghq.com/security/cloud_siem/) to provide out-of-the-box threat detection for - impossible travel - dangerous misconfigurations - DDoS attacks Mitigate security threats more quickly with the included Workflow Automation blueprints, such as blocking an IP address or creating a case in Datadog. ## Setup{% #setup %} Before you begin, you need a [Datadog account](https://www.datadoghq.com/free-datadog-trial/), with an [API token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/), and access to [Cloudflare Logpush](https://developers.cloudflare.com/logs/about), which requires an Enterprise account plan. To create a Cloudflare API token, follow [Cloudflare's API Token Documentation](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/) and ensure it has the necessary permissions listed below for each account. If you encounter authentication issues with your token, contact [Cloudflare Support](https://www.support.cloudflare.com/s/?language=en_US). #### Permissions{% #permissions %} | Scope | Permission | Status | | ------- | ----------------- | ------ | | Account | Account Analytics | Read | | Account | Account Settings | Read | | Account | Workers Scripts | Read | | Account | Workers Tail | Read | | Zone | Analytics | Read | | Zone | Load Balancers | Read | | Zone | Workers Routes | Read | | Zone | Zone | Read | ### Installation{% #installation %} Install the integration with the Datadog [Cloudflare integration tile](https://app.datadoghq.com/integrations/cloudflare) by entering the API token you created above. ### Configuration{% #configuration %} 1. Go to the **Configure** tab in the Datadog [Cloudflare integration tile](https://app.datadoghq.com/integrations/cloudflare). 1. Enter your email address and the API token created earlier for the accounts you want to monitor. You can find your Cloudflare API token in your Cloudflare account under **My Profile** > **API Tokens**. Note that Cloudflare's API Keys are now considered [legacy authentication methods](https://developers.cloudflare.com/fundamentals/api/get-started/keys/). If you're using an API Key, Datadog recommends replacing it with an API token. 1. Provide a name for the account. This name is arbitrary and appears in the `account` tag on your metrics. ### Log collection{% #log-collection %} Cloudflare allows customers to push logs directly into Datadog using Cloudflare Logpush. You can manage the Logpush job with the Cloudflare API or directly within your Cloudflare dashboard. If you install the Cloudflare integration pipeline, it automatically remaps certain attributes. To see which attributes are remapped: 1. Navigate to [Logs Pipelines](https://app.datadoghq.com/logs/pipelines). 1. Click **Browse Pipeline Library** on the top right. 1. Enter `Cloudflare` in the search bar. 1. Click **Cloudflare** to see the list of remappers and other processors that are installed. #### Cloudflare API{% #cloudflare-api %} 1. Create a Logpush job by making a POST request to the Logpush jobs endpoint. Include the following fields: - `name` (optional): Use your domain name as the job name. - `destination_conf`: A log destination consisting of the following parameters: - ``: The Datadog HTTP logs intake endpoint, which can be either one below. You can find the difference at [Datadog API reference](https://docs.datadoghq.com/api/latest/logs/). - **v1:** `http-intake.logs. /v1/input` - **v2 (latest):** `http-intake.logs. /api/v2/logs` - ``: Your Datadog API key. - `ddsource`: Set to `cloudflare`. - `service` (optional): Specify service name. - `host` (optional): Specify host name. - `ddtags` (optional): Specify tags. - `dataset`: The category of logs you want to receive. See the [Cloudflare Log fields](https://developers.cloudflare.com/logs/log-fields) for a list of supported datasets. - `logpull_options` (optional): To configure fields, sample rate, and timestamp format, see the [Logpush API options](https://developers.cloudflare.com/logs/logpush/logpush-configuration-api/understanding-logpush-api#options). Datadog mandates the use of **RFC 3339 format for timestamps** from Cloudflare, which is the default option used by Cloudflare. **Example request**: ```bash curl -s -X POST 'https://api.cloudflare.com/client/v4/zones//logpush/jobs' \ --header 'X-Auth-Key: ' \ --header 'X-Auth-Email: ' \ --header 'Content-Type: application/json' \ --data-raw '{ "name": "", "destination_conf": "datadog://?header_DD-API-KEY=&ddsource=cloudflare&service=cloudflare&ddtags=env:dev", "logpull_options": "fields=RayID,EdgeStartTimestamp×tamps=rfc3339", "dataset": "http_requests" }' ``` **Example response**: ```bash { "errors": [], "messages": [], "result": { "id": 100, "dataset": "http_requests", "enabled": false, "name": "", "logpull_options": "fields=RayID,EdgeStartTimestamp×tamps=rfc3339", "destination_conf": "datadog://http-intake.logs./v1/input?header_DD-API-KEY=&ddsource=cloudflare&service=cloudflare&ddtags=env:dev", "last_complete": null, "last_error": null, "error_message": null }, "success": true } ``` Take note of the value of `id`. In the example above, it is `100`. 