Cloudflare

The Cloudflare source receives logs pushed from Cloudflare LogPush jobs. Bindplane runs an HTTPS listener that LogPush delivers batched log records to over the public internet.

Supported Telemetry Types

Platform	Metrics	Logs	Traces
Linux		✓
Windows		✓
macOS		✓
Kubernetes Gateway		✓
OpenShift Gateway		✓

Prerequisites

• A Cloudflare Enterprise plan (LogPush is an Enterprise feature).
• A TLS certificate and private key signed by a publicly trusted certificate authority. Cloudflare rejects self-signed certificates.
• The collector reachable from the public internet on the configured HTTPS port.
• A Cloudflare LogPush job whose destination points at the collector (see Configuring a LogPush job).

Configuration

General

Parameter	Type	Default	Description
Listen Address	String	0.0.0.0	The IP address to listen on. The collector must be reachable from the internet to receive logs from Cloudflare.
HTTPS Port	Integer	8443	TCP port to receive incoming uploads from the LogPush job(s).
Shared Secret	String		String used to validate that a message is coming from an expected source. When set, it must also be configured on the LogPush job destination as the X-CF-Secret header.

TLS

Parameter	Type	Default	Description
Enable TLS	Boolean	true	Whether or not to use TLS. Cloudflare requires the endpoint to use TLS.
TLS Certificate File	String		Local path to the TLS certificate used to encrypt the listening server. Required when TLS is enabled.
TLS Private Key File	String		Local path to the TLS private key used to encrypt the listening server. Required when TLS is enabled.
Mutual TLS	Boolean	false	Whether or not to require client TLS authentication (mTLS).
TLS Certificate Authority File	String		Local path to the certificate authority used to authenticate client certificates. Required when Mutual TLS is enabled.

Advanced

Parameter	Type	Default	Description
Attributes	Map	{}	A map of Cloudflare LogPush field names to log record attributes. Each key is a LogPush field; the value is the attribute name to map it to.
Timestamp Field	String	EdgeStartTimestamp	The name of the field parsed to set the timestamp of the log record.

Configuring a LogPush job

Cloudflare delivers logs to the collector through an HTTP-destination LogPush job. From the Cloudflare dashboard (or the LogPush API), create a job for the dataset you want (for example, HTTP requests or Firewall events) with an HTTP destination of:

https://<collector-host>:8443/?header_X-CF-Secret=<secret>

• <collector-host> is the publicly resolvable hostname of the collector, matching the certificate's subject.
• <secret> is the same value set in the secret parameter above.

Cloudflare validates the destination by sending a challenge file before it begins delivery. Make sure the collector is running and reachable before you create the job.

Example Configuration

Standalone Source

apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  id: cloudflare
  name: cloudflare
spec:
  type: cloudflare
  parameters:
    - name: listen_address
      value: '0.0.0.0'
    - name: https_port
      value: '8443'
    - name: secret
      value: 'my-shared-secret'
    - name: enable_tls
      value: 'true'
    - name: cert_file
      value: '/opt/observiq-otel-collector/cloudflare.crt'
    - name: key_file
      value: '/opt/observiq-otel-collector/cloudflare.key'
    - name: timestamp_field
      value: 'EdgeStartTimestamp'

Configuration Tips

Mapping LogPush fields to attributes

• Use the attributes parameter to promote specific LogPush fields (for example, ClientIP, RayID, EdgeResponseStatus) to log record attributes so they can be filtered on downstream.
• Map timestamp_field to the field that best represents event time for your dataset. EdgeStartTimestamp suits HTTP request logs; other datasets may expose a different timestamp field.

Kubernetes and OpenShift

• On Kubernetes Gateway and OpenShift Gateway collectors, create a custom Service to route external traffic to the collector. See Custom Service.

Troubleshooting

Symptom: Cloudflare reports the LogPush job destination as invalid, or no logs arrive. Solution: Confirm the collector is reachable from the public internet on the configured port and that the TLS certificate is signed by a publicly trusted CA. Self-signed certificates cause Cloudflare's destination validation to fail.

Symptom: Logs are received but the timestamp does not match event time. Solution: Set timestamp_field to the timestamp field present in your LogPush dataset (for example, EdgeStartTimestamp for HTTP request logs). If the field is absent, the receiver falls back to ingestion time.

Symptom: Records are delivered from an unexpected source. Solution: Set the secret parameter and configure the matching X-CF-Secret header on the LogPush job destination so the receiver rejects requests without the shared secret.

Related Resources

• Cloudflare LogPush documentation
• Cloudflare LogPush HTTP destination
• Custom Service for Kubernetes collectors