Logpush integration

With Cloudflare's Logpush service, you can configure the automatic export of Zero Trust logs to third-party storage destinations or to security information and event management (SIEM) tools. Once exported, your team can analyze and audit the data as needed.

Export Zero Trust logs with Logpush

To configure Logpush for Zero Trust logs:

In Zero Trust ↗, go to Logs > Logpush.
If this is your first Logpush job, select Add a Logpush job. Otherwise, select Go to logpush configurations.
In Logpush, select Create a Logpush job.
Choose a Logpush destination.
Follow the service-specific instructions to configure and validate your destination.
Choose the Zero Trust datasets to export.
Enter a Job name, any filters you would like to add, and the data fields you want to include in the logs.
(Optional) In Advanced settings, choose the timestamp format you prefer and whether you want to enable log sampling.
Select Submit.

The setup of your Logpush integration is now complete. Logpush will send updated logs every five minutes to your selected destination.

You can configure multiple destinations and add additional fields to your logs by returning to the Logpush page.

Zero Trust datasets

Refer to Logpush log fields for a list of all available fields.

Dataset	Description
Access Requests	HTTP requests to sites protected by Cloudflare Access
Audit Logs	Authentication events through Cloudflare Access
CASB Findings	Security issues detected by Cloudflare CASB
Device Posture Results	Device posture status from the WARP client
DLP Forensic Copies	Entire HTTP requests or payloads of HTTP requests captured by Cloudflare DLP
Gateway DNS	DNS queries inspected by Cloudflare Gateway
Gateway HTTP	HTTP requests inspected by Cloudflare Gateway
Gateway Network	Network packets inspected by Cloudflare Gateway
SSH Logs	SSH command logs for Access for Infrastructure targets
Zero Trust Network Session Logs	Network session logs for traffic proxied by Cloudflare Gateway

Parse DNS logs

Logpush logs the following fields for each DNS query:

Query name
Query type
Query class
Response TTL
Response data

DNS query resource records are available in Base64-encoded binary format ↗ and JSON. For example:

{
  "ResourceRecords": [
    {
      "type": "5",
      "data": "d3d3LmV4YW1wbGUuY29tAAABAAUAAABleGFtcGxlLmNvbQ=="
    },
    {
      "type": "1",
      "data": "ZXhhbXBsZS5jb20AAAEAAQAAAQIDBAUGBwgJ"
    }
  ],
  "ResourceRecordsJSON": "[{\"name\":\"www.example.com\",\"type\":\"CNAME\",\"class\":\"IN\",\"ttl\":300,\"rdata\":\"example.com.\"},{\"name\":\"example.com\",\"type\":\"A\",\"class\":\"IN\",\"ttl\":300,\"rdata\":\"203.0.113.0\"}]"
}