Logging

Logs help you monitor requests and troubleshoot application issues. Each log can include the prompt, response, provider, timestamp, status, token usage, cost, duration, and user agent.

When a request matches a Data Loss Prevention (DLP) policy, its log can also include the action and matched policy details.

When Guardrails are turned on, Guardrails evaluation calls are also recorded in your logs.

Use an authenticated gateway to prevent unauthorized access. Authentication also prevents invalid requests from increasing log volume.

Logs are enabled by default for each gateway. This setting applies to all requests unless a request overrides it.

You can turn off collection for privacy or compliance requirements.

To change the default log configuration in the dashboard:

1. In the Cloudflare dashboard, go to the AI Gateway page.

   Go to AI Gateway ↗

2. Select Settings.

3. Change the Logs setting to your preference.

To override the default logging behavior set in the settings tab, you can define headers on a per-request basis.

The cf-aig-collect-log header allows you to bypass the default log setting for the gateway. If the gateway is configured to save logs, the header will exclude the log for that specific request. Conversely, if logging is disabled at the gateway level, this header will save the log for that request.

In the example below, we use cf-aig-collect-log to bypass the default setting to avoid saving the log.

# Run `wrangler whoami` to get your account ID to replace $CLOUDFLARE_ACCOUNT_ID,
# and `wrangler auth token` to get an auth token to replace $CLOUDFLARE_API_TOKEN.
curl -X POST "https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/ai/v1/chat/completions" \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --header "Content-Type: application/json" \
  --header "cf-aig-collect-log: false" \
  --data '{
    "model": "openai/gpt-4.1-mini",
    "messages": [
      {
        "role": "user",
        "content": "What is the email address and phone number of user123?"
      }
    ]
  }'

The cf-aig-collect-log-payload header allows you to control whether the raw request and response bodies (payloads) are stored for a given request. Unlike cf-aig-collect-log, which controls the entire log entry, this header only affects payload storage — metadata such as token counts, model, provider, status code, cost, and duration will still be logged.

This is useful when you want to maintain visibility into usage metrics and request metadata without persisting sensitive prompt or completion data.

In the example below, we use cf-aig-collect-log-payload to skip storing the request and response bodies while keeping the metadata log.

# Run `wrangler whoami` to get your account ID to replace $CLOUDFLARE_ACCOUNT_ID,
# and `wrangler auth token` to get an auth token to replace $CLOUDFLARE_API_TOKEN.
curl -X POST "https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/ai/v1/chat/completions" \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --header "Content-Type: application/json" \
  --header "cf-aig-collect-log-payload: false" \
  --data '{
    "model": "openai/gpt-4.1-mini",
    "messages": [
      {
        "role": "user",
        "content": "What is the email address and phone number of user123?"
      }
    ]
  }'

When Data Loss Prevention (DLP) policies are enabled on a gateway, log entries for requests that trigger a DLP policy match include additional fields: