GraphQL
This lists all of the available datasets and fields in Cloudflare's GraphQL API.
AccountAccessLoginRequestsAdaptiveGroups
Access login requests
Field | Description |
---|---|
avg | |
count | Number of access login API events processed |
dimensions | List of dimensions to group by |
AccountAccessLoginRequestsAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval | Average sample interval |
AccountAccessLoginRequestsAdaptiveGroupsDimensions
Field | Description |
---|---|
appId | Access application ID |
approvingPolicyId | Policy ID that approved the user |
cfRayId | CF ray id |
country | Country tag |
date | The date the access login event was emitted |
datetime | The date and time the access login event was emitted |
datetimeMinute | The date and time the access login event was emitted truncated to the minute |
deviceId | Device ID |
hasExistingJWT | Has existing JWT (0 = false, 1 = true) |
hasGatewayEnabled | Has Gateway enabled (0 = false, 1 = true) |
hasWarpEnabled | Has WARP enabled (0 = false, 1 = true) |
identityProvider | Identity provider |
ipAddress | User IP address |
isSuccessfulLogin | If the login was successful (0 = false, 1 = true) |
mtlsCertSerialId | MTLS certificate serial ID |
mtlsCommonName | MTLS common name |
mtlsStatus | MTLS status (may show error message if status is not successful) |
serviceTokenId | Service token ID |
userUuid | User UUID |
AccountAccessLoginRequestsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountAccessLoginRequestsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroups
Network analytics data for Advanced DNS Protection
Field | Description |
---|---|
avg | The average of values for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsAvg
Field | Description |
---|---|
bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsDimensions
Field | Description |
---|---|
applicationTag | Application tag associated with the packet |
coloCity | City where the Cloudflare datacenter that received the packet is located |
coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
coloName | Cloudflare datacenter that received the packet (unique site identifier) |
date | Date that the packet was received |
datetime | Date and time that the packet was received |
datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
dnsQueryName | The requested domain name in the DNS query |
dnsQueryType | The query type in the DNS query |
ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
greChecksum | Value of the Checkusm header field in the GRE packet |
greEthertype | Value of the Ethertype header field in the GRE packet |
greHeaderLength | Length of the GRE packet header, in bytes |
greKey | Value of the Key header field in the GRE packet |
greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
greVersion | Value of the Version header field in the GRE packet |
icmpChecksum | Value of the Checkusm header field in the ICMP packet |
icmpCode | Value of the Code header field in the ICMP packet |
icmpType | Value of the Type header field in the ICMP packet |
ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
ipv4Identification | Value of the Identification header field in the IPv4 packet |
ipv4Options | List of Options numbers included in the IPv4 packet header |
ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
leaseTag | IP lease tag associated with the packet |
mitigationReason | Reason for applying a mitigation to the packet, if any |
mitigationScope | Whether the packet matched a local or global mitigation, if any (possible values: local, global) |
outcome | The action that was taken on the packet (possible values: pass, drop) |
prefixTag | IP prefix tag associated with the packet |
sampleInterval | ABR sample interval |
sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
sourcePort | Value of the Source Port header field in the TCP or UDP packet |
tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
tcpChecksum | Value of the Checkusm header field in the TCP packet |
tcpDataOffset | Value of the Data Offset header field in the TCP packet |
tcpFlags | Value of the Flags header field in the TCP packet |
tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
tcpMss | Value of the MSS option header field in the TCP packet |
tcpOptions | List of Options numbers included in the TCP packet header |
tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
tcpWindowSize | Value of the Window Size header field in the TCP packet |
udpChecksum | Value of the Checkusm header field in the UDP packet |
udpPayloadLength | Value of the Payload Length header field in the UDP packet |
verdict | The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop) |
AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsSum
Field | Description |
---|---|
bits | Sum of bits received |
packets | Sum of packets received |
AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroups
Network analytics data for Advanced TCP Protection
Field | Description |
---|---|
avg | The average of values for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsAvg
Field | Description |
---|---|
bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsDimensions
Field | Description |
---|---|
applicationTag | Application tag associated with the packet |
coloCity | City where the Cloudflare datacenter that received the packet is located |
coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
coloName | Cloudflare datacenter that received the packet (unique site identifier) |
date | Date that the packet was received |
datetime | Date and time that the packet was received |
datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
greChecksum | Value of the Checkusm header field in the GRE packet |
greEthertype | Value of the Ethertype header field in the GRE packet |
greHeaderLength | Length of the GRE packet header, in bytes |
greKey | Value of the Key header field in the GRE packet |
greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
greVersion | Value of the Version header field in the GRE packet |
icmpChecksum | Value of the Checkusm header field in the ICMP packet |
icmpCode | Value of the Code header field in the ICMP packet |
icmpType | Value of the Type header field in the ICMP packet |
ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
ipv4Identification | Value of the Identification header field in the IPv4 packet |
ipv4Options | List of Options numbers included in the IPv4 packet header |
ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
leaseTag | IP lease tag associated with the packet |
mitigationReason | Reason for applying a mitigation to the packet, if any |
mitigationScope | Whether the packet matched a local or global mitigation, if any (possible values: local, global) |
outcome | The action that was taken on the packet (possible values: pass, drop) |
prefixTag | IP prefix tag associated with the packet |
protocolState | State of the packet in the context of the protocol, if available |
sampleInterval | ABR sample interval |
sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
sourcePort | Value of the Source Port header field in the TCP or UDP packet |
tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
tcpChecksum | Value of the Checkusm header field in the TCP packet |
tcpDataOffset | Value of the Data Offset header field in the TCP packet |
tcpFlags | Value of the Flags header field in the TCP packet |
tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
tcpMss | Value of the MSS option header field in the TCP packet |
tcpOptions | List of Options numbers included in the TCP packet header |
tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
tcpWindowSize | Value of the Window Size header field in the TCP packet |
udpChecksum | Value of the Checkusm header field in the UDP packet |
udpPayloadLength | Value of the Payload Length header field in the UDP packet |
verdict | The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop) |
AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsSum
Field | Description |
---|---|
bits | Sum of bits received |
packets | Sum of packets received |
AccountAiGatewayCacheAdaptiveGroups
AI Gateway Cache
Field | Description |
---|---|
count | Total number of requests for an account with caching enabled: including hits and misses |
dimensions | List of dimensions to group by |
AccountAiGatewayCacheAdaptiveGroupsDimensions
Field | Description |
---|---|
cacheOp | Cache Hit or Miss: 1 = cache hit, 0 = cache miss |
date | The date when trigger was triggerd |
datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
datetimeFiveMinutes | The date and time truncated to five minutes |
datetimeHour | The date and time truncated to the hour |
datetimeMinute | The date and time truncated to the minute |
gateway | Gateway name |
model | Which model was the request sent to |
provider | Which provider was the request sent to |
tokensIn | Number of tokens in the request |
tokensOut | Number of tokens in the response |
AccountAiGatewayCacheAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountAiGatewayCacheAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountAiGatewayErrorsAdaptiveGroups
AI Gateway Errors
Field | Description |
---|---|
count | Number of errors |
dimensions | List of dimensions to group by |
AccountAiGatewayErrorsAdaptiveGroupsDimensions
Field | Description |
---|---|
date | The date when trigger was triggerd |
datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
datetimeFiveMinutes | The date and time truncated to five minutes |
datetimeHour | The date and time truncated to the hour |
datetimeMinute | The date and time truncated to the minute |
gateway | Gateway name |
model | Which models was the request sent to |
provider | Which provider was the request sent to |
AccountAiGatewayErrorsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountAiGatewayErrorsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountAiGatewayRequestsAdaptiveGroups
AI Gateway Requests
Field | Description |
---|---|
count | Number of processed requests |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountAiGatewayRequestsAdaptiveGroupsDimensions
Field | Description |
---|---|
cached | Was the response served from cache?: 1 = cache hit, 0 = cache misss |
date | The date when trigger was triggered |
datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
datetimeFiveMinutes | The date and time truncated to five minutes |
datetimeHour | The date and time truncated to the hour |
datetimeMinute | The date and time truncated to the minute |
gateway | Gateway name |
model | Which models was the request sent to |
provider | Which provider was the request sent to |
rateLimited | Was the request rate limited?: 1 = rate limit applied, 0 = rate limit not applied |
tokensIn | Number of tokens in the request |
tokensOut | Number of tokens in the response |
AccountAiGatewayRequestsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountAiGatewayRequestsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountAiGatewayRequestsAdaptiveGroupsSum
Field | Description |
---|---|
cachedTokensIn | Sum of cached tokens in |
cachedTokensOut | Sum of cached tokens out |
uncachedTokensIn | Sum of uncached tokens in |
uncachedTokensOut | Sum of uncached tokens out |
AccountAiInferenceAdaptive
AI Inference logs with adaptive sampling
Field | Description |
---|---|
datetime | The date when inferance was triggered |
errorCode | Error code |
inferenceTimeMs | Inference time ms |
modelId | ModelId that was trigger to inference |
modelIsBeta | Model that was trigger to inference is Beta |
neurons | Monetization unit |
requestBytesIn | Request size in bytes |
requestBytesOut | Request size out bytes |
requestSource | Source who triggered (worker binding, pages binding, rest api) |
sampleInterval | ABR sample interval |
AccountAiInferenceAdaptiveFilter_InputObject
Field | Description |
---|---|
AccountAiInferenceAdaptiveGroups
Aggregated AI Inference logs with adaptive sampling
Field | Description |
---|---|
count | Total number of inferences for an account |
dimensions | List of dimensions to group by |
sum |
AccountAiInferenceAdaptiveGroupsDimensions
Field | Description |
---|---|
date | The date when starts the inference |
datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
datetimeFiveMinutes | The date and time truncated to five minutes |
datetimeHour | The date and time truncated to the hour |
datetimeMinute | The date and time truncated to the minute |
errorCode | Error code |
inferenceTimeMs | Inference time ms |
modelId | ModelId that was trigger to inference |
modelIsBeta | Model that was trigger to inference is Beta |
neurons | Monetization unit |
requestBytesIn | Request size in bytes |
requestBytesOut | Request size out bytes |
requestSource | Source who triggered (worker binding, pages binding, rest api) |
AccountAiInferenceAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountAiInferenceAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountAiInferenceAdaptiveGroupsSum
Field | Description |
---|---|
totalInferenceTimeMs | Total inference time ms |
totalNeurons | Total neurons |
totalRequestBytesIn | Total bytes in per request |
totalRequestBytesOut | Total bytes out per request |
AccountAiInferenceAdaptiveOrderBy
Field | Description |
---|---|
AccountBrowserRenderingEventsAdaptive
Browser Rendering events with adaptive sampling
Field | Description |
---|---|
browserCloseReason | Browser session close code. Enum (-1, N/A) (0, Unknown) (1, NormalClosure) (2, BrowserIdle) (3, ClientClosedEarly) (4, ChromiumChrashed) (5, ClientAbnormalClosure) (6, ServerAbnormalClosure) (7, ClientError) (8, ServerError) (9, WorkerError) (10, ClientNeverConnected) (11, BrowserSessionEvicted) |
browserEndTime | Browser session end time |
browserStartTime | Browser session start time |
connectionEndTime | When worker ended devtools connection to browser session |
connectionId | Worker connection ID, when available |
connectionStartTime | When worker started devtools connection to browser session |
datetime | The time of the event |
sampleInterval | ABR sample interval |
scriptName | Name of worker who initiated the request |
sessionId | Browser session ID |
AccountBrowserRenderingEventsAdaptiveFilter_InputObject
Field | Description |
---|---|
AccountBrowserRenderingEventsAdaptiveGroups
Aggregated Browser Rendering events with adaptive sampling
Field | Description |
---|---|
count | Total number of events for an account |
dimensions | List of dimensions to group by |
max | The maximum value for a metric per dimension |
min | The minimum value for a metric per dimension |
uniq |
AccountBrowserRenderingEventsAdaptiveGroupsDimensions
Field | Description |
---|---|
browserCloseReason | Browser session close code. Enum (-1, N/A) (0, Unknown) (1, NormalClosure) (2, BrowserIdle) (3, ClientClosedEarly) (4, ChromiumChrashed) (5, ClientAbnormalClosure) (6, ServerAbnormalClosure) (7, ClientError) (8, ServerError) (9, WorkerError) (10, ClientNeverConnected) (11, BrowserSessionEvicted) |
connectionId | Worker connection ID, when available |
date | The date of the event |
datetimeFifteenMinutes | The date and time of the event truncated to fifteen minutes |
datetimeFiveMinutes | The date and time of the event truncated to five minutes |
datetimeHour | The date and time of the event truncated to the hour |
datetimeMinute | The date and time of the event truncated to the minute |
scriptName | Name of worker who initiated the request |
sessionId | Browser session ID |
AccountBrowserRenderingEventsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountBrowserRenderingEventsAdaptiveGroupsMax
Field | Description |
---|---|
finalBrowserCloseReason | Browser close reason |
latestBrowserEndTime | Browser end time |
AccountBrowserRenderingEventsAdaptiveGroupsMin
Field | Description |
---|---|
earliestBrowserStartTime | Browser start time |
AccountBrowserRenderingEventsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountBrowserRenderingEventsAdaptiveGroupsUniq
Field | Description |
---|---|
connectionIdCount | Unique worker connections |
sessionIdCount | Unique browser sessions |
AccountBrowserRenderingEventsAdaptiveOrderBy
Field | Description |
---|---|
AccountCallsStatusAdaptive
(TESTING ONLY, NOT FOR PRODUCTION) Raw Calls events with adaptive sampling
Field | Description |
---|---|
appId | The appId that generated traffic |
datetime | The date and time the event was recorded |
event | The description of the event related to a session or a track |
sessionId | The generated string that identifies a PeerConnection |
trackId | The track identifier provided to us within a PeerConnection |
AccountCallsStatusAdaptiveFilter_InputObject
Field | Description |
---|---|
AccountCallsStatusAdaptiveOrderBy
Field | Description |
---|---|
AccountCallsTurnUsageAdaptiveGroups
Beta. Aggregated Calls TURN bandwidth usage with adaptive sampling
Field | Description |
---|---|
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountCallsTurnUsageAdaptiveGroupsDimensions
Field | Description |
---|---|
customIdentifier | The customIdentifier (provided when credential was generated) that generated traffic |
date | Calls TURN bandwidth metrics date |
datetimeFifteenMinutes | Calls TURN bandwidth metrics timestamp, truncated to fifteen minutes |
datetimeFiveMinutes | Calls TURN bandwidth metrics timestamp, truncated to five minutes |
datetimeHour | Calls TURN bandwidth metrics timestamp, truncated to the hour |
datetimeMinute | Calls TURN bandwidth metrics timestamp, truncated to the minute |
keyId | The credentials created by this keyId that generated traffic |
username | The username from credential that generated traffic |
AccountCallsTurnUsageAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountCallsTurnUsageAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountCallsTurnUsageAdaptiveGroupsSum
Field | Description |
---|---|
egressBytes | The total bytes sent by Calls TURN, observed over the queried time period |
ingressBytes | The total bytes received by Calls TURN, observed over the queried time period |
AccountCallsUsageAdaptiveGroups
Beta. Aggregated Calls SFU bandwidth usage with adaptive sampling
Field | Description |
---|---|
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountCallsUsageAdaptiveGroupsDimensions
Field | Description |
---|---|
appId | The appId that generated traffic |
date | Calls bandwidth metrics date |
datetimeFifteenMinutes | Calls bandwidth metrics timestamp, truncated to fifteen minutes |
datetimeFiveMinutes | Calls bandwidth metrics timestamp, truncated to five minutes |
datetimeHour | Calls bandwidth metrics timestamp, truncated to the hour |
datetimeMinute | Calls bandwidth metrics timestamp, truncated to the minute |
sessionId | The generated string that identifies a PeerConnection |
trackId | The track identifier provided to us within a PeerConnection |
trackType | Describes if the track contains video, audio, or data |
AccountCallsUsageAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountCallsUsageAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountCallsUsageAdaptiveGroupsSum
Field | Description |
---|---|
egressBytes | The total bytes sent by Calls, observed over the queried time period |
ingressBytes | The total bytes received by Calls, observed over the queried time period |
AccountCdnNetworkAnalyticsAdaptiveGroups
Network analytics data for Cloudflare CDN traffic
Field | Description |
---|---|
avg | The average of values for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountCdnNetworkAnalyticsAdaptiveGroupsAvg
Field | Description |
---|---|
bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountCdnNetworkAnalyticsAdaptiveGroupsDimensions
Field | Description |
---|---|
applicationTag | Application tag associated with the packet |
coloCity | City where the Cloudflare datacenter that received the packet is located |
coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
coloName | Cloudflare datacenter that received the packet (unique site identifier) |
date | Date that the packet was received |
datetime | Date and time that the packet was received |
datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
destinationDeviceTag | Device tag associated with the destination IP of the packet |
destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
greChecksum | Value of the Checkusm header field in the GRE packet |
greEthertype | Value of the Ethertype header field in the GRE packet |
greHeaderLength | Length of the GRE packet header, in bytes |
greKey | Value of the Key header field in the GRE packet |
greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
greVersion | Value of the Version header field in the GRE packet |
icmpChecksum | Value of the Checkusm header field in the ICMP packet |
icmpCode | Value of the Code header field in the ICMP packet |
icmpType | Value of the Type header field in the ICMP packet |
ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
ipv4Identification | Value of the Identification header field in the IPv4 packet |
ipv4Options | List of Options numbers included in the IPv4 packet header |
ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
leaseTag | IP lease tag associated with the packet |
mitigationSystem | Which system dropped the packet (possible values: dosd, flowtrackd, magic-firewall) |
outcome | The action that was taken on the packet (possible values: pass, drop) |
popName | Cloudflare PoP that received the packet (unique site identifier) |
prefixTag | IP prefix tag associated with the packet |
sampleInterval | ABR sample interval |
sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
sourceDeviceTag | Device tag associated with the source IP of the packet |
sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
sourcePort | Value of the Source Port header field in the TCP or UDP packet |
tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
tcpChecksum | Value of the Checkusm header field in the TCP packet |
tcpDataOffset | Value of the Data Offset header field in the TCP packet |
tcpFlags | Value of the Flags header field in the TCP packet |
tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
tcpMss | Value of the MSS option header field in the TCP packet |
tcpOptions | List of Options numbers included in the TCP packet header |
tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
tcpWindowSize | Value of the Window Size header field in the TCP packet |
udpChecksum | Value of the Checkusm header field in the UDP packet |
udpPayloadLength | Value of the Payload Length header field in the UDP packet |
AccountCdnNetworkAnalyticsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountCdnNetworkAnalyticsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountCdnNetworkAnalyticsAdaptiveGroupsSum
Field | Description |
---|---|
bits | Sum of bits received |
packets | Sum of packets received |
AccountD1AnalyticsAdaptiveGroups
Beta. Aggregated D1 analytics with adaptive sampling
Field | Description |
---|---|
avg | The average value for a metric per dimension |
count | Number of requests to D1 processed |
dimensions | List of dimensions to group by |
quantiles | Quantiles of a metric per dimension |
sum | The sum of values for a metric per dimension |
AccountD1AnalyticsAdaptiveGroupsAvg
Field | Description |
---|---|
queryBatchResponseBytes | The total number of bytes in the response, including all returned rows and metadata (average/mean). |
queryBatchTimeMs | Query batch response time in milliseconds (average/mean). |
sampleInterval | The average value used for sample interval |
AccountD1AnalyticsAdaptiveGroupsDimensions
Field | Description |
---|---|
databaseId | The UUID of a D1 database |
date | The date the D1 request was received |
datetimeFifteenMinutes | The date and time the D1 request was received truncated to fifteen minutes |
datetimeFiveMinutes | The date and time the D1 request was received truncated to five minutes |
datetimeHour | The date and time the D1 request was received truncated to the hour |
datetimeMinute | The date and time the D1 request was received truncated to the minute |
AccountD1AnalyticsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountD1AnalyticsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountD1AnalyticsAdaptiveGroupsQuantiles
Field | Description |
---|---|
queryBatchResponseBytesP50 | The total number of bytes in the response, including all returned rows and metadata (50th percentile). |
queryBatchResponseBytesP90 | The total number of bytes in the response, including all returned rows and metadata (90th percentile). |
queryBatchTimeMsP50 | Query batch response time in milliseconds (50th percentile). |
queryBatchTimeMsP90 | Query batch response time in milliseconds (90th percentile). |
AccountD1AnalyticsAdaptiveGroupsSum
Field | Description |
---|---|
queryBatchResponseBytes | The total number of bytes in the response, including all returned rows and metadata. |
readQueries | The number of read queries. |
rowsRead | The number of rows your queries read. |
rowsWritten | The number of rows your queries wrote. |
writeQueries | The number of write queries. |
AccountD1QueriesAdaptiveGroups
Beta. D1 query metrics with adaptive sampling
Field | Description |
---|---|
avg | The average value for a metric per dimension |
count | Number of D1 queries processed |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountD1QueriesAdaptiveGroupsAvg
Field | Description |
---|---|
queryDurationMs | The average duration queries in D1 took, observed over the queried time period. |
rowsRead | The average number of rows scanned, observed over the queried time period. |
rowsReturned | The average number of rows returned, observed over the queried time period. |
rowsWritten | The average number of rows written, observed over the queried time period. |
sampleInterval | The average value used for sample interval |
AccountD1QueriesAdaptiveGroupsDimensions
Field | Description |
---|---|
databaseId | The UUID of a D1 database |
date | D1 query sample timestamp |
datetimeFifteenMinutes | D1 query sample timestamp, truncated to fifteen minutes |
datetimeFiveMinutes | D1 query sample timestamp, truncated to five minutes |
datetimeHour | D1 query sample timestamp, truncated to the hour |
datetimeMinute | D1 query sample timestamp, truncated to the minute |
query | The SQL query that ran on a D1 database, with parameterized values replaced with placeholders. |
AccountD1QueriesAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountD1QueriesAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountD1QueriesAdaptiveGroupsSum
Field | Description |
---|---|
queryDurationMs | The total duration queries in D1 took, observed over the queried time period. |
rowsRead | The total number of rows scanned, observed over the queried time period. |
rowsReturned | The total number of rows returned, observed over the queried time period. |
rowsWritten | The total number of rows written, observed over the queried time period. |
AccountD1StorageAdaptiveGroups
Beta. D1 storage with adaptive sampling
Field | Description |
---|---|
dimensions | List of dimensions to group by |
max | The max of values for a metric per dimension |
AccountD1StorageAdaptiveGroupsDimensions
Field | Description |
---|---|
databaseId | The UUID of a D1 database |
date | D1 storage sample timestamp |
datetimeFifteenMinutes | D1 storage sample timestamp, truncated to fifteen minutes |
datetimeFiveMinutes | D1 storage sample timestamp, truncated to five minutes |
datetimeHour | D1 storage sample timestamp, truncated to the hour |
datetimeMinute | D1 storage sample timestamp, truncated to the minute |
AccountD1StorageAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountD1StorageAdaptiveGroupsMax
Field | Description |
---|---|
databaseSizeBytes | The maximum size of the database (measured in bytes) observed over the queried time period. |
AccountD1StorageAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountDosdAttackAnalyticsGroups
Attack analytics metadata for attacks detected by dosd
Field | Description |
---|---|
attackId | Unique identifier of the mitigation that matched the packet, if any |
attackType | DEPRECATED (Use attackVector for a richer description of the attack): Type of attack traffic |
attackVector | Description of attack vector |
bits | Sum of bits received during the attack |
commonTcpFlags | Common TCP flags used by attack traffic, if any |
commonTcpFlagsNames | Names of common TCP flags used by attack traffic, if any |
destinationIp | Fixed destination IP used by attack traffic, if any |
destinationPort | Fixed destination port used by attack traffic, if any |
droppedBits | Sum of bits dropped during the attack |
droppedPackets | Sum of packets dropped during the attack |
endDatetime | Date and time that the attack ended; not available for ongoing attacks |
ipProtocol | Fixed protocol used by attack traffic, if any |
ipProtocolName | Fixed protocol used by attack traffic, if any |
mitigationReason | Type of mitigation applied to attack traffic |
mitigationScope | Whether mitigation was applied in only some locations or globally |
mitigationType | Type of mitigation applied to attack traffic |
packets | Sum of packets received during the attack |
ruleId | Unique identifier of the rule that matched the packet, if any |
ruleName | Human-readable name of the rule that matched the packet, if any |
rulesetId | Unique identifier of the ruleset containing the rule that matched the packet, if any |
rulesetOverrideId | Unique identifier of the ruleset override containing the rule that matched the packet, if any |
sourceIp | Fixed source IP used by attack traffic, if any |
sourcePort | Fixed source port used by attack traffic, if any |
startDatetime | Date and time that the attack started |
tcpFlags | Fixed TCP flags used by attack traffic, if any |
tcpFlagsNames | Names of fixed TCP flags used by attack traffic, if any |
AccountDosdAttackAnalyticsGroupsFilter_InputObject
Field | Description |
---|---|
AccountDosdAttackAnalyticsGroupsOrderBy
Field | Description |
---|---|
AccountDosdNetworkAnalyticsAdaptiveGroups
Network analytics data for dosd
Field | Description |
---|---|
avg | The average of values for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountDosdNetworkAnalyticsAdaptiveGroupsAvg
Field | Description |
---|---|
bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountDosdNetworkAnalyticsAdaptiveGroupsDimensions
Field | Description |
---|---|
applicationTag | Application tag associated with the packet |
attackId | Unique identifier of the mitigation that matched the packet, if any |
attackVector | Attack vector of the rule that matched the packet, if any |
coloCity | City where the Cloudflare datacenter that received the packet is located |
coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
coloName | Cloudflare datacenter that received the packet (unique site identifier) |
