Cloudflare Overview Dashboard

Overview

Integrate with Cloudflare to get your zone metrics, including web traffic, DNS queries, and threat insights. The integration is based on Cloudflare’s analytics API. Learn more about what resources correspond with which metrics in our documentation.

Log Collection: In addition to these metrics, Cloudflare allows customers to push logs directly into Datadog using Cloudflare Logpush. These detailed logs contain metadata generated by Cloudflare products and are helpful for debugging and creating analytics, especially when combined with logs from other sources. Enable Cloudflare log collection in combination with these metrics to get full visibility into your Cloudflare environment.

The out-of-the-box dashboard improves the security and performance of your applications. This single pane of glass gives you visibility into

• security threats
• HTTP request volume and error rates
• load balancing, including round-trip time and any changes in traffic flow
• performance issues in worker scripts

With enriched logs and detailed metrics giving you deep insight into your Cloudflare infrastructure, you can build the context you need to resolve issues.

The integration works with Datadog Cloud SIEM to provide out-of-the-box threat detection for

• impossible travel
• dangerous misconfigurations
• DDoS attacks

Mitigate security threats more quickly with the included Workflow Automation blueprints, such as blocking an IP address or creating a case in Datadog.

Setup

Before you begin, you need a Datadog account, with an API token, and access to Cloudflare Logpush, which requires an Enterprise account plan.

To create a Cloudflare API Token, follow Cloudflare’s API Token Documentation and ensure it has the necessary permissions listed below for each account. If you encounter authentication issues with your token, contact Cloudflare Support.

Permissions

Installation

Install the integration with the Datadog Cloudflare integration tile by entering the API token you created above.

Configuration

1. Go to the Configure tab in the Datadog Cloudflare integration tile.
2. Enter your email address and the API token created earlier for the accounts you want to monitor. You can find your Cloudflare API token in your Cloudflare account under My Profile > API Tokens. Note that Cloudflare’s API Keys are now considered legacy authentication methods. If you’re using an API Key, we recommend replacing it with an API token.
3. Provide a name for the account. This name is arbitrary and will be used in the account tag on your metrics.

Log collection

Cloudflare allows customers to push logs directly into Datadog using Cloudflare Logpush. You can manage the Logpush job with the Cloudflare API or directly within your Cloudflare dashboard.

If you install the Cloudflare integration pipeline, it automatically remaps certain attributes. To see which attributes are remapped:

1. Navigate to Logs Pipelines.
2. Click Browse Pipeline Library on the top right.
3. Enter Cloudflare in the search bar.
4. Click Cloudflare to see the list of remappers and other processors that are installed.

Cloudflare API

1. Create a Logpush job by making a POST request to the Logpush jobs endpoint. Include the following fields:

   • name (optional): Use your domain name as the job name.
   • destination_conf: A log destination consisting of the following parameters:
     • <DATADOG_ENDPOINT_URL>: The Datadog HTTP logs intake endpoint, which can be either one below. You can find the difference at Datadog API reference.
       • v1: http-intake.logs./v1/input
       • v2 (latest): http-intake.logs./api/v2/logs
     • <DATADOG_API_KEY>: Your Datadog API key.
     • ddsource: Set to cloudflare.
     • service (optional): Specify service name.
     • host (optional): Specify host name.
     • ddtags (optional): Specify tags.
   • dataset: The category of logs you want to receive. See the Cloudflare Log fields for a list of supported datasets.
   • logpull_options (optional): To configure fields, sample rate, and timestamp format, see the Logpush API options. Datadog mandates the use of RFC 3339 format for timestamps from Cloudflare, which is the default option used by Cloudflare.

   Example request:

   curl -s -X POST 'https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs' \
   --header 'X-Auth-Key: <CLOUDFLARE_AUTH_KEY>' \
   --header 'X-Auth-Email: <CLOUDFLARE_AUTH_EMAIL>' \
   --header 'Content-Type: application/json' \
   --data-raw '{
      "name": "<NAME>",
      "destination_conf": "datadog://<DATADOG_ENDPOINT_URL>?header_DD-API-KEY=<DATADOG_API_KEY>&ddsource=cloudflare&service=cloudflare&ddtags=env:dev",
      "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
      "dataset": "http_requests"
   }'
   

   Example response:

   {
    "errors": [],
    "messages": [],
    "result": {
      "id": 100,
      "dataset": "http_requests",
      "enabled": false,
      "name": "<DOMAIN_NAME>",
      "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
      "destination_conf": "datadog://http-intake.logs./v1/input?header_DD-API-KEY=<DD-API-KEY>&ddsource=cloudflare&service=cloudflare&ddtags=env:dev",
      "last_complete": null,
      "last_error": null,
      "error_message": null
    },
    "success": true
   }
   

   Take note of the value of id. In the example above, it is 100.

2. Enable the job. Use the job ID returned in the response and send {"enabled": true} in the request body.

   Example request:

   curl -s -X PUT \
   https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs/<JOB_ID> -d'{"enabled":true}' | jq .
   

   Example response:

   {
     "errors": [],
     "messages": [],
     "result": {
       "id": 100,
       "dataset": "http_requests",
       "enabled": true,
       "name": "<DOMAIN_NAME>",
       "logpull_options": "fields=RayID,EdgeStartTimestamp&timestamps=rfc3339",
       "destination_conf": "datadog://?header_DD-API-KEY=<DATADOG-API-KEY>",
       "last_complete": null,
       "last_error": null,
       "error_message": null
     },
     "success": true
   }
   

Cloudflare dashboard

1. Once you have connected a service with the Logpush section of the Cloudflare dashboard, select the dataset, select data fields, and then, under select destination, choose Datadog.

2. Under Enter destination information, enter the Datadog URL Endpoint:

   http-intake.logs./api/v2/logs?ddsource=cloudflare
   

   Note: ddsource=cloudflare is required. To differentiate between logs, you can also add the optional parameters of service, host, and ddtags.

   Example:

   http-intake.logs./api/v2/logs?service=<SERVICE>&host=<HOST>&ddsource=cloudflare
   

3. Enter the Datadog API key you used to set-up your Datadog Cloudflare integration tile.

4. After validating access, you should see “Ready to push!” under Prove ownership. Click Push to complete.

Data Collected

Metrics

Metric categories

The table below describes the types of metrics collected and their associated metric prefixes.

Events

The Cloudflare integration does not include any events.

Service Checks

The Cloudflare integration does not include any service checks.

Troubleshooting

Need help? Contact Datadog support.