Cloudflare Docs
Logs
Logs
Edit this page on GitHub
Set theme to dark (⇧+D)

Spectrum events

The descriptions below detail the fields available for spectrum_events.

FieldValueType
ApplicationThe unique public ID of the application on which the event occurred.string
ClientAsnClient AS number.int
ClientBytesThe number of bytes read from the client by the Spectrum service.int
ClientCountryCountry of the client IP address.string
ClientIPClient IP address.string
ClientMatchedIpFirewallWhether the connection matched any IP Firewall rules. UNKNOWN = No match or Firewall not enabled for spectrum; UNKNOWN | ALLOW | BLOCK_ERROR | BLOCK_IP | BLOCK_COUNTRY | BLOCK_ASN | WHITELIST_IP | WHITELIST_COUNTRY | WHITELIST_ASN.string
ClientPortClient port.int
ClientProtoTransport protocol used by client; tcp | udp | unix.string
ClientTcpRttThe TCP round-trip time in nanoseconds between the client and Spectrum.int
ClientTlsCipherThe cipher negotiated between the client and Spectrum. In v1, an unknown cipher returned as “Unknown.” In v2, it’s returned as “UNK.”string
ClientTlsClientHelloServerNameThe server name in the Client Hello message from client to Spectrum.string
ClientTlsProtocolThe TLS version negotiated between the client and Spectrum; unknown | none | SSLv3 | TLSv1 | TLSv1.1 | TLSv1.2 | TLSv1.3.string
ClientTlsStatusIndicates state of TLS session from the client to Spectrum; UNKNOWN | OK | INTERNAL_ERROR | INVALID_CONFIG | INVALID_SNI | HANDSHAKE_FAILED | KEYLESS_RPC.string
ColoCodeIATA airport code of data center that received the request.string
ConnectTimestampTimestamp at which both legs of the connection (client/edge, edge/origin or nexthop) were established.int or string
DisconnectTimestampTimestamp at which the connection was closed.int or string
Eventconnect | disconnect | clientFiltered | tlsError | resolveOrigin | originError.string
IpFirewallWhether IP Firewall was enabled at time of connection.bool
OriginBytesThe number of bytes read from the origin by Spectrum.int
OriginIPOrigin IP address.string
OriginPortOrigin port.int
OriginProtoTransport protocol used by origin; tcp | udp | unix.string
OriginTcpRttThe TCP round-trip time in nanoseconds between Spectrum and the origin.int
OriginTlsCipherThe cipher negotiated between Spectrum and the origin. In v1, an unknown cipher returned as “Unknown.” In v2, it’s returned as “UNK.”string
OriginTlsFingerprintSHA256 hash of origin certificate. In v1, an unknown SHA256 hash is returned as “0000000000000000000000000000000000000000000000000000000000000000.” In v2, it’s returned as an empty string.string
OriginTlsModeIf and how the upstream connection is encrypted; unknown | off | flexible | full | strict.string
OriginTlsProtocolThe TLS version negotiated between Spectrum and the origin; unknown | none | SSLv3 | TLSv1 | TLSv1.1 | TLSv1.2 | TLSv1.3.string
OriginTlsStatusThe state of the TLS session from Spectrum to the origin; UNKNOWN | OK | INTERNAL_ERROR | INVALID_CONFIG | INVALID_SNI | HANDSHAKE_FAILED | KEYLESS_RPC.string
ProxyProtocolWhich form of proxy protocol is applied to the given connection; off | v1 | v2 | simple.string
StatusA code indicating reason for connection closure.int
TimestampTimestamp at which the event took place.int or string