Data Sets (tables)

Cloudflare Analytics offers a range of data sets, including both general and product-specific data sets. Data sets use a consistent naming scheme that explicitly identifies the type of data they return:

  • Domain. Each data set is named after the domain it describes and is associated with a set of nodes. Data nodes are typically named after the domain they represent. Product-specific data nodes incorporate the name of the relevant product, as in loadBalancingRequests. Network Analytics data nodes incorporate the ipFlows label.

  • Aggregated data. Nodes that represent aggregated data include the the Groups suffix. For example, the loadBalancingRequestsGroups node represents aggregated data for Load Balancing requests. Aggregated data returns in an array of ...Group objects. If the data represented by a node is aggregated prior to query time, the aggregation period is also specified. For example, requests1mGroups represents data aggregated into a collection of minute-wise roll-up reports.

  • Raw data. Raw data nodes, such as loadBalancingRequests, are not aggregated and so do not incorporate the Groups suffix. Raw data returns in arrays containing objects of the relevant data type. For example, a query to loadBalancingRequests returns an array of LoadBalancingRequest objects.

  • Adaptive Sampling. Nodes that represent data acquired using adaptive sampling incorporate the Adaptive suffix. (For details, see Sampling).

Detailed descriptions of nodes, their structure, and supported queries are available directly from the GraphQL Analytics API via introspection (see Getting started: Querying basics). For more on using introspection to ask a GraphQL schema for information about the queries it supports, see the GraphQL documentation.

Available data sets

The following data sets (and associated nodes) are available in Cloudflare Analytics:

Data set (product)Node
Browser InsightsbrowserPerf1mGroups
Firewall Activity LogfirewallEventsAdaptive firewallEventsAdaptiveByTimeGroups
Firewall AnalyticsfirewallEventsAdaptiveGroups
Firewall Rule PreviewfirewallRulePreviewGroups
Health Check AnalyticshealthCheckEvents healthCheckEventsGroups
HTTP RequestshttpRequests1mGroups httpRequests1hGroups httpRequests1dGroups httpRequests1mByColoGroups httpRequests1dByColoGroups
Image Resizing AnalyticsimageResizingRequests1mGroups
Load Balancing AnalyticsloadBalancingRequests loadBalancingRequestsGroups
Network AnalyticsipFlows1mGroups ipFlows1hGroups ipFlows1dGroups ipFlows1mAttacksGroups
SYN Attacks (DoS Analytics)synAvgPps1mGroups
Workers MetricsworkersInvocationsAdaptive

Beta data sets

Beta data sets are available to Enterprise customers for testing and exploration. Do not rely on beta data nodes, since they are subject to change or removal without notice.

Data set (product)Node
Cache AnalyticshttpRequestsCacheGroups
Browser InsightsbrowserPageRequests browserPerfGroups browserResourcePerfGroups browserResourceRequests

Deprecated data nodes

The following data nodes are deprecated. To avoid disruption, migrate to replacement nodes before the sunset date.

NodeReplacement nodeSunset date
firewallEventsfirewallEventsAdaptiveJan 9, 2020
firewallEventsGroupsfirewallEventsAdaptiveGroupsJan 9, 2020
firewallEventsByTimeGroupsfirewallEventsByTimeGroupsAdaptiveJan 9, 2020

Working with data sets

Aggregated fields

This example illustrates the structure for Groups:

type WhateverGroup {
    count # No subfields, it is just the group size. Not available for roll-up tables.
    sum {
        # fields that support summing (numbers, maps of numbers)
    avg {
        # fields that support averaging (numbers)
    uniq {
        # fields that support uniqueing (numbers, strings, enums, IPs, dates, etc.)

Unique values are not available as a dimension but can be queried as demonstrated in this example:

  # Get number of bytes and unique IPs in each minute.
  httpRequests1mGroups {
    sum {
    uniq {
      uniques # unique IPs
    dimensions {

  # Count the number of events in each hour.
  firewallEventsAdaptiveGroups {
    dimensions {

Schema type definitions

Every exposed table has a GraphQL type definition. Type definitions observe the following rules:

  • Regular fields represent themselves.
  • Every field, including nested fields, has a type and represents a list of that type.
  • The enum type represents an enumerated field.

Here is an example type definition for ContentTypeMapElem:

type ContentTypeMapElem {
    edgeResponseContentType: UInt32!
    requests: UInt64!
    bytes: UInt64!

# An array of httpRequestsGroup is the result of httpRequests1hGroups or
# httpRequests1mGroups query.
type httpRequestsGroup {
    date: Date!
    timeslot: DateTime!
    requests: UInt64!
    contentTypeMap: [ContentTypeMapElem!]!
    # ... other fields

enum TrustedClientCategory {

# An array of Request is the result of httpRequests query.
type Request {
    trustedClientCategory: TrustedClientCategory!
    # ... other fields