Store and explore your Cloudflare logs directly within the Cloudflare dashboard or API.
Log Explorer (Legacy) lets security teams and developers analyze, investigate, and monitor issues directly from the Cloudflare dashboard, without the expense and complexity of forwarding logs to third-party tools.
Log Explorer is labeled Legacy because it is being merged into Observability Logs. Your datasets, subscription, and API access continue to work.
Log Explorer provides access to Cloudflare logs with all the context available within the Cloudflare platform. You can monitor security and performance issues with custom dashboards or investigate and troubleshoot issues with log search. Benefits include:
- Reduced cost and complexity: Drastically reduce the expense and operational overhead associated with forwarding, storing, and analyzing terabytes of log data in external tools.
- Faster detection and triage: Access Cloudflare-native logs directly, eliminating cumbersome data pipelines and the ingest lags that delay critical security insights.
- Accelerated investigations with full context: Investigate incidents with Cloudflare's unparalleled contextual data, accelerating your analysis and understanding of "What exactly happened?" and "How did it happen?"
- Minimal recovery time: Seamlessly transition from investigation to action with direct mitigation capabilities via the Cloudflare platform.
Contract customers can choose to store their logs in Log Explorer for up to two years, at an additional cost of $0.10 per GB per month. Customers interested in this feature can contact their account team to have it added to their contract.
Access to Log Explorer depends on how you connect. Account members need a member role, and API tokens need an API token permission. The token permissions are not member roles and do not appear in the role picker.
| Feature | Member role | API token permission | Description |
|---|---|---|---|
| Log Search | Log Share Reader (Log Share and Administrator Read Only also work) | Logs Read |
Query logs in the dashboard or via API. |
| Log Search (save query) | Super Administrator or Administrator | Logs Edit |
Save, edit, or delete log search queries. |
| Manage datasets | Super Administrator or Administrator | Logs Edit |
Add, enable, or disable datasets. |
| Custom dashboards | Analytics | Analytics Read |
Create and view custom dashboards. |
The API lists Logs Edit as Logs Write. They are the same permission.
Grant roles and permissions at the account level to query account-level datasets. A role assigned to specific zones only covers that zone's datasets.
For zone-level datasets and saved queries, Log Share can also make changes.
Some datasets need an additional member role:
- Zero Trust datasets, such as Gateway and DEX, need Cloudflare Zero Trust PII.
- Audit log datasets need Audit Logs Viewer.
Authentication with the API can be done via an API token or API key with an email. Refer to Create API token for further instructions.
Design customized views for tracking application security, performance, and usage metrics.
Choose which datasets to store in Log Explorer.
Manage configuration and perform queries via the API.
Forward Cloudflare logs to third-party tools for debugging, identifying configuration adjustments, and creating analytics dashboards.
Visualize the metadata collected by our products in the Cloudflare dashboard.