1. Enable the job. Use the job ID returned in the response and send `{"enabled": true}` in the request body. **Example request**: ```bash curl -s -X PUT \ https://api.cloudflare.com/client/v4/zones//logpush/jobs/ -d'{"enabled":true}' | jq . ``` **Example response**: ```bash { "errors": [], "messages": [], "result": { "id": 100, "dataset": "http_requests", "enabled": true, "name": "", "logpull_options": "fields=RayID,EdgeStartTimestamp×tamps=rfc3339", "destination_conf": "datadog://?header_DD-API-KEY=", "last_complete": null, "last_error": null, "error_message": null }, "success": true } ``` #### Cloudflare dashboard{% #cloudflare-dashboard %} 1. Once you have connected a service with the Logpush section of the Cloudflare dashboard, select the dataset, select data fields, and then, under select destination, choose Datadog. 1. Under **Enter destination information**, enter the Datadog URL Endpoint: ``` http-intake.logs./api/v2/logs?ddsource=cloudflare ``` **Note**: `ddsource=cloudflare` is required. To differentiate between logs, you can also add the optional parameters of `service`, `host`, and `ddtags`. **Example**: ``` http-intake.logs./api/v2/logs?service=&host=&ddsource=cloudflare ``` 1. Enter the Datadog API key you used to set up your Datadog Cloudflare integration tile. 1. After validating access, you should see "Ready to push!" under **Prove ownership**. Click `Push` to complete. ## Data Collected{% #data-collected %} ### Metrics{% #metrics %} | | | | | **cloudflare.requests.all**(count) | Total request count*Shown as request* | | **cloudflare.requests.cached**(count) | Cached requests count*Shown as request* | | **cloudflare.requests.uncached**(count) | Uncached requests count*Shown as request* | | **cloudflare.requests.ssl.encrypted**(count) | SSL encrypted requests count*Shown as request* | | **cloudflare.requests.ssl.unencrypted**(count) | Unencrypted requests count*Shown as request* | | **cloudflare.requests.country**(count) | Request count, tagged by IATA country code*Shown as request* | | **cloudflare.requests.status**(count) | Request count, tagged by HTTP response code*Shown as request* | | **cloudflare.requests.content\_type**(count) | Request count, tagged by Content-Type*Shown as request* | | **cloudflare.requests.ip\_class**(count) | Request count, tagged by IP class*Shown as request* | | **cloudflare.requests.cross\_zone\_sub\_requests.avg**(gauge) | The proportion of requests that were initiated by a Cloudflare Worker on another zone tagged by IATA country code and cache status*Shown as request* | | **cloudflare.requests.edge\_dns\_response\_time.avg**(gauge) | Average edge dns response time in milliseconds tagged by IATA country code and cache status*Shown as millisecond* | | **cloudflare.requests.edge\_time\_to\_first\_byte.avg**(gauge) | Average time to first byte in milliseconds tagged by IATA country code and cache status*Shown as millisecond* | | **cloudflare.requests.origin\_response\_duration.avg**(gauge) | The average originResponseDuration in milliseconds excluding 0 values (in orther words cached ones) tagged by IATA country code and cache status*Shown as millisecond* | | **cloudflare.requests.cross\_zone\_sub\_requests.avg.all**(gauge) | The proportion of requests that were initiated by a Cloudflare Worker on another zone*Shown as request* | | **cloudflare.requests.edge\_dns\_response\_time.avg.all**(gauge) | Average edge dns response time in milliseconds*Shown as millisecond* | | **cloudflare.requests.edge\_time\_to\_first\_byte.avg.all**(gauge) | Average time to first byte in milliseconds*Shown as millisecond* | | **cloudflare.requests.origin\_response\_duration.avg.all**(gauge) | The average originResponseDuration in milliseconds excluding 0 values (in orther words cached ones)*Shown as millisecond* | | **cloudflare.bandwidth.all**(count) | Total bandwidth*Shown as byte* | | **cloudflare.bandwidth.cached**(count) | Cached bandwidth*Shown