Filters

The following table represents the comparison operators that are supported and example values. Filters are added as escaped JSON strings formatted as {"key":"<field>","operator":"<comparison_operator>","value":"<value>"}.

• Refer to the Log fields page for a list of fields related to each dataset.

• Comparison operators define how values must relate to fields in the log line for an expression to return true.

• Values represent the data associated with fields.

Name	Operator Notation	String	Int	Bool	Array	Object	Example
Equal	eq	✅	✅	✅	❌	❌	{"key":"ClientRequestHost","operator":"eq","value":"example.com"}
Not equal	!eq	✅	✅	✅	❌	❌	{"key":"ClientCountry","operator":"!eq","value":"ca"}
Less than	lt	❌	✅	❌	❌	❌	{"key":"BotScore","operator":"lt","value":"30"}
Less than or equal	leq	❌	✅	❌	❌	❌	{"key":"BotScore","operator":"leq","value":"30"}
Greater than	gt	❌	✅	❌	❌	❌	{"key":"BotScore","operator":"gt","value":"30"}
Greater than or equal	geq	❌	✅	❌	❌	❌	{"key":"BotScore","operator":"geq","value":"30"}
Starts with	startsWith	✅	❌	❌	❌	❌	{"key":"ClientRequestPath","operator":"startsWith","value":"/foo"}
Ends with	endsWith	✅	❌	❌	❌	❌	{"key":"ClientRequestPath","operator":"endsWith","value":"/foo"}
Does not start with	!startsWith	✅	❌	❌	❌	❌	{"key":"ClientRequestPath","operator":"!startsWith","value":"/foo"}
Does not end with	!endsWith	✅	❌	❌	❌	❌	{"key":"ClientRequestPath","operator":"!endsWith","value":"/foo"}
Contains	contains	✅	❌	❌	✅	❌	{"key":"ClientRequestPath","operator":"contains","value":"/static"}
Does not contain	!contains	✅	❌	❌	✅	❌	{"key":"ClientRequestPath","operator":"!contains","value":"/static"}
Value is in a set of values	in	✅	✅	❌	❌	❌	{"key":"EdgeResponseStatus","operator":"in","value":[200,201]}
Value is not in a set of values	!in	✅	✅	❌	❌	❌	{"key":"EdgeResponseStatus","operator":"!in","value":[200,201]}

The filter field has limits of approximately 30 operators and 1000 bytes. Anything exceeding this value will return an error.

Note

Filtering is not supported on the following data types: objects, array[object].

For the Firewall events dataset, the following fields are not supported: Action, Kind, MatchIndex, Metadata, OriginatorRayID, RuleID, and Source.

Logical Operators

• Filters can be connected using AND, OR logical operators.

• Logical operators can be nested.

Here are some examples of how the logical operators can be implemented. X, Y and Z are used to represent filter criteria:

• X AND Y AND Z - {"where":{"and":[{X},{Y},{Z}]}}

• X OR Y OR Z - {"where":{"or":[{X},{Y},{Z}]}}

• X AND (Y OR Z) - {"where":{"and":[{X}, {"or":[{Y},{Z}]}]}}

• (X AND Y) OR Z - {"where":{"or":[{"and": [{X},{Y}]},{Z}]}}

Set filters via API or dashboard

Filters can be set via API or the Cloudflare dashboard. Note that using a filter is optional, but if used, it must contain the where key.

API

Here is an example request using cURL via API:

curl https://api.cloudflare.com/client/v4/zones/{zone_id}/logpush/jobs \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>" \
--header "Content-Type: application/json" \
--data '{
  "name": "static-assets",
  "output_options": {
    "field_names": ["ClientIP", "EdgeStartTimestamp", "RayID"],
    "sample_rate": 0.1,
    "timestamp_format": "rfc3339"
    "CVE-2021-44228": "true"
  },
  "dataset": "http_requests",
  "filter": "{\"where\":{\"and\":[{\"key\":\"ClientRequestPath\",\"operator\":\"contains\",\"value\":\"/static\"},{\"key\":\"ClientRequestHost\",\"operator\":\"eq\",\"value\":\"example.com\"}]}}",
  "destination_conf": "s3://<BUCKET_PATH>?region=us-west-2/"
}'

Dashboard

To set filters through the dashboard:

1. Log in to the Cloudflare dashboard ↗ and select the domain you want to use.
2. Go to Analytics & Logs > Logs.
3. Select Add Logpush job. A modal window will open.
4. Select the dataset you want to push to a storage service.
5. Below Select data fields, in the Filter section, you can set up your filters.
6. You need to select a Field, an Operator, and a Value.
7. You can connect more filters using AND and OR logical operators.
8. Select Next to continue the setting up of your Logpush job.

Was this helpful?

What did you like?

Accurate

Easy to understand

Solved my problem

Helped me decide to use the product

Other

What went wrong?

Hard to understand

Incorrect information

Missing the information

Other

Thank you for helping improve Cloudflare's documentation!