Cloudflare Overview Dashboard

Overview

Integrate with Cloudflare to get your zone metrics, including web traffic, DNS queries, and threat insights. The integration is based on Cloudflare’s analytics API.

The out-of-the-box dashboard improves the security and performance of your applications. This single pane of glass gives you visibility into

• security threats
• HTTP request volume and error rates
• load balancing, including round-trip time and any changes in traffic flow
• performance issues in worker scripts

With enriched logs and detailed metrics giving you deep insight into your Cloudflare infrastructure, you can build the context you need to resolve issues.

The integration works with Datadog Cloud SIEM to provide out-of-the-box threat detection for

• impossible travel
• dangerous misconfigurations
• DDoS attacks

Mitigate security threats more quickly with the included Workflow Automation blueprints, such as blocking an IP address or creating a case in Datadog.

Setup

Before you begin, you need a Datadog account, with an API key, and access to Cloudflare Logpush, which requires an Enterprise account plan.

When using a Cloudflare API token, ensure it has the Zone > Zone > Read and Zone > Analytics > Read permissions.

Installation

Install the integration with the Datadog Cloudflare integration tile.

Configuration

1. Go to the Configuration tab inside the Datadog Cloudflare integration tile.
2. Enter the email addresses and API keys or token of the accounts you want to monitor. Your Cloudflare API key and API token are available in your Cloudflare account under My profile > Api Tokens.
3. Add a name for the account. This name is arbitrary and used in the account tag on your metrics.

Log collection

Cloudflare allows customers to push logs directly into Datadog using Cloudflare Logpush. You can manage the Logpush job with the Cloudflare API or with the Cloudflare dashboard.

If you install the Cloudflare integration pipeline, it automatically remaps certain attributes. To see which attributes are remapped:

1. Navigate to Logs Pipelines.
2. Click Browse Pipeline Library on the top right.
3. Enter Cloudflare in the search bar.
4. Click Cloudflare to see the list of remappers and other processors that are installed.

Cloudflare API

1. Create a Logpush job by making a POST request to the Logpush jobs endpoint. Include the following fields:

   • name (optional): Use your domain name as the job name.
   • destination_conf: A log destination consisting of the following parameters:
     • <DATADOG_ENDPOINT_URL>: The Datadog HTTP logs intake endpoint. Your endpoint is http-intake.logs./v1/input
     • <DATADOG_API_KEY>: Your Datadog API key.
     • ddsource: Set to cloudflare.
     • service (optional): Specify service name.
     • host (optional): Specify host name.
     • ddtags (optional): Specify tags.
   • dataset: The category of logs you want to receive. See the Cloudflare Log fields for a list of supported datasets.
   • logpull_options (optional): To configure fields, sample rate, and timestamp format, see the Logpush API options.

   Example request:

   curl -s -X POST 'https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs' \
   --header 'X-Auth-Key: <CLOUDFLARE_AUTH_KEY>' \
   --header 'X-Auth-Email: <CLOUDFLARE_AUTH_EMAIL>' \
   --header 'Content-Type: application/json' \
   --data-raw '{
      "name": "<NAME>",
      "destination_conf": "datadog://<DATADOG_ENDPOINT_URL>?header_DD-API-KEY=<DATADOG_API_KEY>&ddsource=cloudflare&service=cloudflare&ddtags=env:dev",
      "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
      "dataset": "http_requests"
   }'
   

   Example response:

   {
    "errors": [],
    "messages": [],
    "result": {
      "id": 100,
      "dataset": "http_requests",
      "enabled": false,
      "name": "<DOMAIN_NAME>",
      "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
      "destination_conf": "datadog://http-intake.logs./v1/input?header_DD-API-KEY=<DD-API-KEY>&ddsource=cloudflare&service=cloudflare&ddtags=env:dev",
      "last_complete": null,
      "last_error": null,
      "error_message": null
    },
    "success": true
   }
   

   Take note of the value of id. In the example above, it is 100.

2. Enable the job. Use the job ID returned in the response and send {"enabled": true} in the request body.

   Example request:

   curl -s -X PUT \
   https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs/<JOB_ID> -d'{"enabled":true}' | jq .
   

   Example response:

   {
     "errors": [],
     "messages": [],
     "result": {
       "id": 100,
       "dataset": "http_requests",
       "enabled": true,
       "name": "<DOMAIN_NAME>",
       "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
       "destination_conf": "datadog://?header_DD-API-KEY=<DATADOG-API-KEY>",
       "last_complete": null,
       "last_error": null,
       "error_message": null
     },
     "success": true
   }
   

Cloudflare dashboard

1. Once you have Connected a service with the Logpush section of the Cloudflare dashboard, select the dataset, select data fields, and then, under select destination, choose Datadog.

2. Under Enter destination information, enter the Datadog URL Endpoint:

   http-intake.logs./api/v2/logs?ddsource=cloudflare
   

   Note: ddsource=cloudflare is required. To differentiate between logs, you can also add the optional parameters of service, host, and ddtags.

   Example:

   http-intake.logs./api/v2/logs?service=<SERVICE>&host=<HOST>&ddsource=cloudflare
   

3. Enter the Datadog API key you used to set-up your Datadog Cloudflare integration tile.

4. After validating access, you should see “Ready to push!” under Prove ownership. Click Push to complete.

Data Collected

Metrics

Permissions

Verify your Cloudflare API token has these permissions enabled:

Events

The Cloudflare integration does not include any events.

Service Checks

The Cloudflare integration does not include any service checks.

Troubleshooting

Need help? Contact Datadog support.