as byte* | | **cloudflare.bandwidth.uncached**(count) | Uncached bandwidth*Shown as byte* | | **cloudflare.bandwidth.ssl.encrypted**(count) | SSL encrypted bandwidth*Shown as byte* | | **cloudflare.bandwidth.ssl.unencrypted**(count) | Unencrypted bandwidth*Shown as byte* | | **cloudflare.bandwidth.country**(count) | Bandwidth tagged by IATA country code*Shown as byte* | | **cloudflare.bandwidth.content\_type**(count) | Bandwidth tagged by Content-Type*Shown as byte* | | **cloudflare.threats.all**(count) | Total threats*Shown as operation* | | **cloudflare.threats.type**(count) | Threats tagged by type*Shown as operation* | | **cloudflare.threats.country**(count) | Threats tagged by IATA country code*Shown as operation* | | **cloudflare.pageviews.all**(count) | Total page views*Shown as page* | | **cloudflare.pageviews.search\_engine**(count) | Page views tagged by search engine*Shown as page* | | **cloudflare.uniques.all**(count) | Unique visitors count*Shown as connection* | | **cloudflare.dns.query.all**(count) | DNS query count*Shown as request* | | **cloudflare.dns.query.uncached**(count) | Uncached DNS query count*Shown as request* | | **cloudflare.dns.query.stale**(count) | Stale DNS query count*Shown as request* | | **cloudflare.dns.response\_time.avg**(gauge) | DNS query average response time*Shown as millisecond* | | **cloudflare.dns.response\_time.median**(gauge) | DNS query median response time*Shown as millisecond* | | **cloudflare.dns.response\_time.90p**(gauge) | DNS query response time to the 90th percentile*Shown as millisecond* | | **cloudflare.dns.response\_time.99p**(gauge) | DNS query response time to the 99th percentile*Shown as millisecond* | | **cloudflare.workers.requests.all**(count) | The request count to the worker script (metrics may not show without enabled API Key permissions)*Shown as request* | | **cloudflare.workers.requests.errors**(count) | The error count to the worker script (metrics may not show without enabled API Key permissions)*Shown as request* | | **cloudflare.workers.requests.subrequests**(count) | The subrequest count to the worker script (metrics may not show without enabled API Key permissions)*Shown as request* | | **cloudflare.workers.requests.client\_disconnects**(count) | The number of times the client disconnected from the worker script (metrics may not show without the enabled API Key permissions)*Shown as request* | | **cloudflare.workers.requests.response\_body\_size**(count) | The sum of response body sizes for the worker script (metrics may not show without the enabled API Key permissions)*Shown as byte* | | **cloudflare.workers.response\_time.75p**(gauge) | The worker response time to the 75th percentile (metrics may not show without enabled API Key permissions)*Shown as microsecond* | | **cloudflare.workers.response\_time.99p**(gauge) | The worker response time to the 99th percentile (metrics may not show without enabled API Key permissions)*Shown as microsecond* | | **cloudflare.workers.cpu\_time.p25**(gauge) | The worker CPU time to the 25th percentile*Shown as microsecond* | | **cloudflare.workers.cpu\_time.p50**(gauge) | The worker CPU time to the 50th percentile*Shown as microsecond* | | **cloudflare.workers.cpu\_time.p75**(gauge) | The worker CPU time to the 75th percentile*Shown as microsecond* | | **cloudflare.workers.cpu\_time.p90**(gauge) | The worker CPU time to the 90th percentile*Shown as microsecond* | | **cloudflare.workers.cpu\_time.p95**(gauge) | The worker CPU time to the 95th percentile*Shown as microsecond* | | **cloudflare.workers.cpu\_time.p99**(gauge) | The worker CPU time to the 99th percentile*Shown as microsecond* | | **cloudflare.workers.response\_body\_size.p25**(gauge) | The worker response body size to the 25th percentile*Shown as byte* | | **cloudflare.workers.response\_body\_size.p50**(gauge) | The worker response body size to the 50th percentile*Shown as byte* | | **cloudflare.workers.response\_body\_size.p75**(gauge) | The worker response body size to the 75th percentile*Shown as byte* | | **cloudflare.workers.response\_body\_size.p90**(gauge) | The worker response body size to the 90th percentile*Shown as byte* | | **cloudflare.workers.response\_body\_size.p95**(gauge) | The worker response body size to the 95th percentile*Shown as byte* | | **cloudflare.workers.response\_body\_size.p99**(gauge) | The worker response body size to the 99th percentile*Shown as byte* | | **cloudflare.workers.wall\_time.p25**(gauge) | The worker wall time to the 