Cloudflare
Create a Cloudflare Logpush job with an HTTP destination pointed at your Sazabi intake URL to stream edge network logs to Sazabi.
About
You can also connect your Cloudflare account to Sazabi and have Sazabi create and manage Logpush jobs automatically. See Cloudflare (connect your account) for that path.
This page covers the manual endpoint configuration: create a Logpush job yourself and point it at your Sazabi intake URL. Use this approach when you want to manage the Logpush job directly or when the connect-your-account path is not suitable for your setup.
Cloudflare Workers telemetry (console output and OTLP traces) comes from a separate source. See Cloudflare Workers.
Prerequisites
- A Cloudflare Enterprise plan. Logpush requires Enterprise.
- An API token with: Account Settings Read, Zone Read, and Zone Logs Edit permissions (when creating a zone-scoped job).
- Your Sazabi intake URL, shown above — open the log source and copy the Intake URL from its setup screen (the public key is embedded in the URL).
Set up in the dashboard
Open Logpush in the Cloudflare dashboard
In the Cloudflare dashboard, navigate to your zone or account, then go to Analytics & Logs > Logpush. Click Create a Logpush job.
Select a dataset and destination
Choose the dataset you want to stream (for example, HTTP requests, Firewall events, or DNS logs). When prompted for a destination, select HTTP and paste your Sazabi intake URL shown above.
Set the timestamp format to RFC3339
In the Logpush job output options, set the timestamp format to RFC3339. Sazabi requires RFC3339 timestamps to parse event times correctly.
Set the timestamp format to RFC3339 in the Logpush job output options. Other timestamp formats may cause events to be stored without a parseable timestamp.
Save and enable the job
Save the Logpush job. Once saved, the job starts streaming.
Set up with the CLI
You can also register the Cloudflare log source with the Sazabi CLI (installed and authenticated — see CLI reference).
Registering the source mints the same intake URL the dashboard shows above (the public key is embedded in its hostname):
sazabi log-sources create cloudflare --mode connectionlessThe command prints the intake URL for the new source — copy the whole URL and point your sender at it using the configuration shown above. Run sazabi log-sources get <log-source-id> at any time to reprint the endpoint, or sazabi log-sources list to see every log source in the project.
Verify
Generate traffic on the zone or account you configured (for example, make an HTTP request to your Cloudflare-proxied domain). Open the Intake page in the Sazabi dashboard and confirm records from the Cloudflare source appear within a minute or two.
Troubleshooting
No records arrive — Confirm the intake URL was pasted correctly into the Logpush HTTP destination and that the zone or account is generating traffic on the selected dataset.
Records appear but timestamps are wrong — Confirm the Logpush job output options use RFC3339 timestamp format. Other formats are not parsed correctly.
Enterprise plan required — Logpush is only available on Cloudflare Enterprise plans. On other plans, use a Worker to forward logs instead — see Cloudflare Workers endpoint.
Missing datasets — Some Logpush datasets require specific Cloudflare add-ons or plan features. If a dataset does not appear in the Logpush UI, check the Cloudflare documentation for that dataset's requirements.