Filters

The following table represents the comparison operators that are supported and example values. Filters are added as escaped JSON strings formatted as {"key":"<field>","operator":"<comparison_operator>","value":"<value>"}.

• Refer to the Log fields page for a list of fields related to each dataset.

• Comparison operators define how values must relate to fields in the log line for an expression to return true.

• Values represent the data associated with fields.

Name	Operator Notation	String	Int	Bool	Array	Object	Example
Equal	eq	✅	✅	✅	❌	❌	{"key":"ClientRequestHost","operator":"eq","value":"example.com"}
Not equal	!eq	✅	✅	✅	❌	❌	{"key":"ClientCountry","operator":"!eq","value":"ca"}
Less than	lt	❌	✅	❌	❌	❌	{"key":"BotScore","operator":"lt","value":"30"}
Less than or equal	leq	❌	✅	❌	❌	❌	{"key":"BotScore","operator":"leq","value":"30"}
Greater than	gt	❌	✅	❌	❌	❌	{"key":"BotScore","operator":"gt","value":"30"}
Greater than or equal	geq	❌	✅	❌	❌	❌	{"key":"BotScore","operator":"geq","value":"30"}
Starts with	startsWith	✅	❌	❌	❌	❌	{"key":"ClientRequestPath","operator":"startsWith","value":"/foo"}
Ends with	endsWith	✅	❌	❌	❌	❌	{"key":"ClientRequestPath","operator":"endsWith","value":"/foo"}
Does not start with	!startsWith	✅	❌	❌	❌	❌	{"key":"ClientRequestPath","operator":"!startsWith","value":"/foo"}
Does not end with	!endsWith	✅	❌	❌	❌	❌	{"key":"ClientRequestPath","operator":"!endsWith","value":"/foo"}
Contains	contains	✅	❌	❌	✅	❌	{"key":"ClientRequestPath","operator":"contains","value":"/static"}
Does not contain	!contains	✅	❌	❌	✅	❌	{"key":"ClientRequestPath","operator":"!contains","value":"/static"}
Value is in a set of values	in	✅	✅	❌	❌	❌	{"key":"EdgeResponseStatus","operator":"in","value":[200,201]}
Value is not in a set of values	!in	✅	✅	❌	❌	❌	{"key":"EdgeResponseStatus","operator":"!in","value":[200,201]}

The filter field has limits of approximately 30 operators and 1000 bytes. Anything exceeding this value will return an error.

Note

Filtering is not supported on the following data types: objects, array[object].

For the Firewall events dataset, the following fields are not supported: Action, Kind, MatchIndex, Metadata, OriginatorRayID, RuleID, and Source.

Logical Operators

• Filters can be connected using AND, OR logical operators.

• Logical operators can be nested.

Here are some examples of how the logical operators can be implemented. X, Y and Z are used to represent filter criteria:

• X AND Y AND Z - {"where":{"and":[{X},{Y},{Z}]}}

• X OR Y OR Z - {"where":{"or":[{X},{Y},{Z}]}}

• X AND (Y OR Z) - {"where":{"and":[{X}, {"or":[{Y},{Z}]}]}}

• (X AND Y) OR Z - {"where":{"or":[{"and": [{X},{Y}]},{Z}]}}

Set filters via API or dashboard

Filters can be set via API or the Cloudflare dashboard. Note that using a filter is optional, but if used, it must contain the where key.

API

Here is an example request using cURL via API:

curl https://api.cloudflare.com/client/v4/zones/{zone_id}/logpush/jobs \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>" \
--header "Content-Type: application/json" \
--data '{
  "name": "static-assets",
  "output_options": {
    "field_names": ["ClientIP", "EdgeStartTimestamp", "RayID"],
    "sample_rate": 0.1,
    "timestamp_format": "rfc3339"
    "CVE-2021-44228": "true"
  },
  "dataset": "http_requests",
  "filter": "{\"where\":{\"and\":[{\"key\":\"ClientRequestPath\",\"operator\":\"contains\",\"value\":\"/static\"},{\"key\":\"ClientRequestHost\",\"operator\":\"eq\",\"value\":\"example.com\"}]}}",
  "destination_conf": "s3://<BUCKET_PATH>?region=us-west-2/"
}'

Dashboard

To set filters through the dashboard:

1. Log in to the Cloudflare dashboard ↗ and select the domain you want to use.
2. Go to Analytics & Logs > Logs.
3. Select Add Logpush job. A modal window will open.
4. Select the dataset you want to push to a storage service.
5. Below Select data fields, in the Filter section, you can set up your filters.
6. You need to select a Field, an Operator, and a Value.
7. You can connect more filters using AND and OR logical operators.
8. Select Next to continue the setting up of your Logpush job.