25th percentile*Shown as microsecond* | | **cloudflare.workers.wall\_time.p50**(gauge) | The worker wall time to the 50th percentile*Shown as microsecond* | | **cloudflare.workers.wall\_time.p75**(gauge) | The worker wall time to the 75th percentile*Shown as microsecond* | | **cloudflare.workers.wall\_time.p90**(gauge) | The worker wall time to the 90th percentile*Shown as microsecond* | | **cloudflare.workers.wall\_time.p95**(gauge) | The worker wall time to the 95th percentile*Shown as microsecond* | | **cloudflare.workers.wall\_time.p99**(gauge) | The worker wall time to the 99th percentile*Shown as microsecond* | | **cloudflare.load\_balancer.pool.round\_trip\_time.average**(gauge) | The average round trip time to reach the load balancer pool*Shown as millisecond* | | **cloudflare.load\_balancer.pool.health.status**(count) | The load balancer pool health status*Shown as request* | | **cloudflare.adaptive.bandwidth.all**(count) | Total bandwidth measured using adaptive sampling for high-traffic zones*Shown as byte* | | **cloudflare.adaptive.bandwidth.cached**(count) | Cached bandwidth measured using adaptive sampling*Shown as byte* | | **cloudflare.adaptive.bandwidth.uncached**(count) | Uncached bandwidth measured using adaptive sampling*Shown as byte* | | **cloudflare.adaptive.requests.all**(count) | Total request count using adaptive sampling for high-traffic zones*Shown as request* | | **cloudflare.adaptive.requests.cached**(count) | Cached requests count using adaptive sampling*Shown as request* | | **cloudflare.adaptive.requests.uncached**(count) | Uncached requests count using adaptive sampling*Shown as request* | | **cloudflare.adaptive.pageviews.all**(count) | Total page views using adaptive sampling*Shown as page* | | **cloudflare.adaptive.requests.count**(count) | Request count with multi-dimensional tags (edge response status, colo code, country, cache status, and host)*Shown as request* | #### Metric categories{% #metric-categories %} The table below describes the types of metrics collected and their associated metric prefixes. | **Type** | **Description** | **Metric Prefixes Collected** | | ----------------- | -------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Web Analytics** | Metrics related to web traffic and performance. | `cloudflare.requests.all``cloudflare.requests.cached``cloudflare.requests.uncached``cloudflare.requests.ssl.encrypted``cloudflare.requests.ssl.unencrypted``cloudflare.requests.country``cloudflare.requests.status``cloudflare.requests.content_type``cloudflare.requests.ip_class``cloudflare.bandwidth.all``cloudflare.bandwidth.cached``cloudflare.bandwidth.uncached``cloudflare.bandwidth.ssl.encrypted``cloudflare.bandwidth.ssl.unencrypted``cloudflare.bandwidth.country``cloudflare.bandwidth.content_type``cloudflare.threats.all``cloudflare.threats.type``cloudflare.threats.country``cloudflare.pageviews.all``cloudflare.pageviews.search_engine``cloudflare.uniques.all``cloudflare.requests.cross_zone_sub_requests.avg``cloudflare.requests.edge_dns_response_time.avg``cloudflare.requests.edge_time_to_first_byte.avg``cloudflare.requests.origin_response_duration.avg` | | **DNS** | Metrics related to DNS queries and response times. | `cloudflare.dns.query.all``cloudflare.dns.query.uncached``cloudflare.dns.query.stale``cloudflare.dns.response_time.avg``cloudflare.dns.response_time.median``cloudflare.dns.response_time.90p``cloudflare.dns.response_time.99p` | | **Load Balancer** | Metrics related to load balancing pools. | `cloudflare.load_balancer.pool.round_trip_time.average``cloudflare.load_balancer.pool.health.status` | | **Worker Script** | Metrics related to Cloudflare Workers scripts. | `cloudflare.workers.requests.all``cloudflare.workers.requests.errors``cloudflare.workers.requests.subrequests``cloudflare.workers.response_time.75p``cloudflare.workers.response_time.99p` | ### Events{% #events %} The Cloudflare integration does not include any events. ### Service Checks{% #service-checks %} The Cloudflare integration does not include any service checks. ## Troubleshooting{% #troubleshooting %} Need help? Contact [Datadog support](https://docs.datadoghq.com/help/). ## Further Reading{% #further-reading %} - [Monitor Cloudflare Zero Trust with Datadog Cloud SIEM](https://www.datadoghq.com/blog/monitor-cloudflare-zero-trust/) - [Monitor Cloudflare logs and metrics with Datadog](https://www.datadoghq.com/blog/cloudflare-monitoring-datadog/) - [Cloudflare](https://docs.datadoghq.com/integrations/cloudflare/)