curl -s \ -H "X-Auth-Email: <REDACTED>" \ -H "X-Auth-Key: <REDACTED>" \ "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logs/received?start=2018-12-15T00:00:00Z&end=2018-12-15T01:00:00Z&sample=0.1" \ >sample.log ... $ wc -l sample.log 83 sample.log ... $ ls -lh sample.log -rw-r--r-- 1 mik mik 25K Dec 17 15:49 sample.log
Based on this information, the approximate number of messages/day is 19,920 (831024), and the byte size is 6MB (25K1024). The size estimate is based on the default response field set. Changing the response field set (see Fields) will change the response size.
To get a good estimate of daily traffic, it is best to get at least 30 log lines in your hourly sample. If the response size is too small (or too large), adjust the sample value, not the time range.
Responses are compressed by default (gzip).
cURL decompresses responses transparently, unless called with:
-H "accept-encoding: gzip"
In that case, the output remains gzipped. Compressed data is approximately 5-10% of its uncompressed size. This means that a 1GB uncompressed response gets compressed down to 50-100MB.
If the response or timeout limit is exceeded or there is any problem fetching the response, a
200 status will be returned and the response will end with the non-JSON text line “Error streaming data.” Because responses are streamed, there is no way to identify the error ahead of time. A response is successful if it does not end with the “Error streaming data" text line.
Once you receive a successful response for a given zone and time range, the following is true for all subsequent requests:
Regarding the inclusion of the fields parameter:
The following usage restrictions apply:
408error response if the connection is idle for 30s. This timeout usually means that the request is probably too exhaustive (frequent timeouts (> 12/hr) will result in subsequent queries to be blocked with status code 429 for 1hr) and so:
* try requesting records using lesser number of fields * try with smaller **start** and **end** parameters