Cloudflare
Connect your Cloudflare account so Sazabi can automatically create and manage Logpush jobs for the datasets you select.
About
Cloudflare Logpush exports zone and account logs — HTTP requests, firewall events, DNS queries, Spectrum events, and more — to Sazabi over HTTP. Connecting your account lets Sazabi create and maintain a Logpush job for each dataset you select; Sazabi provisions the job automatically when you add a log stream.
Cloudflare also has a Send to an endpoint path where you create the Logpush job yourself and point it at a Sazabi intake URL. See Cloudflare endpoint page for that setup.
Cloudflare Logpush is only available on the Enterprise plan. Free, Pro, and Business accounts cannot create Logpush jobs.
Prerequisites
- A Cloudflare account on the Enterprise plan.
- Permission to create API tokens under My Profile > API Tokens in your Cloudflare dashboard.
Set up in the dashboard
Create a Cloudflare API token
Create a Cloudflare API token with the following permissions:
- Account Settings: Read (account scope)
- Zone: Read (zone scope)
- Zone Logs: Edit (zone scope)
You can use the Cloudflare API token template to pre-fill the required permissions. Pick the account you want to connect, click Continue to summary, then Create Token, and copy the token.
Find your Cloudflare account ID
Your account ID is the 32-character hexadecimal string in your Cloudflare dashboard URL or on the Account Overview page.
Connect in Sazabi
Go to Settings > Log streams, click Add source, and select Cloudflare Logpush. Enter your API token and account ID, then click Connect.
Sazabi validates the token and account ID against the Cloudflare API. Once confirmed, your connection appears in the log source list.
Add log streams
After the connection is saved, click Add log stream to open the dataset picker. Select the zone or account datasets you want to forward. For each selected dataset Sazabi creates a Logpush job pointed at a dedicated intake URL (the public key it embeds is handled for you) — no further configuration is needed on the Cloudflare side.
Set up with the CLI
You can also connect the Cloudflare log source with the Sazabi CLI (installed and authenticated — see CLI reference).
Create a managed connection by passing your API token and account ID as metadata:
sazabi log-sources create cloudflare --mode managed \
--metadata '{"cloudflareApiToken":"'"$CLOUDFLARE_API_TOKEN"'","accountId":"<your account ID>"}'Use the same token permissions as the dashboard flow (Account Settings Read, Zone Read, Zone Logs Edit). The CLI validates the token and account ID against the Cloudflare API and creates the log source; note the log source ID it prints.
Add a log stream — one Logpush job per dataset — with sazabi log-streams create. Pass the dataset in --config; use "scope":"account" for account-scoped datasets, or "scope":"zone" with the zone's zoneId, zoneName, and accountId for zone-scoped datasets:
sazabi log-streams create --log-source-id <log-source-id> \
--config '{"scope":"account","accountId":"<your account ID>","dataset":"http_requests"}'Run sazabi log-sources list to confirm the source and its streams.
Verify
Generate activity on a connected zone or account — for example send an HTTP request, trigger a firewall rule, or make a DNS query.
Open the Intake page in the Sazabi dashboard and confirm that records attributed to the Cloudflare Logpush source appear. Logs typically arrive within one to two minutes of the Logpush job delivering them.
Troubleshooting
"Cloudflare Logpush is only available on the Enterprise plan" — Upgrade your Cloudflare account, or use the send-to-an-endpoint path if you manage your own Logpush job (Enterprise is still required for Logpush regardless of setup path).
Token validation fails — Confirm the token has all three required permission groups: Account Settings Read, Zone Read, and Zone Logs Edit. Tokens missing any one of them fail the Sazabi validation call.
No datasets appear in the stream picker — The account ID must match the account the token was issued for. Verify the 32-character account ID from your Cloudflare dashboard URL.
Logs stop appearing after a period — The Logpush job may have been deleted or paused in Cloudflare, or the token may have been revoked. Check the job status under Analytics & Logs > Logpush in your Cloudflare dashboard, then reconnect from Settings > Log streams in Sazabi if needed.