# Log Explorer # Query ## Run a log query `logs.log_explorer.query.sql(QuerySqlParams**kwargs) -> SyncSinglePage[QuerySqlResponse]` **post** `/{accounts_or_zones}/{account_or_zone_id}/logs/explorer/query/sql` Run a SQL query against account or zone-level datasets. Timestamp fields are RFC3339 strings. Filter with: WHERE {timestamp_field} >= now() - INTERVAL '30' DAY WHERE {timestamp_field} >= '2026-04-01T00:00:00Z' WHERE {timestamp_field} BETWEEN '2026-04-01T00:00:00Z' AND '2026-04-30T23:59:59Z' Check /account or zones/{account or zone_id}/logs/explorer/datasets to see enabled account or zone level datasets. Zone-level datasets will not appear here. Check /account or zones/{account or zone_id}/logs/explorer/datasets/available for the schemas, and the name of the timestamp fields. For zone-level datasets use the zone-scoped endpoint: POST /zones/{zone_id}/logs/explorer/query/sql For more information about the datasets, and the meaning of each field, check out https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/ ### Parameters - `body: FileTypes` SQL query to execute. - `account_id: Optional[str]` The Account ID to use for this endpoint. Mutually exclusive with the Zone ID. - `zone_id: Optional[str]` The Zone ID to use for this endpoint. Mutually exclusive with the Account ID. ### Returns - `Dict[str, object]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) page = client.logs.log_explorer.query.sql( body=b"Example data", account_id="account_id", ) page = page.result[0] print(page) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ "string" ], "success": true, "result": [ { "foo": "bar" } ] } ``` ## Domain Types ### Query Sql Response - `Dict[str, object]` # Datasets ## List account or zone datasets `logs.log_explorer.datasets.list(DatasetListParams**kwargs) -> SyncSinglePage[DatasetSummary]` **get** `/{accounts_or_zones}/{account_or_zone_id}/logs/explorer/datasets` Returns all Log Explorer datasets configured for the account or zone. Pass `include_zones=true` to also include zone-level datasets that belong to this account or zone. List responses omit the `fields` property; use the single-dataset endpoint to retrieve field configuration. ### Parameters - `account_id: Optional[str]` The Account ID to use for this endpoint. Mutually exclusive with the Zone ID. - `zone_id: Optional[str]` The Zone ID to use for this endpoint. Mutually exclusive with the Account ID. - `include_zones: Optional[bool]` Set to true to include zone-scoped datasets belonging to this account. ### Returns - `class DatasetSummary: …` A Log Explorer dataset summary. List endpoints return this type and omit field configuration; use the single-dataset endpoint to retrieve it. - `created_at: datetime` RFC3339 timestamp recording when the API created this dataset. - `dataset: str` Dataset type name (e.g. `http_requests`). - `dataset_id: str` Unique dataset ID. - `enabled: bool` Whether log ingest is currently active for this dataset. - `object_id: str` Public ID of the account or zone that owns this dataset. - `object_type: Literal["account", "zone"]` Whether this dataset belongs to an account or a zone. - `"account"` - `"zone"` - `updated_at: datetime` RFC3339 timestamp recording when the API last updated this dataset. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) page = client.logs.log_explorer.datasets.list( account_id="account_id", ) page = page.result[0] print(page.dataset_id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ "string" ], "success": true, "result": [ { "created_at": "2019-12-27T18:11:19.117Z", "dataset": "dataset", "dataset_id": "dataset_id", "enabled": true, "object_id": "object_id", "object_type": "account", "updated_at": "2019-12-27T18:11:19.117Z" } ] } ``` ## Get an account or zone dataset `logs.log_explorer.datasets.get(strdataset_id, DatasetGetParams**kwargs) -> Dataset` **get** `/{accounts_or_zones}/{account_or_zone_id}/logs/explorer/datasets/{dataset_id}` Retrieve a single Log Explorer dataset by ID for the account or zone. ### Parameters - `dataset_id: str` - `account_id: Optional[str]` The Account ID to use for this endpoint. Mutually exclusive with the Zone ID. - `zone_id: Optional[str]` The Zone ID to use for this endpoint. Mutually exclusive with the Account ID. ### Returns - `class Dataset: …` A Log Explorer dataset summary. List endpoints return this type and omit field configuration; use the single-dataset endpoint to retrieve it. - `created_at: datetime` RFC3339 timestamp recording when the API created this dataset. - `dataset: str` Dataset type name (e.g. `http_requests`). - `dataset_id: str` Unique dataset ID. - `enabled: bool` Whether log ingest is currently active for this dataset. - `object_id: str` Public ID of the account or zone that owns this dataset. - `object_type: Literal["account", "zone"]` Whether this dataset belongs to an account or a zone. - `"account"` - `"zone"` - `updated_at: datetime` RFC3339 timestamp recording when the API last updated this dataset. - `fields: Optional[List[Field]]` The field configuration for this dataset. - `enabled: bool` Whether the API includes this field in log ingest. - `name: str` Field name in lowercase. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) dataset = client.logs.log_explorer.datasets.get( dataset_id="dataset_id", account_id="account_id", ) print(dataset.dataset_id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ "string" ], "success": true, "result": { "created_at": "2019-12-27T18:11:19.117Z", "dataset": "dataset", "dataset_id": "dataset_id", "enabled": true, "object_id": "object_id", "object_type": "account", "updated_at": "2019-12-27T18:11:19.117Z", "fields": [ { "enabled": true, "name": "name" } ] } } ``` ## Create an account or zone dataset `logs.log_explorer.datasets.create(DatasetCreateParams**kwargs) -> Dataset` **post** `/{accounts_or_zones}/{account_or_zone_id}/logs/explorer/datasets` Create a new Log Explorer dataset for the account or zone. Use the `/account or zones/{account or zone_id}/logs/explorer/datasets/available` endpoint to list dataset types you can create along with their available fields. The `fields` property is optional. If not specified, all available fields will be enabled. For zone-level datasets use the zone-scoped endpoint: POST /zones/{zone_id}/logs/explorer/datasets For dataset field definitions, see: https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/ ### Parameters - `dataset: str` Dataset type name to create (e.g. `http_requests`). - `account_id: Optional[str]` The Account ID to use for this endpoint. Mutually exclusive with the Zone ID. - `zone_id: Optional[str]` The Zone ID to use for this endpoint. Mutually exclusive with the Account ID. - `fields: Optional[Iterable[Field]]` Controls which fields the API ingests. Defaults to all available fields when absent. - `enabled: bool` Whether the API includes this field in log ingest. - `name: str` Field name in lowercase. ### Returns - `class Dataset: …` A Log Explorer dataset summary. List endpoints return this type and omit field configuration; use the single-dataset endpoint to retrieve it. - `created_at: datetime` RFC3339 timestamp recording when the API created this dataset. - `dataset: str` Dataset type name (e.g. `http_requests`). - `dataset_id: str` Unique dataset ID. - `enabled: bool` Whether log ingest is currently active for this dataset. - `object_id: str` Public ID of the account or zone that owns this dataset. - `object_type: Literal["account", "zone"]` Whether this dataset belongs to an account or a zone. - `"account"` - `"zone"` - `updated_at: datetime` RFC3339 timestamp recording when the API last updated this dataset. - `fields: Optional[List[Field]]` The field configuration for this dataset. - `enabled: bool` Whether the API includes this field in log ingest. - `name: str` Field name in lowercase. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) dataset = client.logs.log_explorer.datasets.create( dataset="dataset", account_id="account_id", ) print(dataset.dataset_id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ "string" ], "success": true, "result": { "created_at": "2019-12-27T18:11:19.117Z", "dataset": "dataset", "dataset_id": "dataset_id", "enabled": true, "object_id": "object_id", "object_type": "account", "updated_at": "2019-12-27T18:11:19.117Z", "fields": [ { "enabled": true, "name": "name" } ] } } ``` ## Update an account or zone dataset `logs.log_explorer.datasets.update(strdataset_id, DatasetUpdateParams**kwargs) -> Dataset` **put** `/{accounts_or_zones}/{account_or_zone_id}/logs/explorer/datasets/{dataset_id}` Updates the enabled state and/or field configuration of an account or zone dataset. ### Parameters - `dataset_id: str` - `enabled: bool` Whether to enable or disable log ingest for this dataset. - `account_id: Optional[str]` The Account ID to use for this endpoint. Mutually exclusive with the Zone ID. - `zone_id: Optional[str]` The Zone ID to use for this endpoint. Mutually exclusive with the Account ID. - `fields: Optional[Iterable[Field]]` Controls which fields the API ingests after the update. Defaults to all available fields when absent. - `enabled: bool` Whether the API includes this field in log ingest. - `name: str` Field name in lowercase. ### Returns - `class Dataset: …` A Log Explorer dataset summary. List endpoints return this type and omit field configuration; use the single-dataset endpoint to retrieve it. - `created_at: datetime` RFC3339 timestamp recording when the API created this dataset. - `dataset: str` Dataset type name (e.g. `http_requests`). - `dataset_id: str` Unique dataset ID. - `enabled: bool` Whether log ingest is currently active for this dataset. - `object_id: str` Public ID of the account or zone that owns this dataset. - `object_type: Literal["account", "zone"]` Whether this dataset belongs to an account or a zone. - `"account"` - `"zone"` - `updated_at: datetime` RFC3339 timestamp recording when the API last updated this dataset. - `fields: Optional[List[Field]]` The field configuration for this dataset. - `enabled: bool` Whether the API includes this field in log ingest. - `name: str` Field name in lowercase. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) dataset = client.logs.log_explorer.datasets.update( dataset_id="dataset_id", enabled=True, account_id="account_id", ) print(dataset.dataset_id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ "string" ], "success": true, "result": { "created_at": "2019-12-27T18:11:19.117Z", "dataset": "dataset", "dataset_id": "dataset_id", "enabled": true, "object_id": "object_id", "object_type": "account", "updated_at": "2019-12-27T18:11:19.117Z", "fields": [ { "enabled": true, "name": "name" } ] } } ``` ## Domain Types ### Create Request - `class CreateRequest: …` - `dataset: str` Dataset type name to create (e.g. `http_requests`). - `fields: Optional[List[Field]]` Controls which fields the API ingests. Defaults to all available fields when absent. - `enabled: bool` Whether the API includes this field in log ingest. - `name: str` Field name in lowercase. ### Dataset - `class Dataset: …` A Log Explorer dataset summary. List endpoints return this type and omit field configuration; use the single-dataset endpoint to retrieve it. - `created_at: datetime` RFC3339 timestamp recording when the API created this dataset. - `dataset: str` Dataset type name (e.g. `http_requests`). - `dataset_id: str` Unique dataset ID. - `enabled: bool` Whether log ingest is currently active for this dataset. - `object_id: str` Public ID of the account or zone that owns this dataset. - `object_type: Literal["account", "zone"]` Whether this dataset belongs to an account or a zone. - `"account"` - `"zone"` - `updated_at: datetime` RFC3339 timestamp recording when the API last updated this dataset. - `fields: Optional[List[Field]]` The field configuration for this dataset. - `enabled: bool` Whether the API includes this field in log ingest. - `name: str` Field name in lowercase. ### Dataset Summary - `class DatasetSummary: …` A Log Explorer dataset summary. List endpoints return this type and omit field configuration; use the single-dataset endpoint to retrieve it. - `created_at: datetime` RFC3339 timestamp recording when the API created this dataset. - `dataset: str` Dataset type name (e.g. `http_requests`). - `dataset_id: str` Unique dataset ID. - `enabled: bool` Whether log ingest is currently active for this dataset. - `object_id: str` Public ID of the account or zone that owns this dataset. - `object_type: Literal["account", "zone"]` Whether this dataset belongs to an account or a zone. - `"account"` - `"zone"` - `updated_at: datetime` RFC3339 timestamp recording when the API last updated this dataset. ### Update Request - `class UpdateRequest: …` - `enabled: bool` Whether to enable or disable log ingest for this dataset. - `fields: Optional[List[Field]]` Controls which fields the API ingests after the update. Defaults to all available fields when absent. - `enabled: bool` Whether the API includes this field in log ingest. - `name: str` Field name in lowercase. # Available ## List available account or zone datasets `logs.log_explorer.datasets.available.list(AvailableListParams**kwargs) -> SyncSinglePage[AvailableDataset]` **get** `/{accounts_or_zones}/{account_or_zone_id}/logs/explorer/datasets/available` Returns all dataset types that this account or zone can create. Each entry includes the dataset schema and timestamp field. The schema shows all possible fields for a dataset. However, not all fields may be available for your account or zone. When creating or updating a dataset, only fields available to your account or zone can be enabled. If you request a field that is not available, you will receive an error. ### Parameters - `account_id: Optional[str]` The Account ID to use for this endpoint. Mutually exclusive with the Zone ID. - `zone_id: Optional[str]` The Zone ID to use for this endpoint. Mutually exclusive with the Account ID. ### Returns - `class AvailableDataset: …` A dataset type that the account or zone can create. - `dataset: str` Dataset type name (e.g. `http_requests`). - `object_type: Literal["account", "zone"]` Whether this dataset type is account-scoped or zone-scoped. - `"account"` - `"zone"` - `schema: Schema` JSON Schema that describes the fields this dataset exposes. - `properties: Optional[Dict[str, object]]` - `required: Optional[List[str]]` - `type: Optional[Literal["object"]]` - `"object"` - `timestamp_field: str` The primary timestamp field name for this dataset. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) page = client.logs.log_explorer.datasets.available.list( account_id="account_id", ) page = page.result[0] print(page.dataset) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ "string" ], "success": true, "result": [ { "dataset": "dataset", "object_type": "account", "schema": { "properties": { "foo": "bar" }, "required": [ "string" ], "type": "object" }, "timestamp_field": "timestamp_field" } ] } ``` ## Domain Types ### Available Dataset - `class AvailableDataset: …` A dataset type that the account or zone can create. - `dataset: str` Dataset type name (e.g. `http_requests`). - `object_type: Literal["account", "zone"]` Whether this dataset type is account-scoped or zone-scoped. - `"account"` - `"zone"` - `schema: Schema` JSON Schema that describes the fields this dataset exposes. - `properties: Optional[Dict[str, object]]` - `required: Optional[List[str]]` - `type: Optional[Literal["object"]]` - `"object"` - `timestamp_field: str` The primary timestamp field name for this dataset. ### Available List - `class AvailableList: …` - `errors: List[ResponseInfo]` - `code: int` - `message: str` - `documentation_url: Optional[str]` - `source: Optional[Source]` - `pointer: Optional[str]` - `messages: List[str]` - `success: bool` - `result: Optional[List[AvailableDataset]]` - `dataset: str` Dataset type name (e.g. `http_requests`). - `object_type: Literal["account", "zone"]` Whether this dataset type is account-scoped or zone-scoped. - `"account"` - `"zone"` - `schema: Schema` JSON Schema that describes the fields this dataset exposes. - `properties: Optional[Dict[str, object]]` - `required: Optional[List[str]]` - `type: Optional[Literal["object"]]` - `"object"` - `timestamp_field: str` The primary timestamp field name for this dataset.