> For the complete documentation index, see [llms.txt](https://docs.bindplane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bindplane.com/integrations/sources/cloudflare.md).

# Cloudflare

The Cloudflare source receives logs pushed from [Cloudflare LogPush](https://developers.cloudflare.com/logs/about/) jobs. Bindplane runs an HTTPS listener that LogPush delivers batched log records to over the public internet.

### Supported Telemetry Types

| Platform           | Metrics | Logs | Traces |
| ------------------ | ------- | ---- | ------ |
| Linux              |         | ✓    |        |
| Windows            |         | ✓    |        |
| macOS              |         | ✓    |        |
| Kubernetes Gateway |         | ✓    |        |
| OpenShift Gateway  |         | ✓    |        |

### Prerequisites

* A Cloudflare **Enterprise** plan (LogPush is an Enterprise feature).
* A TLS certificate and private key signed by a **publicly trusted** certificate authority. Cloudflare rejects self-signed certificates.
* The collector reachable from the public internet on the configured HTTPS port.
* A Cloudflare LogPush job whose destination points at the collector (see [Configuring a LogPush job](#configuring-a-logpush-job)).

### Configuration

<figure><img src="/files/82MECgr1KhDpPYLm3ewe" alt="Bindplane docs - Cloudflare - image 1"><figcaption></figcaption></figure>

#### General

| Parameter      | Type    | Default   | Description                                                                                                                                                                |
| -------------- | ------- | --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Listen Address | String  | `0.0.0.0` | The IP address to listen on. The collector must be reachable from the internet to receive logs from Cloudflare.                                                            |
| HTTPS Port     | Integer | `8443`    | TCP port to receive incoming uploads from the LogPush job(s).                                                                                                              |
| Shared Secret  | String  |           | String used to validate that a message is coming from an expected source. When set, it must also be configured on the LogPush job destination as the `X-CF-Secret` header. |

#### TLS

| Parameter                      | Type    | Default | Description                                                                                                            |
| ------------------------------ | ------- | ------- | ---------------------------------------------------------------------------------------------------------------------- |
| Enable TLS                     | Boolean | `true`  | Whether or not to use TLS. Cloudflare requires the endpoint to use TLS.                                                |
| TLS Certificate File           | String  |         | Local path to the TLS certificate used to encrypt the listening server. Required when TLS is enabled.                  |
| TLS Private Key File           | String  |         | Local path to the TLS private key used to encrypt the listening server. Required when TLS is enabled.                  |
| Mutual TLS                     | Boolean | `false` | Whether or not to require client TLS authentication (mTLS).                                                            |
| TLS Certificate Authority File | String  |         | Local path to the certificate authority used to authenticate client certificates. Required when Mutual TLS is enabled. |

#### Advanced

| Parameter       | Type   | Default              | Description                                                                                                                                  |
| --------------- | ------ | -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| Attributes      | Map    | `{}`                 | A map of Cloudflare LogPush field names to log record attributes. Each key is a LogPush field; the value is the attribute name to map it to. |
| Timestamp Field | String | `EdgeStartTimestamp` | The name of the field parsed to set the timestamp of the log record.                                                                         |

### Configuring a LogPush job

Cloudflare delivers logs to the collector through an HTTP-destination LogPush job. From the Cloudflare dashboard (or the LogPush API), create a job for the dataset you want (for example, **HTTP requests** or **Firewall events**) with an HTTP destination of:

```
https://<collector-host>:8443/?header_X-CF-Secret=<secret>
```

* `<collector-host>` is the publicly resolvable hostname of the collector, matching the certificate's subject.
* `<secret>` is the same value set in the `secret` parameter above.

Cloudflare validates the destination by sending a challenge file before it begins delivery. Make sure the collector is running and reachable before you create the job.

### Example Configuration

#### Standalone Source

```yaml
apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  id: cloudflare
  name: cloudflare
spec:
  type: cloudflare
  parameters:
    - name: listen_address
      value: '0.0.0.0'
    - name: https_port
      value: '8443'
    - name: secret
      value: 'my-shared-secret'
    - name: enable_tls
      value: 'true'
    - name: cert_file
      value: '/opt/observiq-otel-collector/cloudflare.crt'
    - name: key_file
      value: '/opt/observiq-otel-collector/cloudflare.key'
    - name: timestamp_field
      value: 'EdgeStartTimestamp'
```

### Configuration Tips

#### Mapping LogPush fields to attributes

* Use the `attributes` parameter to promote specific LogPush fields (for example, `ClientIP`, `RayID`, `EdgeResponseStatus`) to log record attributes so they can be filtered on downstream.
* Map `timestamp_field` to the field that best represents event time for your dataset. `EdgeStartTimestamp` suits HTTP request logs; other datasets may expose a different timestamp field.

#### Kubernetes and OpenShift

* On Kubernetes Gateway and OpenShift Gateway collectors, create a custom Service to route external traffic to the collector. See [Custom Service](https://docs.bindplane.com/deployment/kubernetes/collector/custom-service).

### Troubleshooting

**Symptom:** Cloudflare reports the LogPush job destination as invalid, or no logs arrive. **Solution:** Confirm the collector is reachable from the public internet on the configured port and that the TLS certificate is signed by a publicly trusted CA. Self-signed certificates cause Cloudflare's destination validation to fail.

**Symptom:** Logs are received but the timestamp does not match event time. **Solution:** Set `timestamp_field` to the timestamp field present in your LogPush dataset (for example, `EdgeStartTimestamp` for HTTP request logs). If the field is absent, the receiver falls back to ingestion time.

**Symptom:** Records are delivered from an unexpected source. **Solution:** Set the `secret` parameter and configure the matching `X-CF-Secret` header on the LogPush job destination so the receiver rejects requests without the shared secret.

### Related Resources

* [Cloudflare LogPush documentation](https://developers.cloudflare.com/logs/about/)
* [Cloudflare LogPush HTTP destination](https://developers.cloudflare.com/logs/get-started/enable-destinations/http/)
* [Custom Service for Kubernetes collectors](https://docs.bindplane.com/deployment/kubernetes/collector/custom-service)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.bindplane.com/integrations/sources/cloudflare.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.