Cloudflare
The Cloudflare source receives logs pushed from Cloudflare LogPush jobs. Bindplane runs an HTTPS listener that LogPush delivers batched log records to over the public internet.
Supported Telemetry Types
Linux
✓
Windows
✓
macOS
✓
Kubernetes Gateway
✓
OpenShift Gateway
✓
Prerequisites
A Cloudflare Enterprise plan (LogPush is an Enterprise feature).
A TLS certificate and private key signed by a publicly trusted certificate authority. Cloudflare rejects self-signed certificates.
The collector reachable from the public internet on the configured HTTPS port.
A Cloudflare LogPush job whose destination points at the collector (see Configuring a LogPush job).
Configuration

General
Listen Address
String
0.0.0.0
The IP address to listen on. The collector must be reachable from the internet to receive logs from Cloudflare.
HTTPS Port
Integer
8443
TCP port to receive incoming uploads from the LogPush job(s).
Shared Secret
String
String used to validate that a message is coming from an expected source. When set, it must also be configured on the LogPush job destination as the X-CF-Secret header.
TLS
Enable TLS
Boolean
true
Whether or not to use TLS. Cloudflare requires the endpoint to use TLS.
TLS Certificate File
String
Local path to the TLS certificate used to encrypt the listening server. Required when TLS is enabled.
TLS Private Key File
String
Local path to the TLS private key used to encrypt the listening server. Required when TLS is enabled.
Mutual TLS
Boolean
false
Whether or not to require client TLS authentication (mTLS).
TLS Certificate Authority File
String
Local path to the certificate authority used to authenticate client certificates. Required when Mutual TLS is enabled.
Advanced
Attributes
Map
{}
A map of Cloudflare LogPush field names to log record attributes. Each key is a LogPush field; the value is the attribute name to map it to.
Timestamp Field
String
EdgeStartTimestamp
The name of the field parsed to set the timestamp of the log record.
Configuring a LogPush job
Cloudflare delivers logs to the collector through an HTTP-destination LogPush job. From the Cloudflare dashboard (or the LogPush API), create a job for the dataset you want (for example, HTTP requests or Firewall events) with an HTTP destination of:
<collector-host>is the publicly resolvable hostname of the collector, matching the certificate's subject.<secret>is the same value set in thesecretparameter above.
Cloudflare validates the destination by sending a challenge file before it begins delivery. Make sure the collector is running and reachable before you create the job.
Example Configuration
Standalone Source
Configuration Tips
Mapping LogPush fields to attributes
Use the
attributesparameter to promote specific LogPush fields (for example,ClientIP,RayID,EdgeResponseStatus) to log record attributes so they can be filtered on downstream.Map
timestamp_fieldto the field that best represents event time for your dataset.EdgeStartTimestampsuits HTTP request logs; other datasets may expose a different timestamp field.
Kubernetes and OpenShift
On Kubernetes Gateway and OpenShift Gateway collectors, create a custom Service to route external traffic to the collector. See Custom Service.
Troubleshooting
Symptom: Cloudflare reports the LogPush job destination as invalid, or no logs arrive. Solution: Confirm the collector is reachable from the public internet on the configured port and that the TLS certificate is signed by a publicly trusted CA. Self-signed certificates cause Cloudflare's destination validation to fail.
Symptom: Logs are received but the timestamp does not match event time. Solution: Set timestamp_field to the timestamp field present in your LogPush dataset (for example, EdgeStartTimestamp for HTTP request logs). If the field is absent, the receiver falls back to ingestion time.
Symptom: Records are delivered from an unexpected source. Solution: Set the secret parameter and configure the matching X-CF-Secret header on the LogPush job destination so the receiver rejects requests without the shared secret.
Related Resources
Last updated
Was this helpful?