date | Date that the packet was received |
datetime | Date and time that the packet was received |
datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
greChecksum | Value of the Checkusm header field in the GRE packet |
greEthertype | Value of the Ethertype header field in the GRE packet |
greHeaderLength | Length of the GRE packet header, in bytes |
greKey | Value of the Key header field in the GRE packet |
greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
greVersion | Value of the Version header field in the GRE packet |
icmpChecksum | Value of the Checkusm header field in the ICMP packet |
icmpCode | Value of the Code header field in the ICMP packet |
icmpType | Value of the Type header field in the ICMP packet |
ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
ipv4Identification | Value of the Identification header field in the IPv4 packet |
ipv4Options | List of Options numbers included in the IPv4 packet header |
ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
leaseTag | IP lease tag associated with the packet |
mitigationReason | Reason for applying a mitigation to the packet, if any |
mitigationScope | Whether the packet matched a local or global mitigation, if any (possible values: local, global) |
outcome | The action that was taken on the packet (possible values: pass, drop) |
prefixTag | IP prefix tag associated with the packet |
protocolState | State of the packet in the context of the protocol, if available |
ruleId | Unique identifier of the rule that matched the packet, if any |
ruleName | Human-readable name of the rule that matched the packet, if any |
rulesetId | Unique identifier of the ruleset containing the rule that matched the packet, if any |
rulesetOverrideId | Unique identifier of the ruleset override containing the rule that matched the packet, if any |
sampleInterval | ABR sample interval |
sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
sourcePort | Value of the Source Port header field in the TCP or UDP packet |
tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
tcpChecksum | Value of the Checkusm header field in the TCP packet |
tcpDataOffset | Value of the Data Offset header field in the TCP packet |
tcpFlags | Value of the Flags header field in the TCP packet |
tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
tcpMss | Value of the MSS option header field in the TCP packet |
tcpOptions | List of Options numbers included in the TCP packet header |
tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
tcpWindowSize | Value of the Window Size header field in the TCP packet |
udpChecksum | Value of the Checkusm header field in the UDP packet |
udpPayloadLength | Value of the Payload Length header field in the UDP packet |
verdict | The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop) |
AccountDosdNetworkAnalyticsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountDosdNetworkAnalyticsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountDosdNetworkAnalyticsAdaptiveGroupsSum
Field | Description |
---|---|
bits | Sum of bits received |
packets | Sum of packets received |
AccountDurableObjectsInvocationsAdaptiveGroups
Durable Objects invocations with adaptive sampling
Field | Description |
---|---|
avg | The average value used for sample interval |
dimensions | List of dimensions to group by |
max | The max value for a metric |
min | The min value for a metric |
quantiles | Quantiles of a metric per dimension |
sum | The sum of values for a metric per dimension |
AccountDurableObjectsInvocationsAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval |
AccountDurableObjectsInvocationsAdaptiveGroupsDimensions
Field | Description |
---|---|
date | Request datetime, truncated to start of a day |
datetime | Request datetime |
datetimeHour | Request datetime, truncated to start of an hour |
datetimeMinute | Request datetime, truncated to start of a minute |
environmentName | The name of the script environment |
namespaceId | Durable Object namespace ID |
objectId | Durable Object ID as a hex string |
scriptName | The name of the script |
status | Status of the worker invocation |
AccountDurableObjectsInvocationsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountDurableObjectsInvocationsAdaptiveGroupsMax
Field | Description |
---|---|
responseBodySize | Maximum response body size for one request - bytes |
wallTime | Maximum wall time for one request - microseconds |
AccountDurableObjectsInvocationsAdaptiveGroupsMin
Field | Description |
---|---|
responseBodySize | Minimum response body size for one request - bytes |
wallTime | Minimum wall time for one request - microseconds |
AccountDurableObjectsInvocationsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountDurableObjectsInvocationsAdaptiveGroupsQuantiles
Field | Description |
---|---|
responseBodySizeP25 | Response body size 25th percentile - bytes |
responseBodySizeP50 | Response body size 50th percentile - bytes |
responseBodySizeP75 | Response body size 75th percentile - bytes |
responseBodySizeP90 | Response body size 90th percentile - bytes |
responseBodySizeP99 | Response body size 99th percentile - bytes |
responseBodySizeP999 | Response body size 99.9th percentile - bytes |
wallTimeP25 | Wall time 25th percentile - microseconds |
wallTimeP50 | Wall time 50th percentile - microseconds |
wallTimeP75 | Wall time 75th percentile - microseconds |
wallTimeP90 | Wall time 90th percentile - microseconds |
wallTimeP99 | Wall time 99th percentile - microseconds |
wallTimeP999 | Wall time 99.9th percentile - microseconds |
AccountDurableObjectsInvocationsAdaptiveGroupsSum
Field | Description |
---|---|
errors | Sum of errors |
requests | Sum of requests |
responseBodySize | Sum of response body sizes |
wallTime | Sum of wall time |
AccountDurableObjectsPeriodicGroups
Durable Objects periodic metrics
Field | Description |
---|---|
dimensions | List of dimensions to group by |
max | The max value for a metric |
sum | The sum of values for a metric per dimension |
AccountDurableObjectsPeriodicGroupsDimensions
Field | Description |
---|---|
date | Datetime the metrics period started, truncated to start of a day |
datetimeHour | Datetime the metrics period started, truncated to start of an hour |
datetimeMinute | Datetime the metrics period started, truncated to start of a minute |
namespaceId | Durable Object namespace ID |
objectId | Durable Object ID as a hex string |
AccountDurableObjectsPeriodicGroupsFilter_InputObject
Field | Description |
---|---|
AccountDurableObjectsPeriodicGroupsMax
Field | Description |
---|---|
activeWebsocketConnections | Maximum active websocket connections in the time window |
AccountDurableObjectsPeriodicGroupsOrderBy
Field | Description |
---|---|
AccountDurableObjectsPeriodicGroupsSum
Field | Description |
---|---|
activeTime | Sum of active time - microseconds |
cpuTime | Sum of CPU time - microseconds |
duration | Sum of Duration - GB*s |
exceededCpuErrors | Sum of CPU exceeded errors |
exceededMemoryErrors | Sum of memory exceeded errors |
fatalInternalErrors | Sum of fatal internal server errors |
inboundWebsocketMsgCount | Sum of incoming websocket messages |
outboundWebsocketMsgCount | Sum of outbound websocket messages |
storageDeletes | Sum of storage deletes |
storageReadUnits | Sum of storage reads - in 4KB units |
storageWriteUnits | Sum of storage writes - in 4KB units |
subrequests | Sum of subrequests |
AccountDurableObjectsStorageGroups
Durable Objects storage metrics
Field | Description |
---|---|
dimensions | List of dimensions to group by |
max | The sum of values for a metric per dimension |
AccountDurableObjectsStorageGroupsDimensions
Field | Description |
---|---|
date | Datetime that the storage usage was recorded, truncated to start of a day |
datetimeHour | Datetime that the storage usage was recorded, truncated to start of an hour |
AccountDurableObjectsStorageGroupsFilter_InputObject
Field | Description |
---|---|
AccountDurableObjectsStorageGroupsMax
Field | Description |
---|---|
storedBytes | Max of stored bytes |
AccountDurableObjectsStorageGroupsOrderBy
Field | Description |
---|---|
AccountDurableObjectsSubrequestsAdaptiveGroups
Durable Objects subrequests with adaptive sampling
Field | Description |
---|---|
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountDurableObjectsSubrequestsAdaptiveGroupsDimensions
Field | Description |
---|---|
date | Request datetime, truncated to start of a day |
datetime | Request datetime |
datetimeHour | Request datetime, truncated to start of an hour |
datetimeMinute | Request datetime, truncated to start of a minute |
environmentName | The name of the script environment |
namespaceId | Durable Object namespace ID |
objectId | Durable Object ID as a hex string |
scriptName | The name of the script |
AccountDurableObjectsSubrequestsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountDurableObjectsSubrequestsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountDurableObjectsSubrequestsAdaptiveGroupsSum
Field | Description |
---|---|
requestBodySizeUncached | Outgoing Durable Objects fetch request body size in bytes where the request was not cached |
AccountFbmAttackAnalyticsGroups
FBM analytics metadata for attacks detected by dosd
Field | Description |
---|---|
attackId | Unique identifier of the mitigation that matched the packet, if any |
attackType | DEPRECATED (Use attackVector for a richer description of the attack): Type of attack traffic |
attackVector | Description of attack vector |
bits | Sum of bits received during the attack |
commonTcpFlags | Common TCP flags used by attack traffic, if any |
commonTcpFlagsNames | Names of common TCP flags used by attack traffic, if any |
destinationIp | Fixed destination IP used by attack traffic, if any |
destinationPort | Fixed destination port used by attack traffic, if any |
droppedBits | Sum of bits dropped during the attack |
droppedPackets | Sum of packets dropped during the attack |
endDatetime | Date and time that the attack ended; not available for ongoing attacks |
ipProtocol | Fixed protocol used by attack traffic, if any |
ipProtocolName | Fixed protocol used by attack traffic, if any |
mitigationReason | Type of mitigation applied to attack traffic |
mitigationScope | Whether mitigation was applied in only some locations or globally |
mitigationType | Type of mitigation applied to attack traffic |
packets | Sum of packets received during the attack |
ruleId | Unique identifier of the rule that matched the packet, if any |
ruleName | Human-readable name of the rule that matched the packet, if any |
rulesetId | Unique identifier of the ruleset containing the rule that matched the packet, if any |
rulesetOverrideId | Unique identifier of the ruleset override containing the rule that matched the packet, if any |
sourceIp | Fixed source IP used by attack traffic, if any |
sourcePort | Fixed source port used by attack traffic, if any |
startDatetime | Date and time that the attack started |
tcpFlags | Fixed TCP flags used by attack traffic, if any |
tcpFlagsNames | Names of fixed TCP flags used by attack traffic, if any |
AccountFbmAttackAnalyticsGroupsFilter_InputObject
Field | Description |
---|---|
AccountFbmAttackAnalyticsGroupsOrderBy
Field | Description |
---|---|
AccountFilter_InputObject
Field | Description |
---|---|
AccountFirewallEventsAdaptive
Raw Firewall events with adaptive sampling
Field | Description |
---|---|
action | The code of the first-class action the Cloudflare Firewall took on this request |
apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
apiGatewayMatchedHost | API Gateway host matched at the edge |
botDetectionIds | Array of detections ids that matched this request |
botDetectionTags | Array of detections tags that matched this request |
botScore | The final score originated from bot management detections. |
botScoreSrcName | Name of the source detection which generated the bot management score. |
clientASNDescription | The ASN of the visitor as string |
clientAsn | The ASN number of the visitor |
clientCountryName | Country from which request originated |
clientIP | The visitor's IP address (IPv4 or IPv6) |
clientIPClass | The classification of the visitor's IP address, possible values are: unknown | clean | badHost | searchEngine | allowlist | greylist | monitoringService | securityScanner | noRecord | scan | backupService | mobilePlatform | tor |
clientRefererHost | The referer host |
clientRefererPath | The referer path requested by visitor |
clientRefererQuery | The referer query-string was requested by the visitor |
clientRefererScheme | The referer url scheme requested by the visitor |
clientRequestHTTPHost | The HTTP hostname requested by the visitor |
clientRequestHTTPMethodName | The HTTP method used by the visitor |
clientRequestHTTPProtocol | The version of HTTP protocol requested by the visitor |
clientRequestPath | The path requested by visitor |
clientRequestQuery | The query-string was requested by the visitor |
clientRequestScheme | The url scheme requested by the visitor |
contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
contentScanNumObj | Number of scannable content objects |
contentScanObjResults | Array of scan results in order of detection |
contentScanObjSizes | Array of scan sizes in order of detection |
contentScanObjTypes | Array of content types in order of detection |
date | The date the event occurred at the edge |
datetime | The date and time the event occurred at the edge |
datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
datetimeHour | The date and time the event occurred at the edge truncated to hours |
datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
description | The description of the rule triggered by this request |
edgeColoName | The airport code of the Cloudflare datacenter that served this request |
edgeResponseStatus | HTTP response status code returned to browser |
httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion ): Version associated with HTTP Application |
ja3Hash | MD5 hash of the JA3 TLS fingerprint |
ja4 | JA4 TLS fingerprint |
ja4Signals | Inter-request statistics computed for this JA4 across Cloudflare's entire global edge network |
kind | The kind of event, currently only possible values are: firewall |
leakedCredentialCheckResult | The distinct result of checking for leaked credentials |
matchIndex | Rules match index in the chain |
metadata | Additional product-specific information. Metadata is organized in key:value pairs |
originResponseStatus | HTTP origin response status code returned to browser |
originatorRayName | The RayId of the request that issued the challenge/jschallenge |
rayName | The RayId of the request |
ref | The ref-field is a user-defined rule identifier that can be set via the API for some firewall products and allows users to label their rules individually alongside cloudflare provided identifiers (only available to entitled customers) |
ruleId | The Cloudflare security product-specific RuleId triggered by this request |
rulesetId | The Cloudflare security product-specific RulesetId triggered by this request |
sampleInterval | ABR sample interval |
source | The Cloudflare security product triggered by this request |
userAgent | visitor's user-agent string |
wafAttackScore | Beta. Overall request score generated by the WAF detection module |
wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
wafMlAttackScore | DEPRECATED (Field is replaced with wafAttackScore ): Beta. Overall request score generated by the WAF detection module |
wafMlSqliAttackScore | DEPRECATED (Field is replaced with wafSqliAttackScore ): Beta. WAF ML score for an SQLi attack |
wafMlXssAttackScore | DEPRECATED (Field is replaced with wafXssAttackScore ): Beta. WAF ML score for an XSS attack |
wafRceAttackScore | Beta. WAF score for a RCE attack |
wafSqliAttackScore | Beta. WAF score for a SQLi attack |
wafXssAttackScore | Beta. WAF score for a XSS attack |
zoneTag | Associated zone |
zoneVersion | The version of a zone |
AccountFirewallEventsAdaptiveFilter_InputObject
Field | Description |
---|---|
AccountFirewallEventsAdaptiveGroups
Aggregated Firewall events with adaptive sampling
Field | Description |
---|---|
avg | The average value used for sample interval |
count | The sum of sample interval values |
dimensions | List of dimensions to group by |
sum |
AccountFirewallEventsAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval |
AccountFirewallEventsAdaptiveGroupsDimensions
Field | Description |
---|---|
action | The code of the first-class action the Cloudflare Firewall took on this request |
apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
apiGatewayMatchedHost | API Gateway host matched at the edge |
botDetectionIds | Array of detections ids that matched this request |
botDetectionTags | Array of detections tags that matched this request |
botScore | The final score originated from bot management detections. |
botScoreSrcName | Name of the source detection which generated the bot management score. |
clientASNDescription | The ASN of the visitor as string |
clientAsn | The ASN number of the visitor |
clientCountryName | Country from which request originated |
clientIP | The visitor's IP address (IPv4 or IPv6) |
clientIPClass | The classification of the visitor's IP address, possible values are: unknown | clean | badHost | searchEngine | allowlist | greylist | monitoringService | securityScanner | noRecord | scan | backupService | mobilePlatform | tor |
clientRefererHost | The referer host |
clientRefererPath | The referer path requested by visitor |
clientRefererQuery | The referer query-string was requested by the visitor |
clientRefererScheme | The referer url scheme requested by the visitor |
clientRequestHTTPHost | The HTTP hostname requested by the visitor |
clientRequestHTTPMethodName | The HTTP method used by the visitor |
clientRequestHTTPProtocol | The version of HTTP protocol requested by the visitor |
clientRequestPath | The path requested by visitor |
clientRequestQuery | The query-string was requested by the visitor |
clientRequestScheme | The url scheme requested by the visitor |
contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
contentScanNumObj | Number of scannable content objects |
contentScanObjResults | Array of scan results in order of detection |
contentScanObjSizes | Array of scan sizes in order of detection |
contentScanObjTypes | Array of content types in order of detection |
date | The date the event occurred at the edge |
datetime | The date and time the event occurred at the edge |
datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
datetimeHour | The date and time the event occurred at the edge truncated to hours |
datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
description | The description of the rule triggered by this request |
edgeColoName | The airport code of the Cloudflare datacenter that served this request |
edgeResponseStatus | HTTP response status code returned to browser |
httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion ): Version associated with HTTP Application |
ja3Hash | MD5 hash of the JA3 TLS fingerprint |
ja4 | JA4 TLS fingerprint |
kind | The kind of event, currently only possible values are: firewall |
matchIndex | Rules match index in the chain |
originResponseStatus | HTTP origin response status code returned to browser |
originatorRayName | The RayId of the request that issued the challenge/jschallenge |
rayName | The RayId of the request |
ref | The ref-field is a user-defined rule identifier that can be set via the API for some firewall products and allows users to label their rules individually alongside cloudflare provided identifiers (only available to entitled customers) |
ruleId | The Cloudflare security product-specific RuleId triggered by this request |
rulesetId | The Cloudflare security product-specific RulesetId triggered by this request |
sampleInterval | ABR sample interval |
source | The Cloudflare security product triggered by this request |
userAgent | visitor's user-agent string |
wafAttackScore | Beta. Overall request score generated by the WAF detection module |
wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
wafMlAttackScore | DEPRECATED (Field is replaced with wafAttackScore ): Beta. Overall request score generated by the WAF ML detection module |
wafMlSqliAttackScore | DEPRECATED (Field is replaced with wafSqliAttackScore ): Beta. WAF ML score for an SQLi attack |
wafMlXssAttackScore | DEPRECATED (Field is replaced with wafXssAttackScore ): Beta. WAF ML score for an XSS attack |
wafRceAttackScore | Beta. WAF score for a RCE attack |
wafSqliAttackScore | Beta. WAF score for a SQLi attack |
wafXssAttackScore | Beta. WAF score for a XSS attack |
zoneTag | Associated zone |
zoneVersion | The version of a zone |
AccountFirewallEventsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountFirewallEventsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountFirewallEventsAdaptiveGroupsSum
Field | Description |
---|---|
botDetectionIdArray | Array of bot management detection ids |
botDetectionIdCountArray | Count array of bot management detection ids. Elements in this array correspond to elements in botDetectionIdArray by index. |
botDetectionTagArray | Array of bot management detection tags |
botDetectionTagCountArray | Count array of bot management detection tags. Elements in this array correspond to elements in botDetectionTagArray by index. |
AccountFirewallEventsAdaptiveJa4SignalsElem
Field | Description |
---|---|
signalName | Signal name |
signalValue | Signal value |
AccountFirewallEventsAdaptiveMetadataElem
Field | Description |
---|---|
key | The key of the metadata. Key format can vary by Cloudflare security product and can change over time. |
value | The value of the metadata. Value format can vary by Cloudflare security product and can change over time. |
AccountFirewallEventsAdaptiveOrderBy
Field | Description |
---|---|
AccountFlowtrackdNetworkAnalyticsAdaptiveGroups
Network analytics data for flowtrackd
Field | Description |
---|---|
avg | The average of values for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsAvg
Field | Description |
---|---|
bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsDimensions
Field | Description |
---|---|
applicationTag | Application tag associated with the packet |
coloCity | City where the Cloudflare datacenter that received the packet is located |
coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
coloName | Cloudflare datacenter that received the packet (unique site identifier) |
date | Date that the packet was received |
datetime | Date and time that the packet was received |
datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
greChecksum | Value of the Checkusm header field in the GRE packet |
greEthertype | Value of the Ethertype header field in the GRE packet |
greHeaderLength | Length of the GRE packet header, in bytes |
greKey | Value of the Key header field in the GRE packet |
greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
greVersion | Value of the Version header field in the GRE packet |
icmpChecksum | Value of the Checkusm header field in the ICMP packet |
icmpCode | Value of the Code header field in the ICMP packet |
icmpType | Value of the Type header field in the ICMP packet |
ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
ipv4Identification | Value of the Identification header field in the IPv4 packet |
ipv4Options | List of Options numbers included in the IPv4 packet header |
ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
leaseTag | IP lease tag associated with the packet |
mitigationReason | Reason for applying a mitigation to the packet, if any |
mitigationScope | Whether the packet matched a local or global mitigation, if any (possible values: local, global) |
outcome | The action that was taken on the packet (possible values: pass, drop) |
prefixTag | IP prefix tag associated with the packet |
protocolState | State of the packet in the context of the protocol, if available |
sampleInterval | ABR sample interval |
sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
sourcePort | Value of the Source Port header field in the TCP or UDP packet |
tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
tcpChecksum | Value of the Checkusm header field in the TCP packet |
tcpDataOffset | Value of the Data Offset header field in the TCP packet |
tcpFlags | Value of the Flags header field in the TCP packet |
tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
tcpMss | Value of the MSS option header field in the TCP packet |
tcpOptions | List of Options numbers included in the TCP packet header |
tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
tcpWindowSize | Value of the Window Size header field in the TCP packet |
udpChecksum | Value of the Checkusm header field in the UDP packet |
udpPayloadLength | Value of the Payload Length header field in the UDP packet |
verdict | The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop) |
AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsSum
Field | Description |
---|---|
bits | Sum of bits received |
packets | Sum of packets received |
AccountGatewayL4DownstreamSessionsAdaptiveGroups
Aggregated metrics about downstream (client to edge) L4 Gateway Sessions. Metrics are reported on TCP or UDP session close
Field | Description |
---|---|
count | The number of downstream sessions |
dimensions | List of dimensions to group by |
quantiles | |
sum |
AccountGatewayL4DownstreamSessionsAdaptiveGroupsDimensions
Field | Description |
---|---|
coloCode | IATA Airport code that represents the city in which a Cloudflare data center (colo) is located |
coloCountry | ISO 3166-1 alpha-2 code that represents the country in which a Cloudflare data center (colo) is located |
date | Start timestamp of this session, truncated to date |
datetimeFifteenMinutes | Start timestamp of this session, truncated to multiple of 15 minutes |
datetimeFiveMinutes | Start timestamp of this session, truncated to multiple of 5 minutes |
datetimeHour | Start timestamp of this session, truncated to the hour |
datetimeMinute | Start timestamp of this session, truncated to the minute |
quicErrorCode | QUIC specific error code. Possible values are https://www.iana.org/assignments/quic/quic.xhtml#quic-transport-error-codes |
rttUs | Last Round Trip Time estimation for this session in microseconds |
sessionId | Identifier for this session |
sourceIP | IP address of the client making this session |
tokenAuthStatus | Client token authentication status. Possible values are success | failed with invalid token and upto date token key ID | failed with invalid token due to outdated/missing token key ID | failed due to reused token |
tokenSigningRegion | Broad location assigned to client in this session |
transport | Transport protocol used for this session. Possible values are tcp | quic | udp |
transportHandshakeDurationUs | Time taken for TCP/TLS or QUIC handshake in microsecond |
transportStatus | Transport Status. Possible values are unknown | success | failure |
AccountGatewayL4DownstreamSessionsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountGatewayL4DownstreamSessionsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountGatewayL4DownstreamSessionsAdaptiveGroupsQuantiles
Field | Description |
---|---|
tokenAuthDurationUsP50 | Time taken for Client Token Authentication in microseconds |
transportHandshakeDurationUsP50 | Time taken for TCP/TLS or QUIC handshake in microseconds |
AccountGatewayL4DownstreamSessionsAdaptiveGroupsSum
Field | Description |
---|---|
bytesRecvd | Total bytes received in this session |
bytesSent | Total bytes sent in this session |
clientBytesRetransmitted | Total bytes retransmitted by client in this session |
packetsRecvd | Total number of packets received in this session |
packetsSent | Total number of packets sent in this session |
tokenAuthDurationUs | Time taken for client token authentication in microseconds |
AccountGatewayL4SessionsAdaptiveGroups
BETA - Aggregate counts of Gateway L4 sessions with adaptive sampling
Field | Description |
---|---|
count | The number of Gateway L4 sessions |
dimensions | List of dimensions to group by |
AccountGatewayL4SessionsAdaptiveGroupsDimensions
Field | Description |
---|---|
action | action taken by gateway |
coloCode | Colo Code of edge server |
datetime | Datetime that the session was started |
datetimeHour | Datetime that the session was started truncated to hours |
datetimeMinute | Datetime that the session was started truncated to minutes |
destinationIp | The destination IP address for the session |
destinationPort | The destination port for the session |
detectedProtocol | The detected protocol of network traffic |
deviceId | The device ID of the gateway user who initiated the session |
The email address of the gateway user who initiated the session | |
sni | The SNI pulled from the session tls handshake, if present |
sourceInternalIp | Local LAN IP of the device. Only available when connected via a GRE/IPsec tunnel on-ramp |
sourceIp | The source IP address for the session |
sourcePort | The source port for the session |
transport | The transport protocol used in the session, one of (0, tcp) (1, quic) (2, udp) |
userId | The ID of the gateway user who initiated the session |
AccountGatewayL4SessionsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountGatewayL4SessionsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountGatewayL4UpstreamSessionsAdaptiveGroups
Aggregated metrics about upstream (edge to client) L4 Gateway Sessions. Metrics are reported on TCP, QUIC or UDP session close
Field | Description |
---|---|
count | The number of upstream sessions |
dimensions | List of dimensions to group by |
quantiles | |
sum |
AccountGatewayL4UpstreamSessionsAdaptiveGroupsDimensions
Field | Description |
---|---|
coloCode | IATA Airport code that represents the city in which a Cloudflare data center (colo) is located |
coloCountry | ISO 3166-1 alpha-2 code that represents the country in which a Cloudflare data center (colo) is located |
date | Start timestamp of this session, truncated to date |
datetimeFifteenMinutes | Start timestamp of this session, truncated to multiple of 15 minutes |
datetimeFiveMinutes | Start timestamp of this session, truncated to multiple of 5 minutes |
datetimeHour | Start timestamp of this session, truncated to the hour |
datetimeMinute | Start timestamp of this session, truncated to the minute |
destinationIP | IP address of the origin server |
domainName | SNI domain name for this session |
downstreamSessionId | Downstream session identifier of this session |
httpConnectReqStatus | Client HTTP CONNECT request status. Possible values are unknown | success | failure |
quicErrorCode | QUIC error code. Possible values are https://www.iana.org/assignments/quic/quic.xhtml#quic-transport-error-codes |
rttUs | Last Round Trip Time estimation for this session in microseconds |
tokenSigningRegion | Broad location assigned to client in this session |
totalTunnelSetupDurationUs | Total time taken for tunnel setup in microseconds |
transport | Transport protocol used for this session. Possible values are tcp | quic | udp |
transportStatus | Transport status. Possible values are unknown | success | failure |
AccountGatewayL4UpstreamSessionsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountGatewayL4UpstreamSessionsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountGatewayL4UpstreamSessionsAdaptiveGroupsQuantiles
Field | Description |
---|---|
connectReqHandlingDurationUsP50 | Time taken for CONNECT request handling in microseconds |
totalTunnelSetupDurationUsP50 | Total time taken for tunnel setup in microseconds |
tunnelSetupDurationUsP50 | Time taken to setup the tunnel in microseconds |
AccountGatewayL4UpstreamSessionsAdaptiveGroupsSum
Field | Description |
---|---|
bytesRecvd | Total bytes received in this session |
bytesSent | Total bytes sent in this session |
connectReqHandlingDurationUs | Time taken for CONNECT request handling in microseconds |
originBytesRetransmitted | Total bytes retransmitted by origin in this session |
packetsRecvd | Total number of packets received in this session |
packetsSent | Total number of packets sent in this session |
totalTunnelSetupDurationUs | Total time taken for tunnel setup in microseconds |
tunnelSetupDurationUs | Time taken for tunnel setup in microseconds |
AccountGatewayL7RequestsAdaptiveGroups
BETA - Aggregate counts of Gateway L7 requests with adaptive sampling
Field | Description |
---|---|
count | The number of Gateway L7 requests |
dimensions | List of dimensions to group by |
AccountGatewayL7RequestsAdaptiveGroupsDimensions
Field | Description |
---|---|
action | action taken by gateway |
coloCode | Colo Code of edge server |
datetime | Datetime that the request happened |
datetimeHour | Datetime that the request happened truncated to hours |
datetimeMinute | Datetime that the request happened truncated to minutes |
deviceId | The device ID of the gateway user who made the request |
The email address of the gateway user who made the request | |
httpHost | The destination host for the request |
httpStatusCode | HTTP status code gateway returned to the user. 0 if nothing was returned(e.g client disconnected) |
isIsolated | Indicates whether this request was made through an isolated link |
privateAppAUD | Access private app AUD |
quarantined | Indicates if the request content was quarantined |
sourceInternalIp | Local LAN IP of the device. Only available when connected via a GRE/IPsec tunnel on-ramp |
untrustedCertificateAction | Action taken when an untrusted origin certificate error occurs |
userId | The ID of the gateway user who made the request |
AccountGatewayL7RequestsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountGatewayL7RequestsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountGatewayResolverByCategoryAdaptiveGroups
BETA - Aggregate counts of Gateway Resolver queries by category with adaptive sampling
Field | Description |
---|---|
count | The number of Gateway Resolver queries |
dimensions | List of dimensions to group by |
AccountGatewayResolverByCategoryAdaptiveGroupsDimensions
Field | Description |
---|---|
authoritativeNameserverIps | List of IPs of the authoritative nameservers that provided the answers, if any |
categoryId | ID of the category that was assigned to the domain |
cnames | List of resolved intermediate cname domains |
datetime | The date and time the DNS query was resolved |
datetimeHour | The date and time the event occurred at the edge truncated to hours |
datetimeMinute | The date and time the event occurred at the edge truncated to minutes |
dohSubdomain | The destination DoH subdomain the DNS query was made to |
dotSubdomain | The destination DoT subdomain the DNS query was made to |
edeErrors | List of returned Extended DNS Error Codes |
locationId | The uuid identifying the customer Location used when resolving |
matchedApplicationId | ID of the application the domain belongs to |
matchedApplicationName | Name of the application the domain belongs to |
policyId | ID of the policy/rule that was applied, if any |
policyName | Name of the policy that was applied, if any |
resolvedIpContinents | Continent code of each resolved IP, if any |
resolvedIpCountries | Country code of each resolved IP, if any |
resolvedIps | List of resolved IPs in the response, if any |
resolverDecision | Enum identifier for the decision made by gateway-resolver, one of: (0, unknown) (1, allowedByQueryName) (2, blockedByQueryName) (3, blockedByCategory) (4, allowedOnNoLocation) (5, allowedOnNoPolicyMatch) (6, blockedAlwaysCategory) (7, overrideForSafeSearch) (8, overrideApplied) (9, blockedRule) (10, allowedRule) |
resourceRecordClasses | Resource records' classes |
resourceRecordNames | Resource records' names |
resourceRecordRDatas | Resource records' rdata values |
resourceRecordTTLs | Resource records' TTL values |
resourceRecordTypes | Resource records' types |
srcIpContinent | Continent code of the source IP address making the DNS query |
srcIpCountry | Country code of the source IP address making the DNS query |
AccountGatewayResolverByCategoryAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountGatewayResolverByCategoryAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountGatewayResolverByCustomResolverGroups
Stats on dns custom resolvers
Field | Description |
---|---|
avg | The average value for a metric |
count | The number of Gateway Resolver queries |
dimensions | List of dimensions to group by |
max | Maximum response time |
AccountGatewayResolverByCustomResolverGroupsAvg
Field | Description |
---|---|
customResolverTimeInMs | Average latency |
sampleInterval | Average sample interval |
AccountGatewayResolverByCustomResolverGroupsDimensions
Field | Description |
---|---|
cacheStatus | whether the response was cached or not |
customResolverAddress | address at which custom resolver query was resolved at |
customResolverResponseCode | Response code recieved from the custom resolver 0 => unknown 27 => dnsFirewallSuccess 29 => dnsFirewallCustomerRatelimit 31 => dnsFirewallUpstreamFailure 32 => dnsFirewallUpstreamServfail |
customResolverTimeInMs | time took for custom resolver to respond |
datetime | The date and time the DNS query was resolved |
locationId | The uuid identifying the customer Location used when resolving |
queryName | Name of the query, e.g. one.dash.cloudflare.com |
resolverDecision | Enum identifier for the decision made by gateway-resolver, one of: (0, unknown) (1, allowedByQueryName) (2, blockedByQueryName) (3, blockedByCategory) (4, allowedOnNoLocation) (5, allowedOnNoPolicyMatch) (6, blockedAlwaysCategory) (7, overrideForSafeSearch) (8, overrideApplied) (9, blockedRule) (10, allowedRule) |
AccountGatewayResolverByCustomResolverGroupsFilter_InputObject
Field | Description |
---|---|
AccountGatewayResolverByCustomResolverGroupsMax
Field | Description |
---|---|
customResolverTimeInMs | Maximum response time |
AccountGatewayResolverByCustomResolverGroupsOrderBy
Field | Description |
---|---|
AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroups
Total time spent on executing firewall rules at the edge
Field | Description |
---|---|
avg | The average value for a metric per dimension |
count | The number of Gateway Resolver queries |
dimensions | List of dimensions to group by |
max | Maximum execution time |
quantiles | Quantiles of a rule execution performance |
AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval | Average sample interval |
AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsDimensions
Field | Description |
---|---|
datetime | Request timestamp |
datetimeMonth | Request timestamp month |
AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsMax
Field | Description |
---|---|
executionTime | Maximum execution time |
AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsQuantiles
Field | Description |
---|---|
executionTimeMsP25 | Execution time performance of 25th percentile in milliseconds |
executionTimeMsP50 | Execution time performance of 50th percentile in milliseconds |
executionTimeMsP75 | Execution time performance of 75th percentile in milliseconds |
executionTimeMsP90 | Execution time performance of 90th percentile in milliseconds |
executionTimeMsP95 | Execution time performance of 95th percentile in milliseconds |
executionTimeMsP98 | Execution time performance of 98th percentile in milliseconds |
executionTimeMsP99 | Execution time performance of 99th percentile in milliseconds |
AccountGatewayResolverQueriesAdaptiveGroups
BETA - Aggregate counts of Gateway Resolver queries with adaptive sampling
Field | Description |
---|---|
count | The number of Gateway Resolver queries |
dimensions | List of dimensions to group by |
AccountGatewayResolverQueriesAdaptiveGroupsDimensions
Field | Description |
---|---|
authoritativeNameserverIps | List of IPs of the authoritative nameservers that provided the answers, if any |
categoryIds | Json array of categories for this query |
categoryNames | List of matching categories names for this query |
cnames | List of resolved intermediate cname domains |
datetime | The date and time the DNS query was resolved |
datetimeHour | The date and time the event occurred at the edge truncated to hours |
datetimeMinute | The date and time the event occurred at the edge truncated to minutes |
dohSubdomain | The destination DoH subdomain the DNS query was made to |
dotSubdomain | The destination DoT subdomain the DNS query was made to |
edeErrors | List of returned Extended DNS Error Codes |
locationId | The uuid identifying the customer Location used when resolving |
locationName | The name identifying the customer Location used when resolving |
matchedApplicationId | ID of the application the domain belongs to |
matchedApplicationName | Name of the application the domain belongs to |
matchedIndicatorFeedIds | Json array of indicator feed IDs for this query that matched rule |
matchedIndicatorFeedNames | List of indicator feed names for this query |
policyId | ID of the policy/rule that was applied, if any |
policyName | Name of the policy that was applied, if any |
queryName | Name of the query, e.g. one.dash.cloudflare.com |
queryNameReversed | Name of the query in reverse order, e.g. com.cloudflare.dash.one |
resolvedIpContinents | Continent code of each resolved IP, if any |
resolvedIpCountries | Country code of each resolved IP, if any |
resolvedIps | List of resolved IPs in the response, if any |
resolverDecision | Enum identifier for the decision made by gateway-resolver, one of: (0, unknown) (1, allowedByQueryName) (2, blockedByQueryName) (3, blockedByCategory) (4, allowedOnNoLocation) (5, allowedOnNoPolicyMatch) (6, blockedAlwaysCategory) (7, overrideForSafeSearch) (8, overrideApplied) (9, blockedRule) (10, allowedRule) |
resourceRecordClasses | Resource records' classes |
resourceRecordNames | Resource records' names |
resourceRecordRDatas | Resource records' rdata values |
resourceRecordTTLs | Resource records' TTL values |
resourceRecordTypes | Resource records' types |
scheduleInfo | Json object of schedule releated information |
srcIpContinent | Continent code of the source IP address making the DNS query |
srcIpCountry | Country code of the source IP address making the DNS query |
AccountGatewayResolverQueriesAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountGatewayResolverQueriesAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountHttpRequests1dGroups
Daily rollups of request data
Field | Description |
---|---|
avg | The average value for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
uniq | The number of unique values for a metric per dimension |
AccountHttpRequests1dGroupsAvg
Field | Description |
---|---|
bytes | |
sampleInterval | Average sample interval |
AccountHttpRequests1dGroupsBrowserMapElem
Field | Description |
---|---|
pageViews | Successful requests for HTML content |
uaBrowserFamily | Browser type |
AccountHttpRequests1dGroupsClientHTTPVersionMapElem
Field | Description |
---|---|
clientHTTPProtocol | HTTP version |
requests |
AccountHttpRequests1dGroupsClientSSLMapElem
Field | Description |
---|---|
clientSSLProtocol | Protocol version |
requests |
AccountHttpRequests1dGroupsContentTypeMapElem
Field | Description |
---|---|
bytes | Bytes returned to client |
edgeResponseContentTypeName | Content type returned to client |
requests |
AccountHttpRequests1dGroupsCountryMapElem
Field | Description |
---|---|
bytes | Bytes returned to client |
clientCountryName | Country from which request originated |
requests | |
threats | Requests classified as threats |
AccountHttpRequests1dGroupsDimensions
Field | Description |
---|---|
date | Request date |
AccountHttpRequests1dGroupsFilter_InputObject
Field | Description |
---|---|
AccountHttpRequests1dGroupsIpClassMapElem
Field | Description |
---|---|
ipType | IP class |
requests |
AccountHttpRequests1dGroupsOrderBy
Field | Description |
---|---|
AccountHttpRequests1dGroupsResponseStatusMapElem
Field | Description |
---|---|
edgeResponseStatus | HTTP response status code returned to client |
requests |
AccountHttpRequests1dGroupsSum
Field | Description |
---|---|
browserMap | |
bytes | Bytes returned to client |
cachedBytes | Bytes returned to client from cache |
cachedRequests | Requests served from cache |
clientHTTPVersionMap | |
clientSSLMap | |
contentTypeMap | |
countryMap | |
encryptedBytes | Bytes returned to client using SSL/TLS protocol |
encryptedRequests | Requests served using SSL/TLS protocol |
ipClassMap | |
pageViews | Successful requests for HTML content |
requests | |
responseStatusMap | |
threatPathingMap | |
threats | Requests classified as threats |
AccountHttpRequests1dGroupsThreatPathingMapElem
Field | Description |
---|---|
requests | |
threatPathingName | Threat type |
AccountHttpRequests1dGroupsUniq
Field | Description |
---|---|
uniques | A number of unique IPs |
AccountHttpRequests1hGroups
Hourly rollups of request data
Field | Description |
---|---|
avg | The average value for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
uniq | The number of unique values for a metric per dimension |
AccountHttpRequests1hGroupsAvg
Field | Description |
---|---|
bytes | |
sampleInterval | Average sample interval |
AccountHttpRequests1hGroupsBrowserMapElem
Field | Description |
---|---|
pageViews | Successful requests for HTML content |
uaBrowserFamily | Browser type |
AccountHttpRequests1hGroupsClientHTTPVersionMapElem
Field | Description |
---|---|
clientHTTPProtocol | HTTP version |
requests |
AccountHttpRequests1hGroupsClientSSLMapElem
Field | Description |
---|---|
clientSSLProtocol | Protocol version |
requests |
AccountHttpRequests1hGroupsContentTypeMapElem
Field | Description |
---|---|
bytes | Bytes returned to client |
edgeResponseContentTypeName | Content type returned to client |
requests |
AccountHttpRequests1hGroupsCountryMapElem
Field | Description |
---|---|
bytes | Bytes returned to client |
clientCountryName | Country from which request originated |
requests | |
threats | Requests classified as threats |
AccountHttpRequests1hGroupsDimensions
Field | Description |
---|---|
date | Request date |
datetime | Request datetime truncated to the hour |
AccountHttpRequests1hGroupsFilter_InputObject
Field | Description |
---|---|
AccountHttpRequests1hGroupsIpClassMapElem
Field | Description |
---|---|
ipType | IP class |
requests |
AccountHttpRequests1hGroupsOrderBy
Field | Description |
---|---|
AccountHttpRequests1hGroupsResponseStatusMapElem
Field | Description |
---|---|
edgeResponseStatus | HTTP response status code returned to client |
requests |
AccountHttpRequests1hGroupsSum
Field | Description |
---|---|
browserMap | |
bytes | Bytes returned to client |
cachedBytes | Bytes returned to client from cache |
cachedRequests | Requests served from cache |
clientHTTPVersionMap | |
clientSSLMap | |
contentTypeMap | |
countryMap | |
encryptedBytes | Bytes returned to client using SSL/TLS protocol |
encryptedRequests | Requests served using SSL/TLS protocol |
ipClassMap | |
pageViews | Successful requests for HTML content |
requests | |
responseStatusMap | |
threatPathingMap | |
threats | Requests classified as threats |
AccountHttpRequests1hGroupsThreatPathingMapElem
Field | Description |
---|---|
requests | |
threatPathingName | Threat type |
AccountHttpRequests1hGroupsUniq
Field | Description |
---|---|
uniques | A number of unique IPs |
AccountHttpRequests1mGroups
Minutely rollups of request data
Field | Description |
---|---|
avg | The average value for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
uniq | The number of unique values for a metric per dimension |
AccountHttpRequests1mGroupsAvg
Field | Description |
---|---|
bytes | |
sampleInterval | Average sample interval |
AccountHttpRequests1mGroupsBrowserMapElem
Field | Description |
---|---|
pageViews | Successful requests for HTML content |
uaBrowserFamily | Browser type |
AccountHttpRequests1mGroupsClientHTTPVersionMapElem
Field | Description |
---|---|
clientHTTPProtocol | HTTP version |
requests |
AccountHttpRequests1mGroupsClientSSLMapElem
Field | Description |
---|---|
clientSSLProtocol | Protocol version |
requests |
AccountHttpRequests1mGroupsContentTypeMapElem
Field | Description |
---|---|
bytes | Bytes returned to client |
edgeResponseContentTypeName | Content type returned to client |
requests |
AccountHttpRequests1mGroupsCountryMapElem
Field | Description |
---|---|
bytes | Bytes returned to client |
clientCountryName | Country from which request originated |
requests | |
threats | Requests classified as threats |
AccountHttpRequests1mGroupsDimensions
Field | Description |
---|---|
date | Request date |
datetime | Request datetime, truncated to the minute |
datetimeDay | Request datetime truncated to the day |
datetimeFifteenMinutes | Request datetime truncated to multiple of 15 minutes |
datetimeFiveMinutes | Request datetime truncated to multiple of 5 minutes |
datetimeHalfOfHour | Request datetime truncated to multiple of 30 minutes |
datetimeHour | Request datetime truncated to the hour |
datetimeMinute | DEPRECATED (Field is replaced with datetime ): Request datetime truncated to the minute |
AccountHttpRequests1mGroupsFilter_InputObject
Field | Description |
---|---|
AccountHttpRequests1mGroupsIpClassMapElem
Field | Description |
---|---|
ipType | IP class |
requests |
AccountHttpRequests1mGroupsOrderBy
Field | Description |
---|---|
AccountHttpRequests1mGroupsResponseStatusMapElem
Field | Description |
---|---|
edgeResponseStatus | HTTP response status code returned to client |
requests |
AccountHttpRequests1mGroupsSum
Field | Description |
---|---|
browserMap | |
bytes | Bytes returned to client |
cachedBytes | Bytes returned to client from cache |
cachedRequests | Requests served from cache |
clientHTTPVersionMap | |
clientSSLMap | |
contentTypeMap | |
countryMap | |
encryptedBytes | Bytes returned to client using SSL/TLS protocol |
encryptedRequests | Requests served using SSL/TLS protocol |
ipClassMap | |
pageViews | Successful requests for HTML content |
requests | |
responseStatusMap | |
threatPathingMap | |
threats | Requests classified as threats |
AccountHttpRequests1mGroupsThreatPathingMapElem
Field | Description |
---|---|
requests | |
threatPathingName | Threat type |
AccountHttpRequests1mGroupsUniq
Field | Description |
---|---|
uniques | A number of unique IPs |
AccountHttpRequestsAdaptive
Raw HTTP requests with adaptive sampling
Field | Description |
---|---|
apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
apiGatewayMatchedHost | API Gateway host matched at the edge |
botDetectionIds | Array of detections ids that matched this request |
botDetectionTags | Array of detections tags that matched this request |
botManagementDecision | Judgement of the bot management system |
botScore | The final score originated from bot management detections. |
botScoreBucketBy10 | Range of the bot management score |
botScoreSrcName | Name of the source detection which generated the bot management score. |
cacheReserveUsed | Used Cache Reserve to serve the response |
cacheStatus | Cache status |
clientASNDescription | The ASN of the visitor as string |
clientAsn | The ASN number of the visitor |
clientCountryName | Country from which request originated |
clientDeviceType | |
clientIP | The visitor's IP address (IPv4 or IPv6) |
clientRefererHost | The referrer host |
clientRequestHTTPHost | The HTTP hostname requested by the visitor |
clientRequestHTTPMethodName | HTTP method of client request |
clientRequestHTTPProtocol | The version of HTTP protocol requested by the visitor |
clientRequestPath | The path requested by visitor |
clientRequestQuery | Query parameters of client request |
clientRequestReferer | HTTP request referrer |
clientRequestScheme | The url scheme requested by the visitor |
clientSSLProtocol | SSL protocol version |
coloCode | |
contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
contentScanNumObj | Number of scannable content objects |
contentScanObjResults | Array of scan results in order of detection |
contentScanObjSizes | Array of scan sizes in order of detection |
contentScanObjTypes | Array of content types in order of detection |
date | The date the event occurred at the edge |
datetime | The date and time the event occurred at the edge |
datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
datetimeHour | The date and time the event occurred at the edge truncated to hours |
datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
edgeDnsResponseTimeMs | The time elapsed resolving a CNAME if it was required to reach your origin |
edgeResponseContentTypeName | |
edgeResponseStatus | HTTP response status code returned to browser |
edgeTimeToFirstByteMs | The time elapsed between processing the first byte of the request until when we started sending a response |
httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion ): Version associated with HTTP Application |
isCrossZoneSubrequest | '1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise. |
ja3Hash | MD5 hash of the JA3 TLS fingerprint |
ja4 | JA4 TLS fingerprint |
ja4Signals | Inter-request statistics computed for this JA4 across Cloudflare's entire global edge network |
leakedCredentialCheckResult | The distinct result of checking for leaked credentials |
originASN | |
originASNDescription | ASN associated with origin |
originIP | |
originResponseDurationMs | |
originResponseStatus | HTTP origin response status code returned to browser |
rayName | The RayId of the request |
requestSource | |
securityAction | The code of the first-class action the Cloudflare Firewall took on this request |
securitySource | The Cloudflare security product triggered by this request |
upperTierColoName | |
userAgent | visitor's user-agent string |
userAgentBrowser | Browser parsed from the user agent |
userAgentOS | OS parsed from the user agent |
wafAttackScore | Beta. Overall request score generated by the WAF detection module |
wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
wafRceAttackScore | Beta. WAF score for a RCE attack |
wafSqliAttackScore | Beta. WAF score for a SQLi attack |
wafXssAttackScore | Beta. WAF score for a XSS attack |
xRequestedWith | The X-Requested-With header of the client request |
zoneTag | Associated zone |
zoneVersion | The version of a zone |
AccountHttpRequestsAdaptiveFilter_InputObject
Field | Description |
---|---|
AccountHttpRequestsAdaptiveGroups
Aggregated HTTP requests data with adaptive sampling
Field | Description |
---|---|
avg | The average value used for sample interval |
confidence | ALPHA - DO NOT USE |
count | The number of values for a metric per dimension |
dimensions | List of dimensions to group by |
quantiles | Quantiles of a metric per dimension |
ratio | The ratio of a range of status codes, between 0 and 1 |
sum | The sum of values for a metric per dimension |
AccountHttpRequestsAdaptiveGroupsAvg
Field | Description |
---|---|
crossZoneSubrequests | The proportion of requests that were inititiated by a Cloudflare Worker on another zone |
edgeDnsResponseTimeMs | |
edgeTimeToFirstByteMs | |
originResponseDurationMs | The average originResponseDuration, in milliseconds, excluding 0 values (i.e. cached ones) |
sampleInterval |
AccountHttpRequestsAdaptiveGroupsConfidence
Field | Description |
---|---|
count | The number of values for a metric per dimension, with confidence intervals |
level | Confidence level that was requested |
sum | The sum of values for a metric per dimension, with confidence intervals |
AccountHttpRequestsAdaptiveGroupsDimensions
Field | Description |
---|---|
apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
apiGatewayMatchedHost | API Gateway host matched at the edge |
botDetectionIds | Array of detections ids that matched this request |
botDetectionTags | Array of detections tags that matched this request |
botManagementDecision | Judgement of the bot management system |
botScore | The final score originated from bot management detections. |
botScoreBucketBy10 | Range of the bot management score |
botScoreSrcName | Name of the source detection which generated the bot management score. |
cacheReserveUsed | Used Cache Reserve to serve the response |
cacheStatus | |
clientASNDescription | The ASN of the visitor as string |
clientAsn | |
clientCountryName | Country from which request originated |
clientDeviceType | |
clientIP | |
clientRefererHost | The referrer host |
clientRequestHTTPHost | Host requested by the client |
clientRequestHTTPMethodName | HTTP method of client request |
clientRequestHTTPProtocol | HTTP protocol version |
clientRequestPath | Path of client request |
clientRequestQuery | Query parameters of client request |
clientRequestReferer | HTTP request referrer |
clientRequestScheme | HTTP request URI scheme (http/https) |
clientSSLProtocol | SSL protocol version |
coloCode | |
contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
contentScanNumObj | Number of scannable content objects |
contentScanObjResults | Array of scan results in order of detection |
contentScanObjSizes | Array of scan sizes in order of detection |
contentScanObjTypes | Array of content types in order of detection |
date | The date the event occurred at the edge |
datetime | The date and time the event occurred at the edge |
datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
datetimeHour | The date and time the event occurred at the edge truncated to hours |
datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
edgeDnsResponseTimeMs | The time elapsed resolving a CNAME if it was required to reach your origin |
edgeResponseContentTypeName | |
edgeResponseStatus | |
edgeTimeToFirstByteMs | The time elapsed between processing the first byte of the request until when we started sending a response |
httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion ): Version associated with HTTP Application |
isCrossZoneSubrequest | '1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise. |
ja3Hash | MD5 hash of the JA3 TLS fingerprint |
ja4 | JA4 TLS fingerprint |
leakedCredentialCheckResult | The distinct result of checking for leaked credentials |
originASN | |
originASNDescription | ASN associated with origin |
originIP | |
originResponseDurationMs | |
originResponseStatus | HTTP response status code returned by the origin |
requestSource | |
sampleInterval | ABR sample interval |
securityAction | The code of the first-class action the Cloudflare Firewall took on this request |
securitySource | The Cloudflare security product triggered by this request |
upperTierColoName | |
userAgent | |
userAgentBrowser | Browser parsed from the user agent |
userAgentOS | OS parsed from the user agent |
wafAttackScore | Beta. Overall request score generated by the WAF detection module |
wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
wafRceAttackScore | Beta. WAF score for a RCE attack |
wafSqliAttackScore | Beta. WAF score for a SQLi attack |
wafXssAttackScore | Beta. WAF score for a XSS attack |
xRequestedWith | The X-Requested-With header of the client request |
zoneTag | Associated zone |
zoneVersion | The version of a zone |
AccountHttpRequestsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountHttpRequestsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountHttpRequestsAdaptiveGroupsQuantiles
Field | Description |
---|---|
edgeDnsResponseTimeMsP50 | 50th percentile DNS Response Time (milliseconds) |
edgeDnsResponseTimeMsP95 | 95th percentile DNS Response Time (milliseconds) |
edgeDnsResponseTimeMsP99 | 99th percentile DNS Response Time (milliseconds) |
edgeTimeToFirstByteMsP50 | 50th percentile Time To First Byte (milliseconds) |
edgeTimeToFirstByteMsP95 | 95th percentile Time To First Byte (milliseconds) |
edgeTimeToFirstByteMsP99 | 99th percentile Time To First Byte (milliseconds) |
originResponseDurationMsP50 | 50th percentile Origin Response Duration (milliseconds) |
originResponseDurationMsP95 | 95th percentile Origin Response Duration (milliseconds) |
originResponseDurationMsP99 | 99th percentile Origin Response Duration (milliseconds) |
AccountHttpRequestsAdaptiveGroupsRatio
Field | Description |
---|---|
status4xx | |
status5xx |
AccountHttpRequestsAdaptiveGroupsSum
Field | Description |
---|---|
botDetectionIdArray | Array of bot management detection ids |
botDetectionIdCountArray | Count array of bot management detection ids. Elements in this array correspond to elements in botDetectionIdArray by index. |
botDetectionTagArray | Array of bot management detection tags |
botDetectionTagCountArray | Count array of bot management detection tags. Elements in this array correspond to elements in botDetectionTagArray by index. |
crossZoneSubrequests | The number of requests that were inititiated by a Cloudflare Worker on another zone |
edgeDnsResponseTimeMs | |
edgeResponseBytes | |
edgeTimeToFirstByteMs | |
originResponseDurationMs | |
visits | The number of requests by end-users that were initiated from a different website (i.e. where the request HTTP Referer header does not match the host in the HTTP Host header) |
AccountHttpRequestsAdaptiveGroupsSumConfidence
Field | Description |
---|---|
edgeResponseBytes | Confidence interval for the corresponding point estimate |
AccountHttpRequestsAdaptiveJa4SignalsElem
Field | Description |
---|---|
signalName | Signal name |
signalValue | Signal value |
AccountHttpRequestsAdaptiveOrderBy
Field | Description |
---|---|
AccountHttpRequestsOverviewAdaptiveGroups
A high-level summary of HTTP requests made by end users.
Field | Description |
---|---|
avg | The average value for a metric per dimension |
dimensions | List of dimensions to group by |
ratio | The ratio of a metric in comparison to the rest of the traffic, between 0 and 1 |
sum | The sum of values for a metric per dimension |
AccountHttpRequestsOverviewAdaptiveGroupsAvg
Field | Description |
---|---|
originResponseDurationMs | The average originResponseDuration, in milliseconds, excluding 0 values (i.e. cached ones) |
sampleInterval | Average sample interval |
AccountHttpRequestsOverviewAdaptiveGroupsDimensions
Field | Description |
---|---|
clientCountryName | Country from which request originated |
clientRequestHTTPProtocol | HTTP protocol version |
clientSSLProtocol | SSL protocol version |
date | The date the event occurred at the edge |
datetime | The date and time the event occurred at the edge |
datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
datetimeHour | The date and time the event occurred at the edge truncated to hours |
datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
edgeResponseContentTypeName | Content type returned to client |
edgeResponseStatus | HTTP response status code returned to client |
httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion ): Version associated with HTTP Application |
userAgentBrowser | Browser parsed from the user agent |
zoneVersion | The version of a zone |
AccountHttpRequestsOverviewAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountHttpRequestsOverviewAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountHttpRequestsOverviewAdaptiveGroupsRatio
Field | Description |
---|---|
cachedBytes | |
cachedRequests | |
encryptedBytes | |
encryptedRequests | |
status4xx | |
status5xx |
AccountHttpRequestsOverviewAdaptiveGroupsSum
Field | Description |
---|---|
bytes | |
cachedBytes | Bytes returned to client from cache |
cachedRequests | Requests served from cache |
pageViews | Successful requests for HTML content |
requests | |
visits | The number of requests by end-users that were initiated from a different website (i.e. where the request HTTP Referer header does not match the host in the HTTP Host header) |
AccountHyperdriveQueriesAdaptiveGroups
Hyperdrive query events with adaptive sampling.
Field | Description |
---|---|
avg | The average value for a metric per dimension |
count | Total number of Hyperdrive queries |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountHyperdriveQueriesAdaptiveGroupsAvg
Field | Description |
---|---|
connectionLatency | Average latency (in milliseconds) of retrieving a connection to the origin database |
queryBytes | Average size (in bytes) of queries handled by Hyperdrive |
queryLatency | Average latency (in milliseconds) of serving a query using Hyperdrive |
resultBytes | Average size (in bytes) of query results served by Hyperdrive |
sampleInterval | The average value used for sample interval |
AccountHyperdriveQueriesAdaptiveGroupsDimensions
Field | Description |
---|---|
cacheStatus | The cache status of the Hyperdrive query event |
configId | The ID of the Hyperdrive Config |
date | Hyperdrive query event timestamp, truncated to start of a day |
datetime | Hyperdrive query event timestamp |
datetimeHour | Hyperdrive query event timestamp, truncated to start of hour |
datetimeMinute | Hyperdrive query event timestamp, truncated to start of minute |
eventStatus | The result of the Hyperdrive event: 'error' or 'complete'. Error events may not have complete data. |
AccountHyperdriveQueriesAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountHyperdriveQueriesAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountHyperdriveQueriesAdaptiveGroupsSum
Field | Description |
---|---|
clientWriteLatency | Total latency (in milliseconds) of sending query results back to client |
connectionLatency | Total latency (in milliseconds) of retrieving a connection to the origin database |
originReadLatency | Total latency (in milliseconds) of receiving responses from origin to Hyperdrive |
originWriteLatency | Total latency (in milliseconds) of sending queries to origin from Hyperdrive |
queryBytes | Total size (in bytes) of queries handled by Hyperdrive |
queryLatency | Total latency (in milliseconds) of serving a query using Hyperdrive |
resultBytes | Total size (in bytes) of query results served by Hyperdrive |
AccountImagesRequestsAdaptiveGroups
A high-level summary of Cloudflare Images served to end users.
Field | Description |
---|---|
avg | The average value for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountImagesRequestsAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval |
AccountImagesRequestsAdaptiveGroupsDimensions
Field | Description |
---|---|
date | The date the event occurred at the edge |
datetime | The date and time the event occurred at the edge |
datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
datetimeHour | The date and time the event occurred at the edge truncated to hours |
datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
AccountImagesRequestsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountImagesRequestsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountImagesRequestsAdaptiveGroupsSum
Field | Description |
---|---|
requests |
AccountImagesUniqueTransformations
Image unique transfromations per day
Field | Description |
---|---|
date | The date uniques are calculated for |
transformations | Number of unique image transformations per day in sliding window |
AccountImagesUniqueTransformationsFilter_InputObject
Field | Description |
---|---|
AccountImagesUniqueTransformationsOrderBy
Field | Description |
---|---|
AccountKvOperationsAdaptiveGroups
KV operations data with adaptive sampling
Field | Description |
---|---|
avg | The average value for a metric per dimension |
count | Number of requests |
dimensions | List of dimensions to group by |
max | The max of values for a metric per dimension |
min | The min of values for a metric per dimension |
quantiles | Quantiles of a metric per dimension |
sum | The sum of values for a metric per dimension |
AccountKvOperationsAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval | The average value used for sample interval |
AccountKvOperationsAdaptiveGroupsDimensions
Field | Description |
---|---|
actionType | The type of the action (read, write, delete, list) |
date | Message operation timestamp, truncated to start of a day |
datetime | Message operation timestamp |
datetimeHour | Message operation timestamp, truncated to start of an hour |
datetimeMinute | Message operation timestamp, truncated to start of an minute |
namespaceId | The hexa-encoded namespace id |
responseStatusCode | The http status code of the response. |
result | The result of the action (hot_read, cold_read, deleted, uploaded, error, not_found) |
AccountKvOperationsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountKvOperationsAdaptiveGroupsMax
Field | Description |
---|---|
latencyMs | Max latency |
objectBytes | Max object bytes |
AccountKvOperationsAdaptiveGroupsMin
Field | Description |
---|---|
latencyMs | Min latency |
objectBytes | Min object bytes |
AccountKvOperationsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountKvOperationsAdaptiveGroupsQuantiles
Field | Description |
---|---|
latencyMsP25 | 25th percentile latency (milliseconds) |
latencyMsP50 | 50th percentile latency (milliseconds) |
latencyMsP75 | 75th percentile latency (milliseconds) |
latencyMsP90 | 90th percentile latency (milliseconds) |
latencyMsP99 | 99th percentile latency (milliseconds) |
latencyMsP999 | 99.9th percentile latency (milliseconds) |
AccountKvOperationsAdaptiveGroupsSum
Field | Description |
---|---|
objectBytes | Total bytes of all objects |
requests | Total number of requests |
AccountKvStorageAdaptiveGroups
KV stored data with adaptive sampling
Field | Description |
---|---|
dimensions | List of dimensions to group by |
max | The max of values for a metric per dimension |
AccountKvStorageAdaptiveGroupsDimensions
Field | Description |
---|---|
date | Message operation timestamp, truncated to start of a day |
datetime | Message operation timestamp |
datetimeHour | Message operation timestamp, truncated to start of an hour |
datetimeMinute | Message operation timestamp, truncated to start of an minute |
namespaceId | The hexa-encoded namespace id |
AccountKvStorageAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountKvStorageAdaptiveGroupsMax
Field | Description |
---|---|
byteCount | Max number of bytes |
keyCount | Max number of keys |
AccountKvStorageAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountLogpushHealthAdaptiveGroups
Beta. Logpush job health metrics
Field | Description |
---|---|
avg | |
count | The number of values for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountLogpushHealthAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval | Average sample interval |
AccountLogpushHealthAdaptiveGroupsDimensions
Field | Description |
---|---|
date | Date that we completed pushing the log batch |
datetime | Datetime that we completed pushing the log batch |
datetimeFifteenMinutes | Datetime that we completed pushing the log batch, truncated to multiple of 15 minutes |
datetimeFiveMinutes | Datetime that we completed pushing the log batch, truncated to multiple of 5 minutes |
datetimeHour | Datetime that we completed pushing the log batch, truncated to the hour |
datetimeMinute | Datetime that we completed pushing the log batch, truncated to the minute |
destinationType | Destination type, e.g. 'S3' or 'GCS' |
final | Cloudflare may attempt to push a batch of logs multiple times if we encounter a failure. This field will be set to 'true' if this was the last push attempt for this batch of logs. If this field is set to false, it means the push failed but another retry was attempted. If this field is set to true and status >= 300, then the batch of logs failed to push and log data was lost. If you want to count the total number of logs that succeeded or failed, you should always set final = true. |
jobId | The Logpush Job ID |
status | HTTP response status code of the log destination |
AccountLogpushHealthAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountLogpushHealthAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountLogpushHealthAdaptiveGroupsSum
Field | Description |
---|---|
bytes | Bytes of uncompressed log data pushed |
bytesCompressed | Bytes of compressed log data pushed |
records | A count of the total number of records pushed. |
AccountMagicFirewallNetworkAnalyticsAdaptiveGroups
Network analytics data for Magic Firewall
Field | Description |
---|---|
avg | The average of values for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountMagicFirewallNetworkAnalyticsAdaptiveGroupsAvg
Field | Description |
---|---|
bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountMagicFirewallNetworkAnalyticsAdaptiveGroupsDimensions
Field | Description |
---|---|
applicationTag | Application tag associated with the packet |
coloCity | City where the Cloudflare datacenter that received the packet is located |
coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
coloName | Cloudflare datacenter that received the packet (unique site identifier) |
date | Date that the packet was received |
datetime | Date and time that the packet was received |
datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
destinationDeviceTag | Device tag associated with the destination IP of the packet |
destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
greChecksum | Value of the Checkusm header field in the GRE packet |
greEthertype | Value of the Ethertype header field in the GRE packet |
greHeaderLength | Length of the GRE packet header, in bytes |
greKey | Value of the Key header field in the GRE packet |
greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
greVersion | Value of the Version header field in the GRE packet |
icmpChecksum | Value of the Checkusm header field in the ICMP packet |
icmpCode | Value of the Code header field in the ICMP packet |
icmpType | Value of the Type header field in the ICMP packet |
ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
ipv4Identification | Value of the Identification header field in the IPv4 packet |
ipv4Options | List of Options numbers included in the IPv4 packet header |
ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
leaseTag | IP lease tag associated with the packet |
outcome | The action that was taken on the packet (possible values: pass, drop) |
prefixTag | IP prefix tag associated with the packet |
ruleId | Unique identifier of the rule that matched the packet, if any |
rulesetId | Unique identifier of the ruleset containing the rule that matched the packet, if any |
sampleInterval | ABR sample interval |
sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
sourceDeviceTag | Device tag associated with the source IP of the packet |
sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
sourcePort | Value of the Source Port header field in the TCP or UDP packet |
tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
tcpChecksum | Value of the Checkusm header field in the TCP packet |
tcpDataOffset | Value of the Data Offset header field in the TCP packet |
tcpFlags | Value of the Flags header field in the TCP packet |
tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
tcpMss | Value of the MSS option header field in the TCP packet |
tcpOptions | List of Options numbers included in the TCP packet header |
tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
tcpWindowSize | Value of the Window Size header field in the TCP packet |
udpChecksum | Value of the Checkusm header field in the UDP packet |
udpPayloadLength | Value of the Payload Length header field in the UDP packet |
verdict | The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop) |
AccountMagicFirewallNetworkAnalyticsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountMagicFirewallNetworkAnalyticsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountMagicFirewallNetworkAnalyticsAdaptiveGroupsSum
Field | Description |
---|---|
bits | Sum of bits received |
packets | Sum of packets received |
AccountMagicFirewallRateLimitNetworkAnalyticsAdaptiveGroups
Network analytics data for Magic Firewall Ratelimiting
Field | Description |
---|---|
avg | The average of values for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountMagicFirewallRateLimitNetworkAnalyticsAdaptiveGroupsAvg
Field | Description |
---|---|
bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountMagicFirewallRateLimitNetworkAnalyticsAdaptiveGroupsDimensions
Field | Description |
---|---|
applicationTag | Application tag associated with the packet |
coloCity | City where the Cloudflare datacenter that received the packet is located |
coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
coloName | Cloudflare datacenter that received the packet (unique site identifier) |
date | Date that the packet was received |
datetime | Date and time that the packet was received |
datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
destinationDeviceTag | Device tag associated with the destination IP of the packet |
destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
greChecksum | Value of the Checkusm header field in the GRE packet |
greEthertype | Value of the Ethertype header field in the GRE packet |
greHeaderLength | Length of the GRE packet header, in bytes |
greKey | Value of the Key header field in the GRE packet |
greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
greVersion | Value of the Version header field in the GRE packet |
icmpChecksum | Value of the Checkusm header field in the ICMP packet |
icmpCode | Value of the Code header field in the ICMP packet |
icmpType | Value of the Type header field in the ICMP packet |
ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
ipv4Identification | Value of the Identification header field in the IPv4 packet |
ipv4Options | List of Options numbers included in the IPv4 packet header |
ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
leaseTag | IP lease tag associated with the packet |
outcome | The action that was taken on the packet (possible values: pass, drop) |
prefixTag | IP prefix tag associated with the packet |
ruleId | Unique identifier of the rule that matched the packet, if any |
rulesetId | Unique identifier of the ruleset containing the rule that matched the packet, if any |
sampleInterval | ABR sample interval |
sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
sourceDeviceTag | Device tag associated with the source IP of the packet |
sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
sourcePort | Value of the Source Port header field in the TCP or UDP packet |
tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
tcpChecksum | Value of the Checkusm header field in the TCP packet |
tcpDataOffset | Value of the Data Offset header field in the TCP packet |
tcpFlags | Value of the Flags header field in the TCP packet |
tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
tcpMss | Value of the MSS option header field in the TCP packet |
tcpOptions | List of Options numbers included in the TCP packet header |
tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
tcpWindowSize | Value of the Window Size header field in the TCP packet |
udpChecksum | Value of the Checkusm header field in the UDP packet |
udpPayloadLength | Value of the Payload Length header field in the UDP packet |
verdict | The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop) |
AccountMagicFirewallRateLimitNetworkAnalyticsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountMagicFirewallRateLimitNetworkAnalyticsAdaptiveGroupsSum
Field | Description |
---|---|
bits | Sum of bits received |
packets | Sum of packets received |
AccountMagicFirewallSamplesAdaptiveGroups
Data to visualize traffic allowed and blocked by Magic Firewall rules
Field | Description |
---|---|
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountMagicFirewallSamplesAdaptiveGroupsDimensions
Field | Description |
---|---|
datetime | Date and time that the packet was received |
datetimeFiveMinute | Date and time that the packet was received, rounded to the start of the nearest five minutes |
ruleId | Unique identifier of the rule that matched the packet, if any |
AccountMagicFirewallSamplesAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountMagicFirewallSamplesAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountMagicFirewallSamplesAdaptiveGroupsSum
Field | Description |
---|---|
bits | Sum of bits received |
packets | Sum of packets received |
AccountMagicIDPSNetworkAnalyticsAdaptiveGroups
Network analytics data for Magic IDS
Field | Description |
---|---|
avg | The average of values for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountMagicIDPSNetworkAnalyticsAdaptiveGroupsAvg
Field | Description |
---|---|
bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountMagicIDPSNetworkAnalyticsAdaptiveGroupsDimensions
Field | Description |
---|---|
coloCity | City where the Cloudflare datacenter that received the packet is located |
coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
coloName | Cloudflare datacenter that received the packet (unique site identifier) |
date | Date that the packet was received |
datetime | Date and time that the packet was received |
datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
destinationDeviceTag | Device tag associated with the destination IP of the packet |
destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
greChecksum | Value of the Checkusm header field in the GRE packet |
greEthertype | Value of the Ethertype header field in the GRE packet |
greHeaderLength | Length of the GRE packet header, in bytes |
greKey | Value of the Key header field in the GRE packet |
greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
greVersion | Value of the Version header field in the GRE packet |
icmpChecksum | Value of the Checkusm header field in the ICMP packet |
icmpCode | Value of the Code header field in the ICMP packet |
icmpType | Value of the Type header field in the ICMP packet |
ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
ipv4Identification | Value of the Identification header field in the IPv4 packet |
ipv4Options | List of Options numbers included in the IPv4 packet header |
ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
outcome | The action that was taken on the packet (possible values: pass, drop) |
sampleInterval | ABR sample interval |
sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
sourceDeviceTag | Device tag associated with the source IP of the packet |
sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
sourcePort | Value of the Source Port header field in the TCP or UDP packet |
tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
tcpChecksum | Value of the Checkusm header field in the TCP packet |
tcpDataOffset | Value of the Data Offset header field in the TCP packet |
tcpFlags | Value of the Flags header field in the TCP packet |
tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
tcpMss | Value of the MSS option header field in the TCP packet |
tcpOptions | List of Options numbers included in the TCP packet header |
tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
tcpWindowSize | Value of the Window Size header field in the TCP packet |
udpChecksum | Value of the Checkusm header field in the UDP packet |
udpPayloadLength | Value of the Payload Length header field in the UDP packet |
verdict | The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop) |
AccountMagicIDPSNetworkAnalyticsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountMagicIDPSNetworkAnalyticsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountMagicIDPSNetworkAnalyticsAdaptiveGroupsSum
Field | Description |
---|---|
bits | Sum of bits received |
packets | Sum of packets received |
AccountMagicTransitNetworkAnalyticsAdaptiveGroups
Network analytics data for Magic Transit traffic
Field | Description |
---|---|
avg | The average of values for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountMagicTransitNetworkAnalyticsAdaptiveGroupsAvg
Field | Description |
---|---|
bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountMagicTransitNetworkAnalyticsAdaptiveGroupsDimensions
Field | Description |
---|---|
applicationTag | Application tag associated with the packet |
coloCity | City where the Cloudflare datacenter that received the packet is located |
coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
coloName | Cloudflare datacenter that received the packet (unique site identifier) |
date | Date that the packet was received |
datetime | Date and time that the packet was received |
datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
egressTunnelID | GRE or IPSec Egress Tunnel ID for Magic WAN and Magic Transit traffic |
egressTunnelName | GRE or IPSec Egress Tunnel name for Magic WAN and Magic Transit traffic |
ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
greChecksum | Value of the Checkusm header field in the GRE packet |
greEthertype | Value of the Ethertype header field in the GRE packet |
greHeaderLength | Length of the GRE packet header, in bytes |
greKey | Value of the Key header field in the GRE packet |
greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
greVersion | Value of the Version header field in the GRE packet |
icmpChecksum | Value of the Checkusm header field in the ICMP packet |
icmpCode | Value of the Code header field in the ICMP packet |
icmpType | Value of the Type header field in the ICMP packet |
ingressTunnelID | GRE or IPSec Ingress Tunnel ID for Magic WAN and Magic Transit traffic |
ingressTunnelName | GRE or IPSec Ingress Tunnel name for Magic WAN and Magic Transit traffic |
ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
ipv4Identification | Value of the Identification header field in the IPv4 packet |
ipv4Options | List of Options numbers included in the IPv4 packet header |
ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
leaseTag | IP lease tag associated with the packet |
mitigationSystem | Which system dropped the packet (possible values: dosd, flowtrackd, magic-firewall) |
offRamp | Offramp method for Magic WAN and Magic Transit traffic - GRE, IPSec, CNI, Warp, Cloudflared |
onRamp | Onramp method for Magic WAN and Magic Transit traffic - GRE, IPSec, CNI, Warp, Cloudflared |
outcome | The action that was taken on the packet (possible values: pass, drop) |
prefixTag | IP prefix tag associated with the packet |
sampleInterval | ABR sample interval |
sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
sourcePort | Value of the Source Port header field in the TCP or UDP packet |
tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
tcpChecksum | Value of the Checkusm header field in the TCP packet |
tcpDataOffset | Value of the Data Offset header field in the TCP packet |
tcpFlags | Value of the Flags header field in the TCP packet |
tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
tcpMss | Value of the MSS option header field in the TCP packet |
tcpOptions | List of Options numbers included in the TCP packet header |
tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
tcpWindowSize | Value of the Window Size header field in the TCP packet |
trafficType | Custom protocol or traffic type for Magic Wan and Magic Transit traffic - Unidirectional and Bidirectional Tunnel Health Check |
udpChecksum | Value of the Checkusm header field in the UDP packet |
udpPayloadLength | Value of the Payload Length header field in the UDP packet |
AccountMagicTransitNetworkAnalyticsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountMagicTransitNetworkAnalyticsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountMagicTransitNetworkAnalyticsAdaptiveGroupsSum
Field | Description |
---|---|
bits | Sum of bits received |
packets | Sum of packets received |
AccountMagicTransitTunnelHealthChecksAdaptiveGroups
Beta. Magic Transit Health check results for customer GRE Tunnels with adaptive sampling (ABR).
Field | Description |
---|---|
avg | |
count | Total number of healthcheck results |
dimensions | List of dimensions to group by |
AccountMagicTransitTunnelHealthChecksAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval | Average sample interval per dimension |
tunnelState | Combined Tunnel State aggregated from multiple results. 0 is down, 0.5 is degraded and 1 is healthy |
AccountMagicTransitTunnelHealthChecksAdaptiveGroupsDimensions
Field | Description |
---|---|
active | Returns 1 if the colo had traffic for this tunnel in the last 6 hours, otherwise 0 |
datetime | The time the healthcheck request was sent |
datetimeFifteenMinutes | The time the healthcheck request was sent, truncated to multiple of 15 minutes |
datetimeFiveMinutes | The time the healthcheck request was sent, truncated to multiple of 5 minutes |
datetimeHalfOfHour | The time the healthcheck request was sent, truncated to multiple of 30 minutes |
datetimeHour | The time the healthcheck request was sent, truncated to the hour |
datetimeMinute | The time the healthcheck request was sent, truncated to the last minute |
edgeColoCity | City of the Cloudflare datacenter from where the healthcheck was run |
edgeColoCode | IATA airport code of the Cloudflare datacenter from where the healthcheck was run |
edgeColoCountry | Country of the Cloudflare datacenter from where the healthcheck was run |
edgeColoName | The name of the Cloudflare datacenter from where the healthcheck was run |
edgeColoRegion | Region of the Cloudflare datacenter from where the healthcheck was run |
edgePopName | The name of the Cloudflare POP from where the healthcheck was run |
remoteTunnelIPv4 | IP address of the remote end of the tunnel |
resultStatus | The status of the request |
siteName | Human friendly site name associated with the tunnel |
tunnelName | Human friendly tunnel name |
AccountMagicTransitTunnelHealthChecksAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountMagicTransitTunnelTrafficAdaptiveGroups
Bandwidth usage metric of a Magic Transit tunnel.
Field | Description |
---|---|
avg | The average of values for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountMagicTransitTunnelTrafficAdaptiveGroupsAvg
Field | Description |
---|---|
bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountMagicTransitTunnelTrafficAdaptiveGroupsDimensions
Field | Description |
---|---|
date | Date that the packet was received |
datetime | Date and time that the packet was received |
datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
edgeColoCity | City where the Cloudflare datacenter that received the packet is located |
edgeColoCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
edgeColoCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
edgeColoGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
edgeColoName | Cloudflare datacenter that received the packet (unique site identifier) |
edgePopName | Cloudflare PoP that received the packet (unique site identifier) |
egressTunnelID | GRE, IPSec or CNI Egress Tunnel ID for Magic WAN and Magic Transit traffic |
egressTunnelName | GRE, IPSec or CNIec Egress Tunnel name for Magic WAN and Magic Transit traffic |
ingressTunnelID | GRE, IPSec or CNI Ingress Tunnel ID for Magic WAN and Magic Transit traffic |
ingressTunnelName | GRE, IPSec or CNI Ingress Tunnel name for Magic WAN and Magic Transit traffic |
tunnelName | Tunnel device name |
AccountMagicTransitTunnelTrafficAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountMagicTransitTunnelTrafficAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountMagicTransitTunnelTrafficAdaptiveGroupsSum
Field | Description |
---|---|
bits | Sum of bits received |
packets | Sum of packets received |
AccountMagicWANConnectorMetricsAdaptiveGroups
Beta. Magic WAN Connector Metrics
Field | Description |
---|---|
avg | |
dimensions | List of dimensions to group by |
max |
AccountMagicWANConnectorMetricsAdaptiveGroupsAvg
Field | Description |
---|---|
cpuLoadPercentage | Average CPU load percentage |
cpuTemperature | Average CPU temperature |
diskUsagePercentage | Average Disk usage percentage |
memoryUsagePercentage | Average Memory usage percentage |
rxBitrateFiveMinute | Rx Bitrate over 5 minutes |
rxBitrateMinute | Rx Bitrate over 1 minute |
rxPacketrateFiveMinute | Rx Packet rate over 5 minutes |
rxPacketrateMinute | Rx Packet rate over 1 minute |
txBitrateFiveMinute | Tx Bitrate over 5 minutes |
txBitrateMinute | Tx Bitrate over 1 minute |
txPacketrateFiveMinute | Tx Packet rate over 5 minutes |
txPacketrateMinute | Tx Packet rate over 1 minute |
AccountMagicWANConnectorMetricsAdaptiveGroupsDimensions
Field | Description |
---|---|
datetime | The date and time the event was recorded |
datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
mconnInterfaceName | Name of connector interface |
mconnInterfaceType | Interface type LAN, WAN or IPSEC |
mconnSiteID | Customer site identifier |
AccountMagicWANConnectorMetricsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountMagicWANConnectorMetricsAdaptiveGroupsMax
Field | Description |
---|---|
interfaceCount | Number of interfaces of a given Type |
AccountMagicWANConnectorMetricsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountMnmFlowDataAdaptiveGroups
Flow data collected through Magic Network Monitoring
Field | Description |
---|---|
avg | The average of values for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountMnmFlowDataAdaptiveGroupsAvg
Field | Description |
---|---|
bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
egressBitRate | Sum of egress bits received, divided by 1 second, providing a per-second egress bit rate when grouped by datetime |
egressBitRateDay | Sum of egress bits received, divided by 86400 seconds, providing a per-second egress bit rate when grouped by date |
egressBitRateFifteenMinutes | Sum of egress bits received, divided by 900 seconds, providing a per-second egress bit rate when grouped by datetimeFifteenMinutes |
egressBitRateFiveMinutes | Sum of egress bits received, divided by 300 seconds, providing a per-second egress bit rate when grouped by datetimeFiveMinutes |
egressBitRateHour | Sum of egress bits received, divided by 3600 seconds, providing a per-second egress bit rate when grouped by datetimeHour |
egressBitRateMinute | Sum of egress bits received, divided by 60 seconds, providing a per-second egress bit rate when grouped by datetimeMinute |
egressBitRateTenSeconds | Sum of egress bits received, divided by 10 seconds, providing a per-second egress bit rate when grouped by datetimeTenSeconds |
egressPacketRate | Sum of egress packets received, divided by 1 second, providing a per-second egress packet rate when grouped by datetime |
egressPacketRateDay | Sum of egress packets received, divided by 86400 seconds, providing a per-second egress packet rate when grouped by date |
egressPacketRateFifteenMinutes | Sum of egress packets received, divided by 900 seconds, providing a per-second egress packet rate when grouped by datetimeFifteenMinutes |
egressPacketRateFiveMinutes | Sum of egress packets received, divided by 300 seconds, providing a per-second egress packet rate when grouped by datetimeFiveMinutes |
egressPacketRateHour | Sum of egress packets received, divided by 3600 seconds, providing a per-second egress packet rate when grouped by datetimeHour |
egressPacketRateMinute | Sum of egress packets received, divided by 60 seconds, providing a per-second egress packet rate when grouped by datetimeMinute |
egressPacketRateTenSeconds | Sum of egress packets received, divided by 10 seconds, providing a per-second egress packet rate when grouped by datetimeTenSeconds |
packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
sampleInterval | Average sample interval applied to the data |
AccountMnmFlowDataAdaptiveGroupsDimensions
Field | Description |
---|---|
date | Date that the packet was received |
datetime | Date and time that the packet was received |
datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
destinationAS | Autonomous System to which the data is directed. Corresponds to DstAS field in the packet |
destinationAddress | IP to which the data was sent |
destinationPort | Value of the Destination Port header field in the packet |
ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
protocol | Layer 4 protocol |
protocolString | Human-readable string representation of the protocol |
routerAddress | IP of the router that sampled the flows |
ruleIDs | List of flow matching rules |
sourceAS | Autonomous System from which the data was sent. Corresponds to SrcAS field in the packet |
sourceAddress | IP from which the data was sent |
sourcePort | Value of the Source Port header field in the packet |
tcpFlags | Value of the Flags header field in the TCP packet |
tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
version | Version of the record schema |
AccountMnmFlowDataAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountMnmFlowDataAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountMnmFlowDataAdaptiveGroupsSum
Field | Description |
---|---|
bits | Sum of bits |
egressBits | Sum of egress bits |
egressPackets | Sum of egress packets |
packets | Sum of packets |
AccountNelReportsAdaptiveGroups
Data to visualize network error logs
Field | Description |
---|---|
avg | |
count | The number of NEL Reports |
dimensions | List of dimensions to group by |
AccountNelReportsAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval | Average sample interval |
AccountNelReportsAdaptiveGroupsDimensions
Field | Description |
---|---|
clientIPASN | Client ASN |
clientIPASNDescription | Client ASN Description |
clientIPCountry | Client Country |
clientIPCountryCode | 2 letter client country code using ISO 3166-1 alpha-2 syntax |
clientIPVersion | IP Version the client used to connect |
date | Request date from browser |
datetime | Request datetime from browser |
datetimeFifteenMinutes | Request datetime from browser, truncated to multiple of 15 minutes |
datetimeFiveMinutes | Request datetime from browser, truncated to multiple of 5 minutes |
datetimeHalfOfHour | Request datetime from browser, truncated to multiple of 30 minutes |
datetimeHour | Request datetime from browser, truncated to the hour |
datetimeMinute | Request datetime from browser, truncated to the minute |
lastKnownGoodColoCode | IATA airport code of colo the client connected to |
phase | The phase of connection the error occurred in |
protocol | HTTP Protocol used when the error occured |
type | The type of error in the phase |
AccountNelReportsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountNelReportsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountOhttpMetricsAdaptive
oHTTP request metrics with adaptive sampling
Field | Description |
---|---|
bytesToClient | Bytes returned to client |
bytesToGateway | Total bytes received from the client |
colo | The airport code of the Cloudflare datacenter that served this request |
datetime | The date and time the event was recorded |
gatewayStatusCode | The status code returned by the gateway |
relayStatusCode | The status code returned by the relay |
AccountOhttpMetricsAdaptiveFilter_InputObject
Field | Description |
---|---|
AccountOhttpMetricsAdaptiveGroups
Aggregated oHTTP request metrics with adaptive sampling
Field | Description |
---|---|
count | |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountOhttpMetricsAdaptiveGroupsDimensions
Field | Description |
---|---|
colo | The airport code of the Cloudflare datacenter that served this request |
date | Ohttp requests metrics date |
datetimeFifteenMinutes | Ohttp requests metrics timestamp, truncated to fifteen minutes |
datetimeFiveMinutes | Ohttp requests metrics timestamp, truncated to five minutes |
datetimeHour | Ohttp requests metrics timestamp, truncated to the hour |
datetimeMinute | Ohttp requests metrics timestamp, truncated to the minute |
endpoint | The appId that generated traffic |
gatewayStatusCode | Status code returned by the gateway |
relayStatusCode | Status code returned by the relay |
AccountOhttpMetricsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountOhttpMetricsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountOhttpMetricsAdaptiveGroupsSum
Field | Description |
---|---|
bytesToClient | The total bytes sent from gateway to client, observed over the queried time period |
bytesToGateway | The total bytes from client to gateway, observed over the queried time period |
clientRequestErrors | The total number of client request errors, observed over the queried time period |
gatewayResponseErrors | The total number of gateway response errors, observed over the queried time period |
AccountOhttpMetricsAdaptiveOrderBy
Field | Description |
---|---|
AccountPagesFunctionsInvocationsAdaptiveGroups
Pages Functions invocations with adaptive sampling
Field | Description |
---|---|
avg | |
dimensions | List of dimensions to group by |
quantiles | Quantiles of a metric per dimension |
sum | The sum of values for a metric per dimension |
AccountPagesFunctionsInvocationsAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval | Average sample interval |
AccountPagesFunctionsInvocationsAdaptiveGroupsDimensions
Field | Description |
---|---|
date | Request datetime, truncated to start of a day |
datetime | Request datetime |
datetimeHour | Request datetime, truncated to start of an hour |
datetimeMinute | Request datetime, truncated to start of an minute |
scriptName | The name of the script |
status | Status of the worker invocation |
usageModel | Usage model of the worker invocation |
AccountPagesFunctionsInvocationsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountPagesFunctionsInvocationsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountPagesFunctionsInvocationsAdaptiveGroupsQuantiles
Field | Description |
---|---|
cpuTimeP50 | CPU time 50th percentile - microseconds |
cpuTimeP75 | CPU time 75th percentile - microseconds |
cpuTimeP99 | CPU time 99th percentile - microseconds |
cpuTimeP999 | CPU time 99.9th percentile - microseconds |
durationP50 | Duration 50th percentile - GB*s |
durationP75 | Duration 75th percentile - GB*s |
durationP99 | Duration 99th percentile - GB*s |
durationP999 | Duration 99.9th percentile - GB*s |
AccountPagesFunctionsInvocationsAdaptiveGroupsSum
Field | Description |
---|---|
clientDisconnects | Sum of client disconnects |
duration | Sum of Duration - GB*s |
errors | Sum of Errors |
requests | Sum of Requests |
responseBodySize | Sum of Response Body Sizes |
subrequests | Sum of Subrequests |
wallTime | Sum of Wall Time |
AccountQueueBacklogAdaptiveGroups
Beta. Queue backlog data with adaptive sampling. Queues that are not being written to, or read from, will not return data, even if they have a backlog.
Field | Description |
---|---|
avg | The average value for a metric per dimension |
dimensions | List of dimensions to group by |
AccountQueueBacklogAdaptiveGroupsAvg
Field | Description |
---|---|
bytes | The average size of the backlog in bytes for sample interval |
messages | The average number of messages in the backlog for sample interval |
sampleInterval | The average value used for sample interval |
AccountQueueBacklogAdaptiveGroupsDimensions
Field | Description |
---|---|
date | Message operation timestamp, truncated to start of a day |
datetime | Message operation timestamp |
datetimeHour | Message operation timestamp, truncated to start of an hour |
datetimeMinute | Message operation timestamp, truncated to start of an minute |
queueId | The ID of the Queue |
AccountQueueBacklogAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountQueueBacklogAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountQueueConsumerMetricsAdaptiveGroups
Beta. Queue consumer metrics with adaptive sampling. Inactive queues will not return data.
Field | Description |
---|---|
avg | The average value for a metric per dimension |
dimensions | List of dimensions to group by |
AccountQueueConsumerMetricsAdaptiveGroupsAvg
Field | Description |
---|---|
concurrency | The average concurrency of the queue |
sampleInterval | The average value used for sample interval |
AccountQueueConsumerMetricsAdaptiveGroupsDimensions
Field | Description |
---|---|
date | Consumer metric timestamp, truncated to start of a day |
datetime | Consumer metric timestamp |
datetimeHour | Consumer metric timestamp, truncated to start of an hour |
datetimeMinute | Consumer metric timestamp, truncated to start of an minute |
queueId | The ID of the Queue |
AccountQueueConsumerMetricsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountQueueConsumerMetricsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountQueueDelayedBacklogAdaptiveGroups
Beta. Queue delayed backlog data with adaptive sampling. Queues that are not being written to, or read from, will not return data, even if they have a backlog.
Field | Description |
---|---|
avg | The average value for a metric per dimension |
dimensions | List of dimensions to group by |
AccountQueueDelayedBacklogAdaptiveGroupsAvg
Field | Description |
---|---|
messages | The average number of messages in the delayed backlog for sample interval |
sampleInterval | The average value used for sample interval |
AccountQueueDelayedBacklogAdaptiveGroupsDimensions
Field | Description |
---|---|
date | Message operation timestamp, truncated to start of a day |
datetime | Message operation timestamp |
datetimeHour | Message operation timestamp, truncated to start of an hour |
datetimeMinute | Message operation timestamp, truncated to start of an minute |
queueId | The ID of the Queue |
AccountQueueDelayedBacklogAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountQueueDelayedBacklogAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountQueueMessageOperationsAdaptiveGroups
Beta. Queue message operation data with adaptive sampling
Field | Description |
---|---|
avg | The average value for a metric per dimension |
count | Number of Message Operations |
dimensions | List of dimensions to group by |
max | The max of values for a metric per dimension |
sum | The sum of values for a metric per dimension |
AccountQueueMessageOperationsAdaptiveGroupsAvg
Field | Description |
---|---|
lagTime | The average time in milliseconds between when the message was written to the queue and the current operation over the sample interval. Will always be 0 for WriteMessage operations. |
retryCount | The average number of retries per message operation. A retry occurs after an unsucessful delivery, if the queue is configured to retry failed attempts. Only applicable to ReadMessage and DeleteMessage operations. Will always be 0 for WriteMessage operations. |
sampleInterval | The average value used for sample interval |
AccountQueueMessageOperationsAdaptiveGroupsDimensions
Field | Description |
---|---|
actionType | The type of the Queue message operation |
consumerType | The queue consumer type for the operation. Only applicable for ReadMessage and DeleteMessge action types. |
date | Message operation timestamp, truncated to start of a day |
datetime | Message operation timestamp |
datetimeHour | Message operation timestamp, truncated to start of an hour |
datetimeMinute | Message operation timestamp, truncated to start of an minute |
outcome | The outcome of the operation. Only applicable to DeleteMessage action types. Can be 'success', 'dlq', or 'fail'. Always 'none' for other operations. |
queueId | The ID of the Queue |
AccountQueueMessageOperationsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountQueueMessageOperationsAdaptiveGroupsMax
Field | Description |
---|---|
messageSize | Max Message Size |
AccountQueueMessageOperationsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountQueueMessageOperationsAdaptiveGroupsSum
Field | Description |
---|---|
billableOperations | Number of Billable Operations (some message operations count as multiple billable operations) |
bytes | Total size (in bytes) of message operations |
AccountR2OperationsAdaptiveGroups
Beta. R2 operations with adaptive sampling
Field | Description |
---|---|
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountR2OperationsAdaptiveGroupsDimensions
Field | Description |
---|---|
actionStatus | Status of the R2 operation |
actionType | The name of the R2 operation |
bucketName | The name of the R2 bucket, if applicable to this request |
date | Request timestamp, truncated to start of a day |
datetime | Request timestamp |
datetimeHour | Request timestamp, truncated to start of an hour |
datetimeMinute | Request timestamp, truncated to start of an minute |
objectName | The name of the R2 object, if applicable to this request |
responseStatusCode | HTTP status code returned by R2 |
storageClass | The storage class that applies to this request |
AccountR2OperationsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountR2OperationsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountR2OperationsAdaptiveGroupsSum
Field | Description |
---|---|
requests | Sum of Requests |
responseBytes | Sum of retrieved bytes |
responseObjectSize | Sum of Response Object Sizes |
AccountR2StorageAdaptiveGroups
Beta. R2 storage with adaptive sampling
Field | Description |
---|---|
dimensions | List of dimensions to group by |
max | The max of values for a metric per dimension |
AccountR2StorageAdaptiveGroupsDimensions
Field | Description |
---|---|
bucketName | The name of the R2 bucket, if applicable to this request |
date | Storage sample timestamp, truncated to start of a day |
datetime | Storage sample timestamp |
datetimeHour | Storage sample timestamp, truncated to start of an hour |
datetimeMinute | Storage sample timestamp, truncated to start of an minute |
storageClass | The storage class that applies to this request |
AccountR2StorageAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountR2StorageAdaptiveGroupsMax
Field | Description |
---|---|
metadataSize | Max of metadata size |
objectCount | Max of object count |
payloadSize | Max of payload size |
uploadCount | Max of upload count |
AccountR2StorageAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountRumPageloadEventsAdaptiveGroups
Beta. Aggregated RUM pageload event metrics with adaptive sampling
Field | Description |
---|---|
avg | |
count | The number of pages viewed by end-users |
dimensions | List of dimensions to group by |
sum |
AccountRumPageloadEventsAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval | Average sample interval |
AccountRumPageloadEventsAdaptiveGroupsDimensions
Field | Description |
---|---|
bot | Indicates if the request is likely from a bot (non-human traffic). Returns 1 if from a bot, 0 otherwise. |
countryName | Client country ISO 3166 alpha2 code |
customTagInternalSxg | Signed Exchange enabled status |
date | Request date from browser |
datetimeFifteenMinutes | Request datetime from browser, truncated to multiple of 15 minutes |
datetimeFiveMinutes | Request datetime from browser, truncated to multiple of 5 minutes |
datetimeHalfOfHour | Request datetime from browser, truncated to multiple of 30 minutes |
datetimeHour | Request datetime from browser, truncated to the hour |
datetimeMinute | Request datetime from browser, truncated to the minute |
deviceType | Device type used for view the page |
refererHost | Host of the HTTP request referer |
refererPath | Path of the HTTP request referer |
refererScheme | Scheme of the HTTP request referer (http or https) |
requestHost | HTTP Host of the web page URL |
requestPath | Path of the web page URL |
requestScheme | Scheme of the web page URL (http or https) |
siteTag | The key value to identify a site |
userAgentBrowser | Browser parsed from the user agent |
userAgentOS | OS parsed from the user agent |
AccountRumPageloadEventsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountRumPageloadEventsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountRumPageloadEventsAdaptiveGroupsSum
Field | Description |
---|---|
visits | The number of pages viewed by end-users that were initiated from a different website (i.e. where the Document.referrer does not match the hostname) |
AccountRumPerformanceEventsAdaptiveGroups
Beta. Aggregated RUM performance event metrics with adaptive sampling
Field | Description |
---|---|
avg | |
count | The number of pages viewed by end-users |
dimensions | List of dimensions to group by |
quantiles | |
sum |
AccountRumPerformanceEventsAdaptiveGroupsAvg
Field | Description |
---|---|
connectionTime | Connection time |
dnsTime | Domain lookup time |
firstContentfulPaint | The time when the first content piece from the DOM is painted (i.e. some text or an image) |
firstPaint | The time when the first pixel is painted onto the screen (i.e. background of the page) |
loadEventTime | The time taken for the load event |
pageLoadTime | The time to download and display the entire content of a web page in the browser window |
pageRenderTime | The time to download and display the entire content of a web page in the browser window |
requestTime | The time between initiating the request and receiving the first byte of the response |
responseTime | The time between receiving the first byte and the last byte of the response |
sampleInterval | Average sample interval |
AccountRumPerformanceEventsAdaptiveGroupsDimensions
Field | Description |
---|---|
bot | Indicates if the request is likely from a bot (non-human traffic). Returns 1 if from a bot, 0 otherwise. |
countryName | Client country ISO 3166 alpha2 code |
customTagInternalSxg | Signed Exchange enabled status |
date | Request date from browser |
datetimeFifteenMinutes | Request datetime from browser, truncated to multiple of 15 minutes |
datetimeFiveMinutes | Request datetime from browser, truncated to multiple of 5 minutes |
datetimeHalfOfHour | Request datetime from browser, truncated to multiple of 30 minutes |
datetimeHour | Request datetime from browser, truncated to the hour |
datetimeMinute | Request datetime from browser, truncated to the minute |
deviceType | Device type used for view the page |
refererHost | Host of the HTTP request referer |
refererPath | Path of the HTTP request referer |
refererScheme | Scheme of the HTTP request referer (http or https) |
requestHost | HTTP Host of the web page URL |
requestPath | Path of the web page URL |
requestScheme | Scheme of the web page URL (http or https) |
siteTag | The key value to identify a site |
userAgentBrowser | Browser parsed from the user agent |
userAgentOS | OS parsed from the user agent |
AccountRumPerformanceEventsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountRumPerformanceEventsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountRumPerformanceEventsAdaptiveGroupsQuantiles
Field | Description |
---|---|
connectionTimeP50 | Connection time |
connectionTimeP75 | Connection time |
connectionTimeP90 | Connection time |
connectionTimeP99 | Connection time |
dnsTimeP50 | Domain lookup time |
dnsTimeP75 | Domain lookup time |
dnsTimeP90 | Domain lookup time |
dnsTimeP99 | Domain lookup time |
firstContentfulPaintP50 | The time when the first content piece from the DOM is painted (i.e. some text or an image) |
firstContentfulPaintP75 | The time when the first content piece from the DOM is painted (i.e. some text or an image) |
firstContentfulPaintP90 | The time when the first content piece from the DOM is painted (i.e. some text or an image) |
firstContentfulPaintP99 | The time when the first content piece from the DOM is painted (i.e. some text or an image) |
firstPaintP50 | The time when the first pixel is painted onto the screen (i.e. background of the page) |
firstPaintP75 | The time when the first pixel is painted onto the screen (i.e. background of the page) |
firstPaintP90 | The time when the first pixel is painted onto the screen (i.e. background of the page) |
firstPaintP99 | The time when the first pixel is painted onto the screen (i.e. background of the page) |
loadEventTimeP50 | The time taken for the load event |
loadEventTimeP75 | The time taken for the load event |
loadEventTimeP90 | The time taken for the load event |
loadEventTimeP99 | The time taken for the load event |
pageLoadTimeP50 | The time to download and display the entire content of a web page in the browser window |
pageLoadTimeP75 | The time to download and display the entire content of a web page in the browser window |
pageLoadTimeP90 | The time to download and display the entire content of a web page in the browser window |
pageLoadTimeP99 | The time to download and display the entire content of a web page in the browser window |
pageRenderTimeP50 | The time to download and display the entire content of a web page in the browser window |
pageRenderTimeP75 | The time to download and display the entire content of a web page in the browser window |
pageRenderTimeP90 | The time to download and display the entire content of a web page in the browser window |
pageRenderTimeP99 | The time to download and display the entire content of a web page in the browser window |
requestTimeP50 | The time between initiating the request and receiving the first byte of the response |
requestTimeP75 | The time between initiating the request and receiving the first byte of the response |
requestTimeP90 | The time between initiating the request and receiving the first byte of the response |
requestTimeP99 | The time between initiating the request and receiving the first byte of the response |
responseTimeP50 | The time between receiving the first byte and the last byte of the response |
responseTimeP75 | The time between receiving the first byte and the last byte of the response |
responseTimeP90 | The time between receiving the first byte and the last byte of the response |
responseTimeP99 | The time between receiving the first byte and the last byte of the response |
AccountRumPerformanceEventsAdaptiveGroupsSum
Field | Description |
---|---|
visits | The number of pages viewed by end-users that were initiated from a different website (i.e. where the Document.referrer does not match the hostname) |
AccountRumWebVitalsEventsAdaptive
Beta. RUM Web Vitals event metrics with adaptive sampling
Field | Description |
---|---|
bot | Indicates if the request is likely from a bot (non-human traffic). Returns 1 if from a bot, 0 otherwise. |
countryName | Client country ISO 3166 alpha2 code |
cumulativeLayoutShift | Cumulative Layout Shift (Core Web Vitals) (-1 indicates N/A) |
cumulativeLayoutShiftCurrentRect | Layout values of the rectangular area after the changes |
cumulativeLayoutShiftElement | DOM selector name of the largest layout shift |
cumulativeLayoutShiftPath | Observed path of the Cumulative Layout Shift (Core Web Vitals) |
cumulativeLayoutShiftPreviousRect | Layout values of the rectangular area before the changes |
customTagInternalSxg | Signed Exchange enabled status |
date | Request date from browser |
datetime | Request datetime from browser |
datetimeFifteenMinutes | Request datetime from browser, truncated to multiple of 15 minutes |
datetimeFiveMinutes | Request datetime from browser, truncated to multiple of 5 minutes |
datetimeHalfOfHour | Request datetime from browser, truncated to multiple of 30 minutes |
datetimeHour | Request datetime from browser, truncated to the hour |
datetimeMinute | Request datetime from browser, truncated to the minute |
deviceType | Device type used for view the page |
refererHost | Host of the HTTP request referer |
refererPath | Path of the HTTP request referer |
refererScheme | Scheme of the HTTP request referer (http or https) |
requestHost | HTTP Host of the web page URL |
requestPath | Path of the web page URL |
requestScheme | Scheme of the web page URL (http or https) |
sampleInterval | ABR sample interval |
siteTag | The key value to identify a site |
userAgentBrowser | Browser parsed from the user agent |
userAgentOS | OS parsed from the user agent |
AccountRumWebVitalsEventsAdaptiveFilter_InputObject
Field | Description |
---|---|
AccountRumWebVitalsEventsAdaptiveGroups
Beta. Aggregated RUM Web Vitals event metrics with adaptive sampling
Field | Description |
---|---|
avg | |
count | The number of pages viewed by end-users |
dimensions | List of dimensions to group by |
quantiles | |
sum |
AccountRumWebVitalsEventsAdaptiveGroupsAvg
Field | Description |
---|---|
cumulativeLayoutShift | Cumulative Layout Shift (Core Web Vitals) (negative value indicates N/A) |
firstContentfulPaint | First Contentful Paint in microseconds (negative value indicates N/A) |
firstInputDelay | First Input Delay (Core Web Vitals) in microseconds (negative value indicates N/A) |
interactionToNextPaint | Interaction to Next Paint in microseconds (negative value indicates N/A) |
largestContentfulPaint | Largest Contentful Paint (Core Web Vitals) in microseconds (negative value indicates N/A) |
lcpElementRenderDelay | Largest Contentful Paint Attributions Element Render Delay in microseconds (negative value indicates N/A) |
lcpResourceLoadDelay | Largest Contentful Paint Attributions Resource Load Delay in microseconds (negative value indicates N/A) |
lcpResourceLoadTime | Largest Contentful Paint Attributions Resource Load Time in microseconds (negative value indicates N/A) |
sampleInterval | Average sample interval |
timeToFirstByte | Time to First Byte in microseconds (negative value indicates N/A) |
AccountRumWebVitalsEventsAdaptiveGroupsDimensions
Field | Description |
---|---|
bot | Indicates if the request is likely from a bot (non-human traffic). Returns 1 if from a bot, 0 otherwise. |
countryName | Client country ISO 3166 alpha2 code |
cumulativeLayoutShiftElement | DOM selector name of the largest layout shift |
cumulativeLayoutShiftPath | Observed path of the Cumulative Layout Shift (Core Web Vitals) |
customTagInternalSxg | Signed Exchange enabled status |
date | Request date from browser |
datetimeFifteenMinutes | Request datetime from browser, truncated to multiple of 15 minutes |
datetimeFiveMinutes | Request datetime from browser, truncated to multiple of 5 minutes |
datetimeHalfOfHour | Request datetime from browser, truncated to multiple of 30 minutes |
datetimeHour | Request datetime from browser, truncated to the hour |
datetimeMinute | Request datetime from browser, truncated to the minute |
deviceType | Device type used for view the page |
firstInputDelayElement | DOM selector name of the input delay |
firstInputDelayName | Action name of the input delay |
firstInputDelayPath | Observed path of the First Input Delay (Core Web Vitals) |
largestContentfulPaintElement | DOM selector name of the largest object |
largestContentfulPaintObjectHost | Host of the largest object |
largestContentfulPaintObjectPath | Path of the largest object |
largestContentfulPaintObjectScheme | Scheme of the largest object (http or https) |
largestContentfulPaintPath | Observed path of the Largest Contentful Paint (Core Web Vitals) |
lcpFetchPriority | Fetch priority of the LCP element. |
lcpInitiatorType | Initiator type of the LCP element. |
refererHost | Host of the HTTP request referer |
refererPath | Path of the HTTP request referer |
refererScheme | Scheme of the HTTP request referer (http or https) |
requestHost | HTTP Host of the web page URL |
requestPath | Path of the web page URL |
requestScheme | Scheme of the web page URL (http or https) |
siteTag | The key value to identify a site |
userAgentBrowser | Browser parsed from the user agent |
userAgentOS | OS parsed from the user agent |
AccountRumWebVitalsEventsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountRumWebVitalsEventsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountRumWebVitalsEventsAdaptiveGroupsQuantiles
Field | Description |
---|---|
cumulativeLayoutShiftP50 | Cumulative Layout Shift (Core Web Vitals) (negative value indicates N/A) |
cumulativeLayoutShiftP75 | Cumulative Layout Shift (Core Web Vitals) (negative value indicates N/A) |
cumulativeLayoutShiftP90 | Cumulative Layout Shift (Core Web Vitals) (negative value indicates N/A) |
cumulativeLayoutShiftP99 | Cumulative Layout Shift (Core Web Vitals) (negative value indicates N/A) |
firstContentfulPaintP50 | First Contentful Paint in microseconds (negative value indicates N/A) |
firstContentfulPaintP75 | First Contentful Paint in microseconds (negative value indicates N/A) |
firstContentfulPaintP90 | First Contentful Paint in microseconds (negative value indicates N/A) |
firstContentfulPaintP99 | First Contentful Paint in microseconds (negative value indicates N/A) |
firstInputDelayP50 | First Input Delay (Core Web Vitals) in microseconds (negative value indicates N/A) |
firstInputDelayP75 | First Input Delay (Core Web Vitals) in microseconds (negative value indicates N/A) |
firstInputDelayP90 | First Input Delay (Core Web Vitals) in microseconds (negative value indicates N/A) |
firstInputDelayP99 | First Input Delay (Core Web Vitals) in microseconds (negative value indicates N/A) |
interactionToNextPaintP50 | Interaction to Next Paint in microseconds (negative value indicates N/A) |
interactionToNextPaintP75 | Interaction to Next Paint in microseconds (negative value indicates N/A) |
interactionToNextPaintP90 | Interaction to Next Paint in microseconds (negative value indicates N/A) |
interactionToNextPaintP99 | Interaction to Next Paint in microseconds (negative value indicates N/A) |
largestContentfulPaintP50 | Largest Contentful Paint (Core Web Vitals) in microseconds (negative value indicates N/A) |
largestContentfulPaintP75 | Largest Contentful Paint (Core Web Vitals) in microseconds (negative value indicates N/A) |
largestContentfulPaintP90 | Largest Contentful Paint (Core Web Vitals) in microseconds (negative value indicates N/A) |
largestContentfulPaintP99 | Largest Contentful Paint (Core Web Vitals) in microseconds (negative value indicates N/A) |
lcpElementRenderDelayP50 | Largest Contentful Paint Attributions Element Render Delay in microseconds (negative value indicates N/A) |
lcpElementRenderDelayP75 | Largest Contentful Paint Attributions Element Render Delay in microseconds (negative value indicates N/A) |
lcpElementRenderDelayP90 | Largest Contentful Paint Attributions Element Render Delay in microseconds (negative value indicates N/A) |
lcpElementRenderDelayP99 | Largest Contentful Paint Attributions Element Render Delay in microseconds (negative value indicates N/A) |
lcpResourceLoadDelayP50 | Largest Contentful Paint Attributions Resource Load Delay in microseconds (negative value indicates N/A) |
lcpResourceLoadDelayP75 | Largest Contentful Paint Attributions Resource Load Delay in microseconds (negative value indicates N/A) |
lcpResourceLoadDelayP90 | Largest Contentful Paint Attributions Resource Load Delay in microseconds (negative value indicates N/A) |
lcpResourceLoadDelayP99 | Largest Contentful Paint Attributions Resource Load Delay in microseconds (negative value indicates N/A) |
lcpResourceLoadTimeP50 | Largest Contentful Paint Attributions Resource Load Time in microseconds (negative value indicates N/A) |
lcpResourceLoadTimeP75 | Largest Contentful Paint Attributions Resource Load Time in microseconds (negative value indicates N/A) |
lcpResourceLoadTimeP90 | Largest Contentful Paint Attributions Resource Load Time in microseconds (negative value indicates N/A) |
lcpResourceLoadTimeP99 | Largest Contentful Paint Attributions Resource Load Time in microseconds (negative value indicates N/A) |
timeToFirstByteP50 | Time to First Byte in microseconds (negative value indicates N/A) |
timeToFirstByteP75 | Time to First Byte in microseconds (negative value indicates N/A) |
timeToFirstByteP90 | Time to First Byte in microseconds (negative value indicates N/A) |
timeToFirstByteP99 | Time to First Byte in microseconds (negative value indicates N/A) |
AccountRumWebVitalsEventsAdaptiveGroupsSum
Field | Description |
---|---|
clsGood | Cumulative Layout Shift (Core Web Vitals), count of Good occurrences (under 0.1) |
clsNeedsImprovement | Cumulative Layout Shift (Core Web Vitals), count of Needs Improvement occurrences (between 0.1 and 0.25) |
clsPoor | Cumulative Layout Shift (Core Web Vitals), count of Poor occurrences (over 0.25) |
clsTotal | Cumulative Layout Shift (Core Web Vitals), total count |
fcpGood | First Contentful Paint, count of Good occurrences (under 1.8 s) |
fcpNeedsImprovement | First Contentful Paint, count of Needs Improvement occurrences (between 1.8 s and 3 s) |
fcpPoor | First Contentful Paint, count of Poor occurrences (over 3 s) |
fcpTotal | First Contentful Paint, total count |
fidGood | First Input Delay (Core Web Vitals), count of Good occurrences (under 100 ms) |
fidNeedsImprovement | First Input Delay (Core Web Vitals), count of Needs Improvement occurrences (between 100 ms and 300ms) |
fidPoor | First Input Delay (Core Web Vitals), count of Poor occurrences (over 300 ms) |
fidTotal | First Input Delay (Core Web Vitals), total count |
inpGood | Interaction to Next Paint, count of Good occurrences (under 200 ms) |
inpNeedsImprovement | Interaction to Next Paint, count of Needs Improvement occurrences (between 200 ms and 500ms) |
inpPoor | Interaction to Next Paint, count of Poor occurrences (over 500 ms) |
inpTotal | Interaction to Next Paint, total count |
lcpGood | Largest Contentful Paint (Core Web Vitals), count of Good occurrences (under 2.5 sec) |
lcpNeedsImprovement | Largest Contentful Paint (Core Web Vitals), count of Needs Improvement occurrences (between 2.5 sec and 4.0 sec) |
lcpPoor | Largest Contentful Paint (Core Web Vitals), count of Poor occurrences (over 4.0 sec) |
lcpTotal | Largest Contentful Paint (Core Web Vitals), total count |
ttfbGood | Time to First Byte, count of Good occurrences (under 800 ms) |
ttfbNeedsImprovement | Time to First Byte, count of Needs Improvement occurrences (between 800 ms and 1800ms) |
ttfbPoor | Time to First Byte, count of Poor occurrences (over 500 ms) |
ttfbTotal | Time to First Byte, total count |
visits | The number of pages viewed by end-users that were initiated from a different website (i.e. where the Document.referrer does not match the hostname) |
AccountRumWebVitalsEventsAdaptiveOrderBy
Field | Description |
---|---|
AccountSettings
Access and limitations for an account
Field | Description |
---|---|
MagicWANConnectorMetricsAdaptiveGroups | |
accessLoginRequestsAdaptiveGroups | |
advancedDnsProtectionNetworkAnalyticsAdaptiveGroups | |
advancedTcpProtectionNetworkAnalyticsAdaptiveGroups | |
aiGatewayCacheAdaptiveGroups | |
aiGatewayErrorsAdaptiveGroups | |
aiGatewayRequestsAdaptiveGroups | |
aiInferenceAdaptive | |
aiInferenceAdaptiveGroups | |
browserRenderingEventsAdaptive | |
browserRenderingEventsAdaptiveGroups | |
callsStatusAdaptive | |
callsTurnUsageAdaptiveGroups | |
callsUsageAdaptiveGroups | |
cdnNetworkAnalyticsAdaptiveGroups | |
d1AnalyticsAdaptiveGroups | |
d1QueriesAdaptiveGroups | |
d1StorageAdaptiveGroups | |
dosdAttackAnalyticsGroups | |
dosdNetworkAnalyticsAdaptiveGroups | |
durableObjectsInvocationsAdaptiveGroups | |
durableObjectsPeriodicGroups | |
durableObjectsStorageGroups | |
durableObjectsSubrequestsAdaptiveGroups | |
fbmAttackAnalyticsGroups | |
firewallEventsAdaptive | |
firewallEventsAdaptiveGroups | |
flowtrackdNetworkAnalyticsAdaptiveGroups | |
gatewayL4DownstreamSessionsAdaptiveGroups | |
gatewayL4SessionsAdaptiveGroups | |
gatewayL4UpstreamSessionsAdaptiveGroups | |
gatewayL7RequestsAdaptiveGroups | |
gatewayResolverByCategoryAdaptiveGroups | |
gatewayResolverByCustomResolverGroups | |
gatewayResolverByRuleExecutionPerformanceAdaptiveGroups | |
gatewayResolverQueriesAdaptiveGroups | |
httpRequests1dGroups | |
httpRequests1hGroups | |
httpRequests1mGroups | |
httpRequestsAdaptive | |
httpRequestsAdaptiveGroups | |
httpRequestsOverviewAdaptiveGroups | |
hyperdriveQueriesAdaptiveGroups | |
imagesRequestsAdaptiveGroups | |
imagesUniqueTransformations | |
kvOperationsAdaptiveGroups | |
kvStorageAdaptiveGroups | |
logpushHealthAdaptiveGroups | |
magicFirewallNetworkAnalyticsAdaptiveGroups | |
magicFirewallRateLimitNetworkAnalyticsAdaptiveGroups | |
magicFirewallSamplesAdaptiveGroups | |
magicIDPSNetworkAnalyticsAdaptiveGroups | |
magicTransitNetworkAnalyticsAdaptiveGroups | |
magicTransitTunnelHealthChecksAdaptiveGroups | |
magicTransitTunnelTrafficAdaptiveGroups | |
mnmFlowDataAdaptiveGroups | |
nelReportsAdaptiveGroups | |
ohttpMetricsAdaptive | |
ohttpMetricsAdaptiveGroups | |
pagesFunctionsInvocationsAdaptiveGroups | |
queueBacklogAdaptiveGroups | |
queueConsumerMetricsAdaptiveGroups | |
queueDelayedBacklogAdaptiveGroups | |
queueMessageOperationsAdaptiveGroups | |
r2OperationsAdaptiveGroups | |
r2StorageAdaptiveGroups | |
rumPageloadEventsAdaptiveGroups | |
rumPerformanceEventsAdaptiveGroups | |
rumWebVitalsEventsAdaptive | |
rumWebVitalsEventsAdaptiveGroups | |
sinkholeRequestLogsAdaptive | |
sinkholeRequestLogsAdaptiveGroups | |
sippyOperationsAdaptiveGroups | |
spectrumNetworkAnalyticsAdaptiveGroups | |
storageTraces | |
streamMinutesViewedAdaptiveGroups | |
turnstileAdaptiveGroups | |
vectorizeQueriesAdaptiveGroups | |
vectorizeStorageAdaptiveGroups | |
vectorizeV2OperationsAdaptiveGroups | |
vectorizeV2QueriesAdaptiveGroups | |
vectorizeV2StorageAdaptiveGroups | |
vectorizeV2WritesAdaptiveGroups | |
videoBufferEventsAdaptiveGroups | |
videoPlaybackEventsAdaptiveGroups | |
videoQualityEventsAdaptiveGroups | |
warpDeviceAdaptiveGroups | |
workerPlacementAdaptiveGroups | |
workersAnalyticsEngineAdaptiveGroups | |
workersInvocationsAdaptive | |
workersInvocationsScheduled | |
workersOverviewDataAdaptiveGroups | |
workersOverviewRequestsAdaptiveGroups | |
workersSubrequestsAdaptiveGroups | |
zarazTrackAdaptiveGroups | |
zarazTriggersAdaptiveGroups | |
zeroTrustPrivateNetworkDiscoveryGroups |
AccountSinkholeRequestLogsAdaptive
Sinkhole Request Logs
Field | Description |
---|---|
body | The request body |
datetime | The date and time the event was recorded |
destinationAddress | The destination IP address of the request |
headers | The request headers. If a header has multiple values, the values are comma separated. Each header is newline separated. |
host | The host the request was sent to |
method | The request method |
r2Path | The path to the object within the R2 bucket linked to this sinkhole that stores overflow body and header data. Blank if neither headers nor body was larger than 256 bytes. |
referrer | The referrer of the request |
sampleInterval | ABR sample interval |
sinkholeId | The ID of the sinkhole that logged the request |
sourceAddress | The sender's IP address |
uri | The request uri |
url | The request url |
userAgent | The request user agent |
AccountSinkholeRequestLogsAdaptiveFilter_InputObject
Field | Description |
---|---|
AccountSinkholeRequestLogsAdaptiveGroups
Sinkhole Request Logs
Field | Description |
---|---|
count | Number of requests logged |
dimensions | List of dimensions to group by |
AccountSinkholeRequestLogsAdaptiveGroupsDimensions
Field | Description |
---|---|
body | The request body |
datetime | The date and time the event was recorded |
destinationAddress | The destination IP address of the request |
headers | The request headers. If a header has multiple values, the values are comma separated. Each header is newline separated. |
host | The host the request was sent to |
method | The request method |
r2Path | The path to the object within the R2 bucket linked to this sinkhole that stores overflow body and header data. Blank if neither headers nor body was larger than 256 bytes. |
referrer | The referrer of the request |
sinkholeId | The ID of the sinkhole that logged the request |
sourceAddress | The sender's IP address |
uri | The request uri |
url | The request url |
userAgent | The request user agent |
AccountSinkholeRequestLogsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountSinkholeRequestLogsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountSinkholeRequestLogsAdaptiveOrderBy
Field | Description |
---|---|
AccountSippyOperationsAdaptiveGroups
Sippy operations with adaptive sampling
Field | Description |
---|---|
count | Total number of Sippy operations |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountSippyOperationsAdaptiveGroupsDimensions
Field | Description |
---|---|
action | Operation's name |
bucket | Name of the R2 bucket |
date | Operation timestamp, truncated to start of a day |
datetime | Operation timestamp |
datetimeHour | Operation timestamp, truncated to start of an hour |
datetimeMinute | Operation timestamp, truncated to start of an minute |
initiator | Operation's initiator (eyeball / Sippy) |
object | Object key the operation was made for |
size | Number of bytes transferred as part of the operation |
status | Operation's response HTTP code |
target | Operation's target (upstream / R2) |
AccountSippyOperationsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountSippyOperationsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountSippyOperationsAdaptiveGroupsSum
Field | Description |
---|---|
size | Total bytes transferred |
AccountSpectrumNetworkAnalyticsAdaptiveGroups
Network analytics data for Spectrum traffic
Field | Description |
---|---|
avg | The average of values for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountSpectrumNetworkAnalyticsAdaptiveGroupsAvg
Field | Description |
---|---|
bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountSpectrumNetworkAnalyticsAdaptiveGroupsDimensions
Field | Description |
---|---|
applicationTag | Application tag associated with the packet |
coloCity | City where the Cloudflare datacenter that received the packet is located |
coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
coloName | Cloudflare datacenter that received the packet (unique site identifier) |
date | Date that the packet was received |
datetime | Date and time that the packet was received |
datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
greChecksum | Value of the Checkusm header field in the GRE packet |
greEthertype | Value of the Ethertype header field in the GRE packet |
greHeaderLength | Length of the GRE packet header, in bytes |
greKey | Value of the Key header field in the GRE packet |
greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
greVersion | Value of the Version header field in the GRE packet |
icmpChecksum | Value of the Checkusm header field in the ICMP packet |
icmpCode | Value of the Code header field in the ICMP packet |
icmpType | Value of the Type header field in the ICMP packet |
ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
ipv4Identification | Value of the Identification header field in the IPv4 packet |
ipv4Options | List of Options numbers included in the IPv4 packet header |
ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
leaseTag | IP lease tag associated with the packet |
mitigationSystem | Which system dropped the packet (possible values: dosd, flowtrackd, magic-firewall) |
outcome | The action that was taken on the packet (possible values: pass, drop) |
prefixTag | IP prefix tag associated with the packet |
sampleInterval | ABR sample interval |
sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
sourcePort | Value of the Source Port header field in the TCP or UDP packet |
tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
tcpChecksum | Value of the Checkusm header field in the TCP packet |
tcpDataOffset | Value of the Data Offset header field in the TCP packet |
tcpFlags | Value of the Flags header field in the TCP packet |
tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
tcpMss | Value of the MSS option header field in the TCP packet |
tcpOptions | List of Options numbers included in the TCP packet header |
tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
tcpWindowSize | Value of the Window Size header field in the TCP packet |
udpChecksum | Value of the Checkusm header field in the UDP packet |
udpPayloadLength | Value of the Payload Length header field in the UDP packet |
AccountSpectrumNetworkAnalyticsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountSpectrumNetworkAnalyticsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountSpectrumNetworkAnalyticsAdaptiveGroupsSum
Field | Description |
---|---|
bits | Sum of bits received |
packets | Sum of packets received |
AccountStorageTraces
Storage Tracing Information
Field | Description |
---|---|
containerId | The container that this resource is stored under. |
datetime | Storage trace timestamp |
resourceId | The identifier to access this resource in the container. |
serviceId | The identifier of the storage service that houses the resourse. |
traceId | The ID that this trace entry is under. |
userAccountId | The AccountID of the user who owns the resource. |
AccountStorageTracesFilter_InputObject
Field | Description |
---|---|
AccountStorageTracesOrderBy
Field | Description |
---|---|
AccountStreamMinutesViewedAdaptiveGroups
A high-level summary of Cloudflare Stream minutes viewed.
Field | Description |
---|---|
count | The number of values for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountStreamMinutesViewedAdaptiveGroupsDimensions
Field | Description |
---|---|
clientCountryName | ISO 3166 alpha2 country code from the client |
creator | Customer-provided creator ID of a video |
date | The date the event occurred at the edge |
datetime | The date and time the event occurred at the edge |
datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
datetimeHour | The date and time the event occurred at the edge truncated to hours |
datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
mediaType | The source of the minutes viewed |
uid | Unique ID of a video |
AccountStreamMinutesViewedAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountStreamMinutesViewedAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountStreamMinutesViewedAdaptiveGroupsSum
Field | Description |
---|---|
minutesViewed |
AccountTurnstileAdaptiveGroups
Beta. Cloudflare Turnstile aggregated events with adaptive sampling
Field | Description |
---|---|
avg | |
count | Number of Cloudflare Turnstile events processed |
dimensions | List of dimensions to group by |
AccountTurnstileAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval | Average sample interval |
AccountTurnstileAdaptiveGroupsDimensions
Field | Description |
---|---|
action | The action tag of the challenge event |
date | The date the challenge event was emitted |
datetime | The date and time the challenge event was emitted |
datetimeDay | The date and time the challenge event was emitted truncated to the day |
datetimeFifteenMinutes | The date and time the challenge event was emitted truncated to a multiple of 15 minutes |
datetimeFiveMinutes | The date and time the challenge event was emitted truncated to a multiple of 5 minutes |
datetimeHalfOfHour | The date and time the challenge event was emitted truncated to a multiple of 30 minutes |
datetimeHour | The date and time the challenge event was emitted truncated to the hour |
datetimeMinute | The date and time the challenge event was emitted truncated to the minute |
eventType | The type of the Cloudflare Turnstile event |
siteKey | The sitekey of the widget associated with the event |
AccountTurnstileAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountTurnstileAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountVectorizeQueriesAdaptiveGroups
Beta. Vectorize usage with adaptive sampling
Field | Description |
---|---|
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountVectorizeQueriesAdaptiveGroupsDimensions
Field | Description |
---|---|
date | Vectorize storage sample timestamp |
datetimeHour | Vectorize storage sample timestamp, truncated to the hour |
vectorizeIndexId | Identifier for a Vectorize index |
AccountVectorizeQueriesAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountVectorizeQueriesAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountVectorizeQueriesAdaptiveGroupsSum
Field | Description |
---|---|
queriedVectorDimensions | The number of queried vector dimensions in Vectorize over the queried time period. |
AccountVectorizeStorageAdaptiveGroups
Beta. Vectorize storage with adaptive sampling
Field | Description |
---|---|
dimensions | List of dimensions to group by |
max | The max of values for a metric per dimension |
AccountVectorizeStorageAdaptiveGroupsDimensions
Field | Description |
---|---|
date | Vectorize storage sample timestamp |
datetimeHour | Vectorize storage sample timestamp, truncated to the hour |
vectorizeIndexId | Identifier for a Vectorize index |
AccountVectorizeStorageAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountVectorizeStorageAdaptiveGroupsMax
Field | Description |
---|---|
storedVectorDimensions | The maximum number of stored vector dimensions in Vectorize over the queried time period. |
AccountVectorizeStorageAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountVectorizeV2OperationsAdaptiveGroups
Vectorize operations with adaptive sampling
Field | Description |
---|---|
count | Total number of Vectorize operations |
dimensions | List of dimensions to group by |
AccountVectorizeV2OperationsAdaptiveGroupsDimensions
Field | Description |
---|---|
date | Vectorize operation event timestamp, truncated to start of a day |
datetime | Vectorize operation event timestamp |
datetimeHour | Vectorize operation event timestamp, truncated to start of hour |
datetimeMinute | Vectorize operation event timestamp, truncated to start of minute |
indexName | Name of a Vectorize index |
operation | The type of Vectorize operation |
requestStatus | Request status. One of [2xx, 4xx, 5xx, unknown] |
AccountVectorizeV2OperationsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountVectorizeV2OperationsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountVectorizeV2QueriesAdaptiveGroups
Vectorize queries with adaptive sampling
Field | Description |
---|---|
avg | The average value for a metric per dimension |
count | Total number of Vectorize queries |
dimensions | List of dimensions to group by |
quantiles | Quantiles of a metric per dimension |
sum | The sum of values for a metric per dimension |
AccountVectorizeV2QueriesAdaptiveGroupsAvg
Field | Description |
---|---|
requestDurationMs | Average latency (in milliseconds) of serving a Vectorize query |
AccountVectorizeV2QueriesAdaptiveGroupsDimensions
Field | Description |
---|---|
date | Vectorize queries event timestamp, truncated to start of a day |
datetime | Vectorize queries event timestamp |
datetimeHour | Vectorize queries event timestamp, truncated to start of hour |
datetimeMinute | Vectorize queries event timestamp, truncated to start of minute |
indexName | Name of a Vectorize index |
operation | The type of Vectorize operation |
requestStatus | Request status. One of [2xx, 4xx, 5xx, unknown] |
AccountVectorizeV2QueriesAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountVectorizeV2QueriesAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountVectorizeV2QueriesAdaptiveGroupsQuantiles
Field | Description |
---|---|
requestDurationMsP25 | 25th percentile latency (milliseconds) |
requestDurationMsP50 | 50th percentile latency (milliseconds) |
requestDurationMsP75 | 75th percentile latency (milliseconds) |
requestDurationMsP95 | 95th percentile latency (milliseconds) |
requestDurationMsP99 | 99th percentile latency (milliseconds) |
AccountVectorizeV2QueriesAdaptiveGroupsSum
Field | Description |
---|---|
queriedVectorDimensions | The number of queried vector dimensions in Vectorize over the queried time period. |
requestDurationMs | Total latency (in milliseconds) of serving Vectorize queries over the queried time period |
servedVectorCount | The number of vectors served in Vectorize queries over the queried time period. |
AccountVectorizeV2StorageAdaptiveGroups
Vectorize storage with adaptive sampling
Field | Description |
---|---|
dimensions | List of dimensions to group by |
max | The max of values for a metric per dimension |
AccountVectorizeV2StorageAdaptiveGroupsDimensions
Field | Description |
---|---|
date | Vectorize storage event timestamp, truncated to start of a day |
datetime | Vectorize storage event timestamp |
datetimeHour | Vectorize storage event timestamp, truncated to start of hour |
datetimeMinute | Vectorize storage event timestamp, truncated to start of minute |
indexName | Name of a Vectorize index |
AccountVectorizeV2StorageAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountVectorizeV2StorageAdaptiveGroupsMax
Field | Description |
---|---|
storedVectorDimensions | The maximum number of stored vector dimensions in Vectorize over the queried time period. |
vectorCount | The maximum number of stored vectors in Vectorize over the queried time period. |
AccountVectorizeV2StorageAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountVectorizeV2WritesAdaptiveGroups
Vectorize writes with adaptive sampling
Field | Description |
---|---|
avg | The average value for a metric per dimension |
count | Total number of Vectorize writes |
dimensions | List of dimensions to group by |
quantiles | Quantiles of a metric per dimension |
sum | The sum of values for a metric per dimension |
AccountVectorizeV2WritesAdaptiveGroupsAvg
Field | Description |
---|---|
requestDurationMs | Average latency (in milliseconds) of serving a Vectorize write |
AccountVectorizeV2WritesAdaptiveGroupsDimensions
Field | Description |
---|---|
date | Vectorize write event timestamp, truncated to start of a day |
datetime | Vectorize write event timestamp |
datetimeHour | Vectorize write event timestamp, truncated to start of hour |
datetimeMinute | Vectorize write event timestamp, truncated to start of minute |
indexName | Name of a Vectorize index |
operation | The type of Vectorize operation |
requestStatus | Request status. One of [2xx, 4xx, 5xx, unknown] |
AccountVectorizeV2WritesAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountVectorizeV2WritesAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountVectorizeV2WritesAdaptiveGroupsQuantiles
Field | Description |
---|---|
requestDurationMsP25 | 25th percentile latency (milliseconds) |
requestDurationMsP50 | 50th percentile latency (milliseconds) |
requestDurationMsP75 | 75th percentile latency (milliseconds) |
requestDurationMsP95 | 95th percentile latency (milliseconds) |
requestDurationMsP99 | 99th percentile latency (milliseconds) |
AccountVectorizeV2WritesAdaptiveGroupsSum
Field | Description |
---|---|
addedVectorCount | The number of vectors added in Vectorize writes over the queried time period. |
deletedVectorCount | The number of vectors deleted in Vectorize writes over the queried time period. |
requestDurationMs | Total latency (in milliseconds) of serving Vectorize writes over the queried time period |
AccountVideoBufferEventsAdaptiveGroups
Beta. Aggregated video streaming buffer event metrics with adaptive sampling
Field | Description |
---|---|
avg | |
count | Total number of buffer events |
dimensions | List of dimensions to group by |
AccountVideoBufferEventsAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval | Average sample interval |
AccountVideoBufferEventsAdaptiveGroupsDimensions
Field | Description |
---|---|
clientCountryName | ISO 3166 alpha2 country code from the client |
date | Request date of the event |
datetime | Request datetime of the event |
datetimeFifteenMinutes | Request datetime of the event, truncated to multiple of 15 minutes |
datetimeFiveMinutes | Request datetime of the event, truncated to multiple of 5 minutes |
datetimeHalfOfHour | Request datetime of the event, truncated to multiple of 30 minutes |
datetimeHour | Request datetime of the event, truncated to the hour |
datetimeMinute | Request datetime of the event, truncated to the minute |
deviceBrowser | Browser of the device used in playback |
deviceOs | OS of the device used in playback |
deviceType | Device type used in playback |
uid | unique id for a video |
AccountVideoBufferEventsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountVideoBufferEventsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountVideoPlaybackEventsAdaptiveGroups
Beta. Aggregated video streaming playback event metrics with adaptive sampling
Field | Description |
---|---|
avg | |
count | Total number of playback starts |
dimensions | List of dimensions to group by |
sum |
AccountVideoPlaybackEventsAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval | Average sample interval |
AccountVideoPlaybackEventsAdaptiveGroupsDimensions
Field | Description |
---|---|
clientCountryName | ISO 3166 alpha2 country code from the client |
date | Request date of the event |
datetime | Request datetime of the event |
datetimeFifteenMinutes | Request datetime of the event, truncated to multiple of 15 minutes |
datetimeFiveMinutes | Request datetime of the event, truncated to multiple of 5 minutes |
datetimeHalfOfHour | Request datetime of the event, truncated to multiple of 30 minutes |
datetimeHour | Request datetime of the event, truncated to the hour |
datetimeMinute | Request datetime of the event, truncated to the minute |
deviceBrowser | Browser of the device used in playback |
deviceOs | OS of the device used in playback |
deviceType | Device type used in playback |
uid | unique id for a video |
AccountVideoPlaybackEventsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountVideoPlaybackEventsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountVideoPlaybackEventsAdaptiveGroupsSum
Field | Description |
---|---|
timeViewedMinutes | Total time viewed in minutes |
AccountVideoQualityEventsAdaptiveGroups
Beta. Aggregated video streaming quality change event metrics with adaptive sampling
Field | Description |
---|---|
avg | |
count | Total number of quality change events |
dimensions | List of dimensions to group by |
AccountVideoQualityEventsAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval | Average sample interval |
AccountVideoQualityEventsAdaptiveGroupsDimensions
Field | Description |
---|---|
clientCountryName | ISO 3166 alpha2 country code from the client |
date | Request date of the event |
datetime | Request datetime of the event |
datetimeFifteenMinutes | Request datetime of the event, truncated to multiple of 15 minutes |
datetimeFiveMinutes | Request datetime of the event, truncated to multiple of 5 minutes |
datetimeHalfOfHour | Request datetime of the event, truncated to multiple of 30 minutes |
datetimeHour | Request datetime of the event, truncated to the hour |
datetimeMinute | Request datetime of the event, truncated to the minute |
deviceBrowser | Browser of the device used in playback |
deviceOs | OS of the device used in playback |
deviceType | Device type used in playback |
qualityResolution | Video playback vertical resolution |
uid | unique id for a video |
AccountVideoQualityEventsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountVideoQualityEventsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountWarpDeviceAdaptiveGroups
Beta. Warp device health events with adaptive sampling
Field | Description |
---|---|
count | Number of device health events, which usually occur at 2m intervals per device |
dimensions | List of dimensions to group by |
uniq |
AccountWarpDeviceAdaptiveGroupsDimensions
Field | Description |
---|---|
clientPlatform | Device's OS |
clientVersion | Device's Warp version |
colo | Device's connected colo |
date | The date of the device log |
datetime | The date and time of the device log |
datetimeFiveMinute | The date and time of the device log truncated to every five minutes |
datetimeHour | The date and time of the device log truncated to the hour |
datetimeTenMinute | The date and time of the device log truncated to every ten minutes |
deviceId | Device ID |
mode | Device's Warp mode |
status | Device connection status |
AccountWarpDeviceAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountWarpDeviceAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountWarpDeviceAdaptiveGroupsUniq
Field | Description |
---|---|
deviceIds | Approximate count of unique deviceIds |
AccountWorkerPlacementAdaptiveGroups
Worker placement metrics
Field | Description |
---|---|
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountWorkerPlacementAdaptiveGroupsDimensions
Field | Description |
---|---|
date | Request timestamp, truncated to start of a day |
datetime | Request timestamp |
datetimeFifteenMinutes | Request timestamp, truncated to fifteen minutes |
datetimeFiveMinutes | Request timestamp, truncated to five minutes |
datetimeHour | Request timestamp, truncated to start of an hour |
datetimeMinute | Request timestamp, truncated to start of an minute |
httpStatus | Response status of worker |
isSample | 1 if the request was sampled to bypass Smart Placement, 0 otherwise |
placementUsed | 1 if the request was processed using Smart Placement, 0 if it was processed in default mode |
requestDurationBucketMin | Bucket of request duration rounded down to nearest 10*2^n |
requestDurationBucketMin100ms | Bucket of request duration rounded down to nearest 100ms |
scriptName | The script name |
scriptTag | The unique tag of the script |
scriptVersion | The script version |
AccountWorkerPlacementAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountWorkerPlacementAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountWorkerPlacementAdaptiveGroupsSum
Field | Description |
---|---|
requestDuration | Sum of duration ms of requests measured at the data centers that receive the requests |
requests | Total number of requests |
AccountWorkersAnalyticsEngineAdaptiveGroups
Beta. Custom Events with adaptive sampling
Field | Description |
---|---|
count | The number of values for a metric per dimension |
dimensions | List of dimensions to group by |
AccountWorkersAnalyticsEngineAdaptiveGroupsDimensions
Field | Description |
---|---|
dataset | The dataset name |
date | The date the event occurred |
datetime | The date and time the event occurred |
datetimeFifteenMinutes | The date and time the event occurred truncated to a multiple of 15 minutes |
datetimeFiveMinutes | The date and time the event occurred truncated to a multiple of 5 minutes |
datetimeHour | The date and time the event occurred truncated to the start of an hour |
datetimeMinute | The date and time the event occurred truncated to the start of a minute |
AccountWorkersAnalyticsEngineAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountWorkersAnalyticsEngineAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountWorkersInvocationsAdaptive
Beta. Workers invocations with adaptive sampling
Field | Description |
---|---|
avg | The average value used for sample interval |
dimensions | List of dimensions to group by |
max | The max value for a metric |
min | The min value for a metric |
quantiles | Quantiles of a metric per dimension |
sum | The sum of values for a metric per dimension |
AccountWorkersInvocationsAdaptiveAvg
Field | Description |
---|---|
sampleInterval |
AccountWorkersInvocationsAdaptiveDimensions
Field | Description |
---|---|
date | Request datetime, truncated to start of a day |
datetime | Request datetime |
datetimeFifteenMinutes | The date and time of the event truncated to fifteen minutes |
datetimeFiveMinutes | The date and time of the event truncated to five minutes |
datetimeHour | Request datetime, truncated to start of an hour |
datetimeMinute | Request datetime, truncated to start of an minute |
dispatchNamespaceName | The name of the script's dispatch namespace |
environmentName | The name of the script environment |
isDispatcher | Whether the request is from a Dispatch Worker. Non-zero if true |
scriptName | The name of the script |
scriptTag | The unique tag of the script |
scriptVersion | The version of the Worker |
status | Status of the worker invocation |
usageModel | Usage model of the worker invocation |
AccountWorkersInvocationsAdaptiveFilter_InputObject
Field | Description |
---|---|
AccountWorkersInvocationsAdaptiveMax
Field | Description |
---|---|
cpuTime | Maximum CPU time for one request - microseconds |
duration | Maximum duration of one request - GB*s |
responseBodySize | Maximum response body size for one request - bytes |
wallTime | Maximum wall time for one request - microseconds |
AccountWorkersInvocationsAdaptiveMin
Field | Description |
---|---|
cpuTime | Minimum CPU time for one request - microseconds |
duration | Minimum duration of one request - GB*s |
responseBodySize | Minimum response body size for one request - bytes |
wallTime | Minimum wall time for one request - microseconds |
AccountWorkersInvocationsAdaptiveOrderBy
Field | Description |
---|---|
AccountWorkersInvocationsAdaptiveQuantiles
Field | Description |
---|---|
cpuTimeP25 | CPU time 25th percentile - microseconds |
cpuTimeP50 | CPU time 50th percentile - microseconds |
cpuTimeP75 | CPU time 75th percentile - microseconds |
cpuTimeP90 | CPU time 90th percentile - microseconds |
cpuTimeP95 | CPU time 95th percentile - microseconds |
cpuTimeP99 | CPU time 99th percentile - microseconds |
cpuTimeP999 | CPU time 99.9th percentile - microseconds |
durationP25 | Duration 25th percentile - GB*s |
durationP50 | Duration 50th percentile - GB*s |
durationP75 | Duration 75th percentile - GB*s |
durationP90 | Duration 90th percentile - GB*s |
durationP95 | Duration 95th percentile - GB*s |
durationP99 | Duration 99th percentile - GB*s |
durationP999 | Duration 99.9th percentile - GB*s |
responseBodySizeP25 | Response body size 25th percentile - bytes |
responseBodySizeP50 | Response body size 50th percentile - bytes |
responseBodySizeP75 | Response body size 75th percentile - bytes |
responseBodySizeP90 | Response body size 90th percentile - bytes |
responseBodySizeP95 | Response body size 95th percentile - bytes |
responseBodySizeP99 | Response body size 99th percentile - bytes |
responseBodySizeP999 | Response body size 99.9th percentile - bytes |
wallTimeP25 | Wall time 25th percentile - microseconds |
wallTimeP50 | Wall time 50th percentile - microseconds |
wallTimeP75 | Wall time 75th percentile - microseconds |
wallTimeP90 | Wall time 90th percentile - microseconds |
wallTimeP95 | Wall time 95th percentile - microseconds |
wallTimeP99 | Wall time 99th percentile - microseconds |
wallTimeP999 | Wall time 99.9th percentile - microseconds |
AccountWorkersInvocationsAdaptiveSum
Field | Description |
---|---|
clientDisconnects | Sum of client disconnects |
cpuTimeUs | Sum of cpu time in us |
duration | Sum of Duration - GB*s |
errors | Sum of Errors |
requests | Sum of Requests |
responseBodySize | Sum of Response Body Sizes |
subrequests | Sum of Subrequests |
wallTime | Sum of Wall Time |
AccountWorkersInvocationsScheduled
Workers scheduled invocations
Field | Description |
---|---|
cpuTimeUs | CPU time - microseconds |
cron | The cron string of the schedule |
datetime | Request datetime |
environmentName | The name of the script environment |
scheduledDatetime | Scheduled datetime |
scriptName | The name of the script |
status | Status of the worker invocation |
AccountWorkersInvocationsScheduledFilter_InputObject
Field | Description |
---|---|
AccountWorkersInvocationsScheduledOrderBy
Field | Description |
---|---|
AccountWorkersOverviewDataAdaptiveGroups
Beta. Workers account overview invocation data with adaptive sampling
Field | Description |
---|---|
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountWorkersOverviewDataAdaptiveGroupsDimensions
Field | Description |
---|---|
datetime | Request datetime |
usageModel | Usage model of the worker invocation |
AccountWorkersOverviewDataAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountWorkersOverviewDataAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountWorkersOverviewDataAdaptiveGroupsSum
Field | Description |
---|---|
standardCpuTimeUs | Standard usage model cpu time in us |
unboundDurationUs | Unbound usage model duration in us |
AccountWorkersOverviewRequestsAdaptiveGroups
Beta. Workers account overview invocation count with adaptive sampling
Field | Description |
---|---|
count | The number of values for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountWorkersOverviewRequestsAdaptiveGroupsDimensions
Field | Description |
---|---|
datetime | Request datetime |
status | Status of the worker invocation |
usageModel | Usage model of the worker invocation |
AccountWorkersOverviewRequestsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountWorkersOverviewRequestsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountWorkersOverviewRequestsAdaptiveGroupsSum
Field | Description |
---|---|
cpuTimeUs | Cpu time in us |
AccountWorkersSubrequestsAdaptiveGroups
Beta. Workers subrequests with adaptive sampling
Field | Description |
---|---|
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
AccountWorkersSubrequestsAdaptiveGroupsDimensions
Field | Description |
---|---|
cacheStatus | Cache status |
date | Request datetime, truncated to start of a day |
datetime | Request datetime |
datetimeFifteenMinutes | The date and time of the event truncated to fifteen minutes |
datetimeFiveMinutes | The date and time of the event truncated to five minutes |
datetimeHour | Request datetime, truncated to start of an hour |
datetimeMinute | Request datetime, truncated to start of an minute |
environmentName | The name of the script environment |
scriptName | The name of the script |
scriptVersion | The version of the Worker |
usageModel | Usage model of the worker invocation |
AccountWorkersSubrequestsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountWorkersSubrequestsAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountWorkersSubrequestsAdaptiveGroupsSum
Field | Description |
---|---|
requestBodySizeUncached | Workers fetch request body size in bytes where the request was not cached |
subrequests | Number of subrequests |
AccountZarazTrackAdaptiveGroups
Zaraz Track Analytics - counts zaraz.track calls
Field | Description |
---|---|
count | Number of processed Zaraz Track requests |
dimensions | List of dimensions to group by |
AccountZarazTrackAdaptiveGroupsDimensions
Field | Description |
---|---|
date | Date when track was called |
datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
datetimeFiveMinutes | The date and time truncated to five minutes |
datetimeHour | The date and time truncated to the hour |
datetimeMinute | The date and time truncated to the minute |
trackName | Track Name |
urlPath | The URL from where Track was called |
AccountZarazTrackAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountZarazTrackAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountZarazTriggersAdaptiveGroups
Zaraz Triggers Analytics (a trigger is a set of rules that can trigger a zaraz action)
Field | Description |
---|---|
count | Number of processed Zaraz Triggers |
dimensions | List of dimensions to group by |
AccountZarazTriggersAdaptiveGroupsDimensions
Field | Description |
---|---|
date | The date when trigger was triggerd |
datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
datetimeFiveMinutes | The date and time truncated to five minutes |
datetimeHour | The date and time truncated to the hour |
datetimeMinute | The date and time truncated to the minute |
triggerName | Trigger Name |
AccountZarazTriggersAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
AccountZarazTriggersAdaptiveGroupsOrderBy
Field | Description |
---|---|
AccountZeroTrustPrivateNetworkDiscoveryGroups
Beta - Unique origins, applications, and users discovered for Zero Trust private networks
Field | Description |
---|---|
count | Sum of network access during the select range |
dimensions | List of dimensions to group by |
max | |
uniq |
AccountZeroTrustPrivateNetworkDiscoveryGroupsDimensions
Field | Description |
---|---|
date | Request date |
datetimeHour | Request datetime and start of the hour |
destinationIP | Destination IPv4 or IPv6 |
destinationPort | Destination port |
The email address of the user who accessed the resource | |
hostname | SNI hostname of the origin if TLS intercept is enabled |
originId | UUID of the origin if it has been identified before |
status | status of the origin, one of unreviewed, in_review, approved, unapproved |
transport | The transport protocol used in the session, one of (0, tcp) (1, quic) (2, udp) |
userId | The ID of the user who accessed the resource |
AccountZeroTrustPrivateNetworkDiscoveryGroupsFilter_InputObject
Field | Description |
---|---|
AccountZeroTrustPrivateNetworkDiscoveryGroupsMax
Field | Description |
---|---|
dateTime | Latest access time of a user |
AccountZeroTrustPrivateNetworkDiscoveryGroupsOrderBy
Field | Description |
---|---|
AccountZeroTrustPrivateNetworkDiscoveryGroupsUniq
Field | Description |
---|---|
emails | Approximate count of unique emails |
origins | Approximate count of unique origins. An origin is a (transport, destinationIP, destinationPort) |
userIds | Approximate count of unique users |
Confidence
Field | Description |
---|---|
estimate | Estimated value of this metric |
isValid | True if the confidence interval is valid, i.e. there is enough samples at low enough sample interval |
lower | Lower bound of confidence interval |
sampleSize | Number of samples that contributed to the estimate |
upper | Upper bound of confidence interval |
OrganizationFilter_InputObject
Field | Description |
---|---|
OrganizationHttpRequestsAdaptiveGroups
Aggregated HTTP requests data with adaptive sampling
Field | Description |
---|---|
avg | The average value used for sample interval |
confidence | ALPHA - DO NOT USE |
count | The number of values for a metric per dimension |
dimensions | List of dimensions to group by |
quantiles | Quantiles of a metric per dimension |
ratio | The ratio of a range of status codes, between 0 and 1 |
sum | The sum of values for a metric per dimension |
OrganizationHttpRequestsAdaptiveGroupsAvg
Field | Description |
---|---|
crossZoneSubrequests | The proportion of requests that were inititiated by a Cloudflare Worker on another zone |
edgeDnsResponseTimeMs | |
edgeTimeToFirstByteMs | |
originResponseDurationMs | The average originResponseDuration, in milliseconds, excluding 0 values (i.e. cached ones) |
sampleInterval |
OrganizationHttpRequestsAdaptiveGroupsConfidence
Field | Description |
---|---|
count | The number of values for a metric per dimension, with confidence intervals |
level | Confidence level that was requested |
sum | The sum of values for a metric per dimension, with confidence intervals |
OrganizationHttpRequestsAdaptiveGroupsDimensions
Field | Description |
---|---|
accountTag | Associated account |
apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
apiGatewayMatchedHost | API Gateway host matched at the edge |
botManagementDecision | Judgement of the bot management system |
botScore | The final score originated from bot management detections. |
botScoreBucketBy10 | Range of the bot management score |
botScoreSrcName | Name of the source detection which generated the bot management score. |
cacheReserveUsed | Used Cache Reserve to serve the response |
cacheStatus | |
clientASNDescription | The ASN of the visitor as string |
clientAsn | |
clientCountryName | Country from which request originated |
clientDeviceType | |
clientIP | |
clientRefererHost | The referrer host |
clientRequestHTTPHost | Host requested by the client |
clientRequestHTTPMethodName | HTTP method of client request |
clientRequestHTTPProtocol | HTTP protocol version |
clientRequestPath | Path of client request |
clientRequestQuery | Query parameters of client request |
clientRequestReferer | HTTP request referrer |
clientRequestScheme | HTTP request URI scheme (http/https) |
clientSSLProtocol | SSL protocol version |
coloCode | |
contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
contentScanNumObj | Number of scannable content objects |
contentScanObjResults | Array of scan results in order of detection |
contentScanObjSizes | Array of scan sizes in order of detection |
