INTEGRITY Cloudflare Docs

← Logs / logs / logpush / logpush-job / enable-destinations

Enable Datadog

Cloudflare Logpush supports pushing logs directly to Datadog via the Cloudflare dashboard or via API.

Manage via the Cloudflare dashboard

  1. In the Cloudflare dashboard, go to the Logpush page at the account or or domain (also known as zone) level.

    For account: Go to Logpush ↗

    For domain (also known as zone): Go to Logpush ↗

  2. Depending on your choice, you have access to account-scoped datasets and zone-scoped datasets, respectively.

  3. Select Create a Logpush job.

  1. In Select a destination, choose Datadog.

  2. Enter or select the following destination information:

  • http-intake.logs.datadoghq.com/v1/input
  • http-intake.logs.datadoghq.com/api/v2/logs

When you are done entering the destination details, select Continue.

  1. Select the dataset to push to the storage service.

  2. In the next step, you need to configure your logpush job:

    • Enter the Job name.
    • Under If logs match, you can select the events to include and/or remove from your logs. Refer to Filters for more information. Not all datasets have this option available.
    • In Send the following fields, you can choose to either push all logs to your storage destination or selectively choose which logs you want to push.

  3. In Advanced Options, you can:

    • Choose the format of timestamp fields in your logs (RFC3339 (default), Unix, or UnixNano).
    • Select a sampling rate for your logs or push a randomly-sampled percentage of logs.
    • Enable redaction for CVE-2021-44228. This option will replace every occurrence of ${ with x{.

  4. Select Submit once you are done configuring your logpush job.

Manage via API

To set up a Datadog Logpush job:

  1. Create a job with the appropriate endpoint URL and authentication parameters.
  2. Enable the job to begin pushing logs.

Ensure Log Share permissions are enabled, before attempting to read or configure a Logpush job. For more information refer to the Roles section.

1. Create a job

To create a job, make a POST request to the Logpush jobs endpoint with the following fields:

"datadog://<DATADOG_ENDPOINT_URL>?header_DD-API-KEY=<DATADOG_API_KEY>&ddsource=cloudflare&service=<SERVICE>&host=<HOST>&ddtags=<TAGS>"

Example request using cURL:

Required API token permissions

At least one of the following token permissions is required:
Create Logpush job
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/logpush/jobs" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "<DOMAIN_NAME>",
		"destination_conf": "datadog://<DATADOG_ENDPOINT_URL>?header_DD-API-KEY=<DATADOG_API_KEY>&ddsource=cloudflare&service=<SERVICE>&host=<HOST>&ddtags=<TAGS>",
		"output_options": {
				"field_names": [
						"ClientIP",
						"ClientRequestHost",
						"ClientRequestMethod",
						"ClientRequestURI",
						"EdgeEndTimestamp",
						"EdgeResponseBytes",
						"EdgeResponseStatus",
						"EdgeStartTimestamp",
						"RayID"
				],
				"timestamp_format": "rfc3339"
		},
		"dataset": "http_requests",
		"enabled": true
	}'

Response:

{
  "errors": [],
  "messages": [],
  "result": {
    "id": <JOB_ID>,
    "dataset": "http_requests",
    "kind": "",
    "enabled": true,
    "name": "<DOMAIN_NAME>",
    "output_options": {
      "field_names": ["ClientIP", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "EdgeEndTimestamp", "EdgeResponseBytes", "EdgeResponseStatus" ,"EdgeStartTimestamp", "RayID"],
      "timestamp_format": "rfc3339"
    },
    "destination_conf": "datadog://<DATADOG_ENDPOINT_URL>?header_DD-API-KEY=<DATADOG_API_KEY>",
    "last_complete": null,
    "last_error": null,
    "error_message": null
  },
  "success": true
}

Refer to Manage Logpush with cURL to update a job (including enabling and disabling).

Limitations

Note the following Logpush sending limitations, as described in the Datadog documentation ↗.

Send your logs to your Datadog platform over HTTP. Limits per HTTP request are the following: