Logpush datasets

Logpush is a service that automatically streams your Cloudflare log data to a storage destination you control (such as a cloud storage bucket or SIEM).

The table below lists the Logpush datasets (categories of log data) that support zones or accounts with Customer Metadata Boundary (CMB) enabled.

Level — Whether this log type is collected per-zone (a single domain on your account) or per-account (across all domains).
Respects CMB — Whether enabling CMB causes this dataset's logs to be stored only in your selected region. If ✅, logs are localized. If ✘, this dataset is not affected by CMB and may be stored outside your selected region.
Available with US/EU CMB region — Whether you can receive this dataset when CMB is set to US or EU.

Dataset name	Level	Respects CMB	Available with US CMB region	Available with EU CMB region
Access Requests	Account	✅	✅	✅
AI Gateway Events	Account	✅	✅	✅
Audit Logs v1	Account	✘	✅	✘
Audit Logs v2	Account	✅	✅	✅
Browser Isolation User Actions	Account	✅	✅	✅
CASB Findings	Account	✘	✅	✘
Client-side security (formerly Page Shield)	Zone	✅	✅	✅
DEX Application Tests	Account	✅	✘	✅
DEX Device State Events	Account	✅	✘	✅
Device Posture Results	Account	✘	✅	✘
DLP Forensic Copies	Account	N/A¹	✘	✘
DNS Firewall logs	Account	✅	✅	✅
DNS logs	Zone	✅	✅	✅
Email security Alerts	Account	✅	✅	✅
Firewall events	Zone	✅	✅	✅
Gateway DNS	Account	✅	✅	✅
Gateway HTTP	Account	✅	✅	✅
Gateway Network	Account	✅	✅	✅
HTTP requests	Zone	✅	✅	✅
IPSec Logs	Account	✅	✅	✅
Magic IDS Detections	Account	✅	✅	✅
NEL reports	Zone	✘	✅	✘
Network Analytics Logs	Account	✅	✅	✅
Sinkhole Events	Account	✅	✅	✅
Spectrum events	Zone	✅	✅	✅
WARP Config Changes	Account	✅	✘	✅
WARP Toggle Changes	Account	✅	✘	✅
Workers Trace Events	Account	✅	✅	✅
Zaraz Events	Zone	✅	✅	✅
Zero Trust Sessions	Account	✅	✅	✅

Customer Metadata Boundary does not apply in this case, as these logs are sent directly from the processing location to your configured destination. ↩

Logpush datasets

Footnotes