Skip to content
Cloudflare Docs

Filter different views

You can utilize different Log filters to only view specific data from Cloudflare Network Firewall.

Filter by enabled or disabled rules

Use the filter examples below to filter your Cloudflare Network Firewall traffic to display events for enabled or disabled rules.

The example below creates a Logpush job that only displays fields relevant to Cloudflare Network Firewall, and the filter only displays events for disabled rules.

Required API token permissions

 At least one of the following token permissions is required:
  • Logs Write
Create Logpush job
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/logpush/jobs" \
  --request POST \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --json '{
    "destination_conf": "<DESTINATION_CONF>",
    "output_options": {
        "field_names": [
            "ColoName",
            "Datetime",
            "Direction",
            "IPDestinationAddress",
            "IPDestinationSubnet",
            "IPProtocol",
            "IPSourceAddress",
            "IPSourceSubnet",
            "Outcome",
            "RuleID",
            "RulesetID",
            "SampleInterval",
            "Verdict"
        ]
    },
    "filter": "{\"where\":{\"or\":[{\"and\":[{\"key\":\"MitigationSystem\",\"operator\":\"eq\",\"value\":\"magic-firewall\"},{\"key\":\"RulesetID\",\"operator\":\"!eq\",\"value\":\"\"},{\"key\":\"Outcome\",\"operator\":\"eq\",\"value\":\"pass\"},{\"key\":\"Verdict\",\"operator\":\"eq\",\"value\":\"drop\"}]}]}}"
  }'

The example below creates a Logpush job that only displays fields relevant to Cloudflare Network Firewall, and the filter only displays events for enabled rules.

Required API token permissions

 At least one of the following token permissions is required:
  • Logs Write
Create Logpush job
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/logpush/jobs" \
  --request POST \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --json '{
    "destination_conf": "<DESTINATION_CONF>",
    "output_options": {
        "field_names": [
            "ColoName",
            "Datetime",
            "Direction",
            "IPDestinationAddress",
            "IPDestinationSubnet",
            "IPProtocol",
            "IPSourceAddress",
            "IPSourceSubnet",
            "Outcome",
            "RuleID",
            "RulesetID",
            "SampleInterval",
            "Verdict"
        ]
    },
    "filter": "{\"where\":{\"or\":[{\"and\":[{\"key\":\"MitigationSystem\",\"operator\":\"eq\",\"value\":\"magic-firewall\"},{\"key\":\"RulesetID\",\"operator\":\"!eq\",\"value\":\"\"},{\"or\":[{\"key\":\"Outcome\",\"operator\":\"eq\",\"value\":\"drop\"},{\"key\":\"Verdict\",\"operator\":\"eq\",\"value\":\"pass\"}]}]}]}}"
  }'

Filter by allowed or blocked traffic

Use the filter examples below to filter your Cloudflare Network Firewall traffic to display events for allowed or blocked traffic.

The example below creates a Logpush job that only displays fields relevant to Cloudflare Network Firewall, and the filter only displays events where no explicit action was taken, for example, a packet "fell through" Cloudflare Network Firewall. This example does not have any rules applied.

Required API token permissions

 At least one of the following token permissions is required:
  • Logs Write
Create Logpush job
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/logpush/jobs" \
  --request POST \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --json '{
    "destination_conf": "<DESTINATION_CONF>",
    "output_options": {
        "field_names": [
            "ColoName",
            "Datetime",
            "Direction",
            "IPDestinationAddress",
            "IPDestinationSubnet",
            "IPProtocol",
            "IPSourceAddress",
            "IPSourceSubnet",
            "Outcome",
            "RuleID",
            "RulesetID",
            "SampleInterval",
            "Verdict"
        ]
    },
    "filter": "{\"where\":{\"and\":[{\"key\":\"MitigationSystem\",\"operator\":\"eq\",\"value\":\"magic-firewall\"},{\"key\":\"RulesetID\",\"operator\":\"eq\",\"value\":\"\"}]}}"
  }'

The example below creates a Logpush job that only displays fields relevant to Cloudflare Network Firewall, and the filter only displays events where explicit action was taken. The example includes both enabled and disabled Cloudflare Network Firewall rules.

Required API token permissions

 At least one of the following token permissions is required:
  • Logs Write
Create Logpush job
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/logpush/jobs" \
  --request POST \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --json '{
    "destination_conf": "<DESTINATION_CONF>",
    "output_options": {
        "field_names": [
            "ColoName",
            "Datetime",
            "Direction",
            "IPDestinationAddress",
            "IPDestinationSubnet",
            "IPProtocol",
            "IPSourceAddress",
            "IPSourceSubnet",
            "Outcome",
            "RuleID",
            "RulesetID",
            "SampleInterval",
            "Verdict"
        ]
    },
    "filter": "{\"where\":{\"and\":[{\"key\":\"MitigationSystem\",\"operator\":\"eq\",\"value\":\"magic-firewall\"},{\"key\":\"RulesetID\",\"operator\":\"!eq\",\"value\":\"\"}]}}"
  }'

Filter by relevant fields to Cloudflare Network Firewall

Use the examples below to filter out fields that are not relevant to traffic flowing through Cloudflare Network Firewall. The example below creates a Logpush job that only includes Cloudflare Network Firewall events.

Required API token permissions

 At least one of the following token permissions is required:
  • Logs Write
Create Logpush job
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/logpush/jobs" \
  --request POST \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --json '{
    "destination_conf": "<DESTINATION_CONF>",
    "output_options": {
        "field_names": [
            "ColoName",
            "Datetime",
            "Direction",
            "IPDestinationAddress",
            "IPDestinationSubnet",
            "IPProtocol",
            "IPSourceAddress",
            "IPSourceSubnet",
            "Outcome",
            "RuleID",
            "RulesetID",
            "SampleInterval",
            "Verdict"
        ]
    },
    "filter": "{\"where\":{\"key\":\"MitigationSystem\",\"operator\":\"eq\",\"value\":\"magic-firewall\"}}"
  }'