contentScanObjTypes | Array of content types in order of detection |
date | The date the event occurred at the edge |
datetime | The date and time the event occurred at the edge |
datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
datetimeHour | The date and time the event occurred at the edge truncated to hours |
datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
edgeDnsResponseTimeMs | The time elapsed resolving a CNAME if it was required to reach your origin |
edgeResponseContentTypeName | |
edgeResponseStatus | |
edgeTimeToFirstByteMs | The time elapsed between processing the first byte of the request until when we started sending a response |
httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion ): Version associated with HTTP Application |
isCrossZoneSubrequest | '1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise. |
ja3Hash | MD5 hash of the JA3 TLS fingerprint |
ja4 | JA4 TLS fingerprint |
leakedCredentialCheckResult | The distinct result of checking for leaked credentials |
originASN | |
originASNDescription | ASN associated with origin |
originIP | |
originResponseDurationMs | |
originResponseStatus | HTTP response status code returned by the origin |
requestSource | |
sampleInterval | ABR sample interval |
securityAction | The code of the first-class action the Cloudflare Firewall took on this request |
securitySource | The Cloudflare security product triggered by this request |
upperTierColoName | |
userAgent | |
userAgentBrowser | Browser parsed from the user agent |
userAgentOS | OS parsed from the user agent |
wafAttackScore | Beta. Overall request score generated by the WAF detection module |
wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
wafRceAttackScore | Beta. WAF score for a RCE attack |
wafSqliAttackScore | Beta. WAF score for a SQLi attack |
wafXssAttackScore | Beta. WAF score for a XSS attack |
xRequestedWith | The X-Requested-With header of the client request |
zoneTag | Associated zone |
zoneVersion | The version of a zone |
OrganizationHttpRequestsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
OrganizationHttpRequestsAdaptiveGroupsOrderBy
Field | Description |
---|---|
OrganizationHttpRequestsAdaptiveGroupsQuantiles
Field | Description |
---|---|
edgeDnsResponseTimeMsP50 | 50th percentile DNS Response Time (milliseconds) |
edgeDnsResponseTimeMsP95 | 95th percentile DNS Response Time (milliseconds) |
edgeDnsResponseTimeMsP99 | 99th percentile DNS Response Time (milliseconds) |
edgeTimeToFirstByteMsP50 | 50th percentile Time To First Byte (milliseconds) |
edgeTimeToFirstByteMsP95 | 95th percentile Time To First Byte (milliseconds) |
edgeTimeToFirstByteMsP99 | 99th percentile Time To First Byte (milliseconds) |
originResponseDurationMsP50 | 50th percentile Origin Response Duration (milliseconds) |
originResponseDurationMsP95 | 95th percentile Origin Response Duration (milliseconds) |
originResponseDurationMsP99 | 99th percentile Origin Response Duration (milliseconds) |
OrganizationHttpRequestsAdaptiveGroupsRatio
Field | Description |
---|---|
status4xx | |
status5xx |
OrganizationHttpRequestsAdaptiveGroupsSum
Field | Description |
---|---|
crossZoneSubrequests | The number of requests that were inititiated by a Cloudflare Worker on another zone |
edgeDnsResponseTimeMs | |
edgeResponseBytes | |
edgeTimeToFirstByteMs | |
originResponseDurationMs | |
visits | The number of requests by end-users that were initiated from a different website (i.e. where the request HTTP Referer header does not match the host in the HTTP Host header) |
OrganizationHttpRequestsAdaptiveGroupsSumConfidence
Field | Description |
---|---|
edgeResponseBytes | Confidence interval for the corresponding point estimate |
OrganizationSettings
Access and limitations for an organization
Field | Description |
---|---|
httpRequestsAdaptiveGroups |
Query
Field | Description |
---|---|
cost | |
viewer |
Settings
Access and limitations
Field | Description |
---|---|
availableFields | The list of available fields to query |
enabled | |
maxDuration | Requested time range should not be wider than this (seconds) |
maxNumberOfFields | Maximum number of fields to request at once |
maxPageSize | Maximum allowed value for 'limit' |
notOlderThan | Cannot reach for data beyond this distance in the past (seconds) |
ZoneApiGatewayGraphqlQueryAnalyticsGroups
GraphQL query attributes and trends
Field | Description |
---|---|
avg | |
count | Number of events with GraphQL query attributes computed |
dimensions | List of dimensions to group by |
ZoneApiGatewayGraphqlQueryAnalyticsGroupsAvg
Field | Description |
---|---|
sampleInterval | Average sample interval |
ZoneApiGatewayGraphqlQueryAnalyticsGroupsDimensions
Field | Description |
---|---|
apiGatewayGraphqlQueryDepth | Maximum depth level of a terminal (leaf) field in the query |
apiGatewayGraphqlQuerySize | Number of terminal (leaf) fields in the query |
date | |
datetime | |
datetimeDay | |
datetimeFifteenMinutes | |
datetimeFiveMinutes | |
datetimeHalfOfHour | |
datetimeHour | |
datetimeMinute |
ZoneApiGatewayGraphqlQueryAnalyticsGroupsFilter_InputObject
Field | Description |
---|---|
ZoneApiGatewayGraphqlQueryAnalyticsGroupsOrderBy
Field | Description |
---|---|
ZoneApiGatewayMatchedSessionIDsAdaptiveGroups
Beta. Aggregated count of Session Identifier matches
Field | Description |
---|---|
avg | |
count | Number of events with Session Identifiers |
dimensions | List of dimensions to group by |
ZoneApiGatewayMatchedSessionIDsAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval | Average sample interval |
ZoneApiGatewayMatchedSessionIDsAdaptiveGroupsDimensions
Field | Description |
---|---|
apiGatewayMatchedSessionIdentifierName | Name of session identifier |
apiGatewayMatchedSessionIdentifierType | Type of session identifier. Possible values are header | cookie |
date | |
datetime | |
datetimeDay | |
datetimeFifteenMinutes | |
datetimeFiveMinutes | |
datetimeHalfOfHour | |
datetimeHour | |
datetimeMinute |
ZoneApiGatewayMatchedSessionIDsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZoneApiGatewayMatchedSessionIDsAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneApiGatewayMatchedSessionIDsPerEndpointAdaptiveGroups
Beta. Aggregated count of Session Identifier matches per endpoint
Field | Description |
---|---|
avg | |
count | Number of events per dimension |
dimensions | List of dimensions to group by |
ZoneApiGatewayMatchedSessionIDsPerEndpointAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval | Average sample interval |
ZoneApiGatewayMatchedSessionIDsPerEndpointAdaptiveGroupsDimensions
Field | Description |
---|---|
apiGatewayMatchedEndpoint | Id of the matched API endpoint |
apiGatewayMatchedSessionIdentifier | Array of observed tuples consisting of session identifier types and names. Possible types are header | cookie | jwt |
date | |
datetime | |
datetimeDay | |
datetimeFifteenMinutes | |
datetimeFiveMinutes | |
datetimeHalfOfHour | |
datetimeHour | |
datetimeMinute | |
responseStatusCode | HTTP status code returned by edge |
ZoneApiGatewayMatchedSessionIDsPerEndpointAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneApiRequestSequencesGroups
Sequences of API endpoint operations. Sequences are learned by grouping requests by AuthID. Correlation scores are estimated over a 24 hour window and are current to within 10 minutes
Field | Description |
---|---|
aggArgMax | |
aggMax | |
dimensions | List of dimensions to group by |
uniq |
ZoneApiRequestSequencesGroupsAggArgMax
Field | Description |
---|---|
correlation | Correlation score estimated over a 24 hour window. The correlation score is the probability that the last operation in the sequence is preceded by the remaining operations in the sequence, assuming that the last operation in the sequence occurred |
numOccurrences | Estimated number of occurrences of this sequence of endpoint operations |
numOccurrencesLast | Estimated number of occurrences of the last operation in this sequence of endpoint operations |
numOccurrencesPrefix | Estimated number of occurrences of this sequence of endpoint operations, disregarding the last operation |
numOccurrencesSuffix | DEPRECATED (Field is not guaranteed to be always populated for sequences of length greater than 2. Use numOccurrencesLast instead): Estimated number of occurrences of this sequence of endpoint operations, disregarding the first operation |
operationsApiEndpoints | API endpoints in the sequence of operations. Individual endpoints are delimited by # symbols |
operationsClientRequestHTTPMethods | HTTP request methods in the sequence of operations. Individual request method names are delimited by # symbols |
samplingFraction | Fraction of requests sampled |
ZoneApiRequestSequencesGroupsAggMax
Field | Description |
---|---|
timeLastSeen | Time of the most recent occurrence of this sequence of endpoint operations (based on the timestamp of the first request in the sequence) |
timeLastUpdated | The time at which Cloudflare last refreshed this data |
ZoneApiRequestSequencesGroupsDimensions
Field | Description |
---|---|
apiHost | The host associated with this sequence of endpoint operations |
clientRequestHTTPHost | DEPRECATED (Field is replaced with apiHost ): The host associated with this sequence of endpoint operations |
datetime | Sequence generation timeslot, truncated to 10 minutes |
operationsFirstApiEndpoint | First API endpoint in the sequence of operations |
operationsFirstClientRequestHTTPMethod | First HTTP request method in the sequence of operations |
operationsLastApiEndpoint | Last API endpoint in the sequence of operations |
operationsLastClientRequestHTTPMethod | Last HTTP request method in the sequence of operations |
operationsLength | Length of the sequence of operations |
operationsPrefixApiEndpoints | API endpoints in the sequence of operations, disregarding the last operation. Individual endpoints are delimited by # symbols |
operationsPrefixClientRequestHTTPMethods | HTTP request methods in the sequence of operations, disregarding the last operation. Individual request method names are delimited by # symbols |
rank | DEPRECATED (Field is replaced with sequenceHash serving as unique sequence identifier): Sequence rank based on ordering sequences by correlation |
sequenceHash | Unique sequence identifier obtained by hashing operationsApiEndpoints and operationsClientRequestHTTPMethods |
ZoneApiRequestSequencesGroupsFilter_InputObject
Field | Description |
---|---|
ZoneApiRequestSequencesGroupsOrderBy
Field | Description |
---|---|
ZoneApiRequestSequencesGroupsUniq
Field | Description |
---|---|
rankCount | Number of unique rank values |
sequenceHashCount | Number of unique sequenceHash values |
ZoneCacheReserveOperationsAdaptiveGroups
Beta. Cache Reserve operations with adaptive sampling
Field | Description |
---|---|
avg | The average value used for sample interval |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
ZoneCacheReserveOperationsAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval |
ZoneCacheReserveOperationsAdaptiveGroupsDimensions
Field | Description |
---|---|
actionStatus | Status of the R2 operation |
bucketName | Name of bucket containing stored objects |
date | Request timestamp, truncated to start of a day |
datetime | Request timestamp |
datetimeFifteenMinutes | Request timestamp, truncated to multiple of 15 minutes |
datetimeFiveMinutes | Request timestamp, truncated to multiple of 5 minutes |
datetimeHour | Request timestamp, truncated to start of an hour |
datetimeMinute | Request timestamp, truncated to start of an minute |
jurisdiction | Jurisdiction of the R2 bucket, or 'default' if unrestricted |
operationClass | Billable class of storage operation |
ZoneCacheReserveOperationsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZoneCacheReserveOperationsAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneCacheReserveOperationsAdaptiveGroupsSum
Field | Description |
---|---|
requests | Sum of Requests |
ZoneCacheReserveRequestsAdaptiveGroups
Cache Reserve HTTP requests data with adaptive sampling
Field | Description |
---|---|
avg | The average value used for sample interval |
count | |
dimensions | List of dimensions to group by |
sum | Sum of bytes returned to client |
ZoneCacheReserveRequestsAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval |
ZoneCacheReserveRequestsAdaptiveGroupsDimensions
Field | Description |
---|---|
cacheStatus | Cache status |
date | The date the event occurred at the edge |
datetime | The date and time the event occurred at the edge |
datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
datetimeHour | The date and time the event occurred at the edge truncated to hours |
datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
edgeResponseContentTypeName | Content type returned to client |
edgeResponseStatus | HTTP response status code returned to browser |
ZoneCacheReserveRequestsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZoneCacheReserveRequestsAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneCacheReserveRequestsAdaptiveGroupsSum
Field | Description |
---|---|
edgeResponseBytes |
ZoneCacheReserveStorageAdaptiveGroups
Beta. Cache Reserve storage with adaptive sampling
Field | Description |
---|---|
avg | The average value used for sample interval |
dimensions | List of dimensions to group by |
max | The max of values for a metric per dimension |
ZoneCacheReserveStorageAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval |
ZoneCacheReserveStorageAdaptiveGroupsDimensions
Field | Description |
---|---|
bucketHash | Hash of bucket containing stored objects |
bucketName | Name of bucket containing stored objects |
date | Storage sample timestamp, truncated to start of a day |
datetime | Storage sample timestamp |
datetimeFifteenMinutes | Storage sample timestamp, truncated to multiple of 15 minutes |
datetimeFiveMinutes | Storage sample timestamp, truncated to multiple of 5 minutes |
datetimeHour | Storage sample timestamp, truncated to start of an hour |
datetimeMinute | Storage sample timestamp, truncated to start of an minute |
jurisdiction | Jurisdiction of the R2 bucket, or 'default' if unrestricted |
ZoneCacheReserveStorageAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZoneCacheReserveStorageAdaptiveGroupsMax
Field | Description |
---|---|
objectCount | Max of object count |
storedBytes | Payload and metadata size of objects in bucket |
ZoneCacheReserveStorageAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneDmarcReportsAdaptive
Dmarc report records with adaptive sampling
Field | Description |
---|---|
datetime | The date and time the source email was received |
disposition | DMARC policy disposition |
dkim | DKIM result |
domain | Domain to which this report refers to |
envelopeFrom | Envelope From of emails |
envelopeTo | Envelope To of emails |
evaluatedReason | Reason (if any) why the record was evaluated |
headerFrom | Header From of emails |
matchingMessages | Number of messages that matched |
orgName | Organization that generated report |
policyDKIMAlignmentMode | DKIM alignment mode specified in the policy |
policyDomain | DMARC policy of the domain |
policyPercentage | Percentage of emails that should be checked |
policySPFAlignmentMode | SPF alignment mode specified in the policy |
policySubDomain | DMARC policy of subdomains |
recordId | Unique identifier of this record |
recordIndex | Index of this record within the report |
reportBegin | Start of the reporting period |
reportEnd | End of the reporting period |
reportError | Error message (if any) |
reportId | Unique identifier of the report to which this record belongs |
sampleInterval | ABR sample interval |
sourceIP | Source IP address of the email |
sourceLocationName | Country name from source IP |
sourceOrgName | Source IP address organisation name |
sourceOrgSlug | Source IP address organisation slug |
sourcePTR | Source Domain from IP address |
spf | SPF result |
spfMFromDomain | Checked domain from scope mfrom |
ZoneDmarcReportsAdaptiveFilter_InputObject
Field | Description |
---|---|
ZoneDmarcReportsAdaptiveOrderBy
Field | Description |
---|---|
ZoneDmarcReportsSourcesAdaptiveGroups
Aggregated dmarc reports by sources logs with adaptive sampling
Field | Description |
---|---|
avg | Beta. The avg of values for a metric per dimension |
dimensions | List of dimensions to group by |
sum | |
uniq |
ZoneDmarcReportsSourcesAdaptiveGroupsAvg
Field | Description |
---|---|
dkimPass | Percentage of dkim messages pass |
dmarc | Percentage of dmarc messages pass |
spfPass | Percentage of spf messages pass |
ZoneDmarcReportsSourcesAdaptiveGroupsDimensions
Field | Description |
---|---|
date | The date the source email was received |
datetimeDay | The date and time the source email was received truncated to the day |
datetimeHour | The date and time the source email was received truncated to the hour |
datetimeLast31Days | The date and time the source email was received truncated to the last 31 days |
datetimeMonth | The date and time the source email was received truncated to the month |
datetimeWeek | The date and time the source email was received truncated to the week |
disposition | DMARC policy disposition |
dkim | DKIM result |
domain | Domain to which this report refers to |
envelopeFrom | Envelope From of emails |
envelopeTo | Envelope To of emails |
evaluatedReason | Reason (if any) why the record was evaluated |
headerFrom | Header From of emails |
orgName | Organization that generated report |
sampleInterval | ABR sample interval |
sourceIP | Source IP address of the email |
sourceLocationName | Country name from source IP |
sourceOrgName | Source IP address organisation name |
sourceOrgSlug | Source IP address organisation slug |
sourcePTR | Source Domain from IP address |
spf | SPF result |
spfMFromDomain | Checked domain from scope mfrom |
ZoneDmarcReportsSourcesAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZoneDmarcReportsSourcesAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneDmarcReportsSourcesAdaptiveGroupsSum
Field | Description |
---|---|
dkimPass | Total of dkim messages pass |
dmarc | Total of dmarc messages pass |
spfPass | Total of spf messages pass |
totalMatchingMessages | Total matching messages |
ZoneDmarcReportsSourcesAdaptiveGroupsUniq
Field | Description |
---|---|
ipCount | Number of distinct IPs |
ZoneDnsAnalyticsAdaptive
Analytics data for DNS queries (currently, only Foundation DNS zones are supported)
Field | Description |
---|---|
coloName | IATA airport code of the data center that processed the query |
date | Date on which the query was received |
datetime | Time at which the query was received |
destinationIP | Cloudflare edge IP address that the query was received at |
ipVersion | Internet Protocol version over which the query was received |
protocol | Transport protocol over which the query was received |
queryName | DNS query name without trailing dot |
querySize | Size of the DNS query in bytes |
queryType | DNS query type |
responseCached | Whether the DNS response was served from cache |
responseCode | DNS response code |
responseSize | Size of the DNS response in bytes |
responseStale | Whether a stale DNS response was served from cache |
sampleInterval | ABR sample interval |
sourceIP | IP address of the client that sent the query (usually this is the resolver's IP address) |
upstreamIP | Upstream server that the query was forwarded to |
ZoneDnsAnalyticsAdaptiveFilter_InputObject
Field | Description |
---|---|
ZoneDnsAnalyticsAdaptiveGroups
Analytics data for DNS queries (currently, only Foundation DNS zones are supported)
Field | Description |
---|---|
avg | Average of a metric per dimension |
count | Number of queries per dimension |
dimensions | List of dimensions to group by |
quantiles | Quantiles of a metric per dimension |
ZoneDnsAnalyticsAdaptiveGroupsAvg
Field | Description |
---|---|
processingTimeUs | Average processing time in microseconds |
sampleInterval | Average sample interval |
ZoneDnsAnalyticsAdaptiveGroupsDimensions
Field | Description |
---|---|
coloName | IATA airport code of the data center that processed the query |
date | Date on which the query was received |
datetime | Time at which the query was received |
datetimeFifteenMinutes | Time at which the query was received, truncated to multiple of 15 minutes |
datetimeFiveMinutes | Time at which the query was received, truncated to multiple of 5 minutes |
datetimeHalfOfHour | Time at which the query was received, truncated to multiple of 30 minutes |
datetimeHour | Time at which the query was received, truncated to the hour |
datetimeMinute | Time at which the query was received, truncated to the minute |
destinationIP | Cloudflare edge IP address that the query was received at |
ipVersion | Internet Protocol version over which the query was received |
protocol | Transport protocol over which the query was received |
queryName | DNS query name without trailing dot |
querySizeBucket | Size of the DNS query in bytes (in multiples of 16) |
queryType | DNS query type |
responseCached | Whether the DNS response was served from cache |
responseCode | DNS response code |
responseSizeBucket | Size of the DNS response in bytes (in multiples of 16) |
responseStale | Whether a stale DNS response was served from cache |
sourceIP | IP address of the client that sent the query (usually this is the resolver's IP address) |
upstreamIP | Upstream server that the query was forwarded to |
ZoneDnsAnalyticsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZoneDnsAnalyticsAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneDnsAnalyticsAdaptiveGroupsQuantiles
Field | Description |
---|---|
processingTimeUsP50 | 50th percentile processing time in microseconds (median) |
processingTimeUsP90 | 90th percentile processing time in microseconds |
processingTimeUsP99 | 99th percentile processing time in microseconds |
ZoneDnsAnalyticsAdaptiveOrderBy
Field | Description |
---|---|
ZoneEmailRoutingAdaptive
Beta. Raw email routing logs with adaptive sampling
Field | Description |
---|---|
datetime | The date and time the source email was received |
dkim | DKIM check status of the source email |
dmarc | DMARC check status of the source email |
errorDetail | Detailed error message (if any) |
from | The sender email address of the source email |
isNDR | Is this event related to a NDR (bounce) email? |
messageId | The Message-ID header of the source email (if present) |
ruleMatched | The UUID of the routing rule matched by the source email |
sampleInterval | ABR sample interval |
sessionId | Unique identifier for the email log entry (note: retries for the same email may result in multiple log entries) |
spf | SPF check status of the source email |
status | The resulting outcome (action) for the email |
subject | The subject of the source email |
to | The recipient email address of the source email |
ZoneEmailRoutingAdaptiveFilter_InputObject
Field | Description |
---|---|
ZoneEmailRoutingAdaptiveGroups
Beta. Aggregated email routing logs with adaptive sampling
Field | Description |
---|---|
count | Number of emails processed |
dimensions | List of dimensions to group by |
ZoneEmailRoutingAdaptiveGroupsDimensions
Field | Description |
---|---|
date | The date the source email was received |
datetimeFifteenMinutes | The date and time the source email was received truncated to fifteen minutes |
datetimeFiveMinutes | The date and time the source email was received truncated to five minutes |
datetimeHour | The date and time the source email was received truncated to the hour |
datetimeMinute | The date and time the source email was received truncated to the minute |
dkim | DKIM check status of the source email |
dmarc | DMARC check status of the source email |
isNDR | Is this event related to a NDR (bounce) email? |
ruleMatched | The UUID of the routing rule matched by the source email |
sampleInterval | ABR sample interval |
spf | SPF check status of the source email |
status | The resulting outcome (action) for the email |
ZoneEmailRoutingAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZoneEmailRoutingAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneEmailRoutingAdaptiveOrderBy
Field | Description |
---|---|
ZoneFilter_InputObject
Field | Description |
---|---|
ZoneFirewallEventsAdaptive
Raw Firewall events with adaptive sampling
Field | Description |
---|---|
action | The code of the first-class action the Cloudflare Firewall took on this request |
apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
apiGatewayMatchedHost | API Gateway host matched at the edge |
botDetectionIds | Array of detections ids that matched this request |
botDetectionTags | Array of detections tags that matched this request |
botScore | The final score originated from bot management detections. |
botScoreSrcName | Name of the source detection which generated the bot management score. |
clientASNDescription | The ASN of the visitor as string |
clientAsn | The ASN number of the visitor |
clientCountryName | Country from which request originated |
clientIP | The visitor's IP address (IPv4 or IPv6) |
clientIPClass | The classification of the visitor's IP address, possible values are: unknown | clean | badHost | searchEngine | allowlist | greylist | monitoringService | securityScanner | noRecord | scan | backupService | mobilePlatform | tor |
clientRefererHost | The referer host |
clientRefererPath | The referer path requested by visitor |
clientRefererQuery | The referer query-string was requested by the visitor |
clientRefererScheme | The referer url scheme requested by the visitor |
clientRequestHTTPHost | The HTTP hostname requested by the visitor |
clientRequestHTTPMethodName | The HTTP method used by the visitor |
clientRequestHTTPProtocol | The version of HTTP protocol requested by the visitor |
clientRequestPath | The path requested by visitor |
clientRequestQuery | The query-string was requested by the visitor |
clientRequestScheme | The url scheme requested by the visitor |
contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
contentScanNumObj | Number of scannable content objects |
contentScanObjResults | Array of scan results in order of detection |
contentScanObjSizes | Array of scan sizes in order of detection |
contentScanObjTypes | Array of content types in order of detection |
date | The date the event occurred at the edge |
datetime | The date and time the event occurred at the edge |
datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
datetimeHour | The date and time the event occurred at the edge truncated to hours |
datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
description | The description of the rule triggered by this request |
edgeColoName | The airport code of the Cloudflare datacenter that served this request |
edgeResponseStatus | HTTP response status code returned to browser |
httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion ): Version associated with HTTP Application |
ja3Hash | MD5 hash of the JA3 TLS fingerprint |
ja4 | JA4 TLS fingerprint |
ja4Signals | Inter-request statistics computed for this JA4 across Cloudflare's entire global edge network |
kind | The kind of event, currently only possible values are: firewall |
leakedCredentialCheckResult | The distinct result of checking for leaked credentials |
matchIndex | Rules match index in the chain |
metadata | Additional product-specific information. Metadata is organized in key:value pairs |
originResponseStatus | HTTP origin response status code returned to browser |
originatorRayName | The RayId of the request that issued the challenge/jschallenge |
rayName | The RayId of the request |
ref | The ref-field is a user-defined rule identifier that can be set via the API for some firewall products and allows users to label their rules individually alongside cloudflare provided identifiers (only available to entitled customers) |
ruleId | The Cloudflare security product-specific RuleId triggered by this request |
rulesetId | The Cloudflare security product-specific RulesetId triggered by this request |
sampleInterval | ABR sample interval |
source | The Cloudflare security product triggered by this request |
userAgent | visitor's user-agent string |
wafAttackScore | Beta. Overall request score generated by the WAF detection module |
wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
wafMlAttackScore | DEPRECATED (Field is replaced with wafAttackScore ): Beta. Overall request score generated by the WAF detection module |
wafMlSqliAttackScore | DEPRECATED (Field is replaced with wafSqliAttackScore ): Beta. WAF ML score for an SQLi attack |
wafMlXssAttackScore | DEPRECATED (Field is replaced with wafXssAttackScore ): Beta. WAF ML score for an XSS attack |
wafRceAttackScore | Beta. WAF score for a RCE attack |
wafSqliAttackScore | Beta. WAF score for a SQLi attack |
wafXssAttackScore | Beta. WAF score for a XSS attack |
zoneVersion | The version of a zone |
ZoneFirewallEventsAdaptiveByTimeGroups
Aggregated Firewall events with adaptive sampling grouped by time
Field | Description |
---|---|
avg | The average value used for sample interval |
count | The sum of sample interval values |
dimensions | List of dimensions to group by |
sum |
ZoneFirewallEventsAdaptiveByTimeGroupsAvg
Field | Description |
---|---|
sampleInterval |
ZoneFirewallEventsAdaptiveByTimeGroupsDimensions
Field | Description |
---|---|
apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
apiGatewayMatchedHost | API Gateway host matched at the edge |
botDetectionIds | Array of detections ids that matched this request |
botDetectionTags | Array of detections tags that matched this request |
botScore | The final score originated from bot management detections. |
botScoreSrcName | Name of the source detection which generated the bot management score. |
date | The date the event occurred at the edge |
datetime | The date and time the event occurred at the edge |
datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
datetimeHour | The date and time the event occurred at the edge truncated to hours |
datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
description | The description of the rule triggered by this request |
httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion ): Version associated with HTTP Application |
ja3Hash | MD5 hash of the JA3 TLS fingerprint |
ja4 | JA4 TLS fingerprint |
wafAttackScore | Beta. Overall request score generated by the WAF detection module |
wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
wafMlAttackScore | DEPRECATED (Field is replaced with wafAttackScore ): Beta. Overall request score generated by the WAF ML detection module |
wafMlSqliAttackScore | DEPRECATED (Field is replaced with wafSqliAttackScore ): Beta. WAF ML score for an SQLi attack |
wafMlXssAttackScore | DEPRECATED (Field is replaced with wafXssAttackScore ): Beta. WAF ML score for an XSS attack |
wafRceAttackScore | Beta. WAF score for a RCE attack |
wafSqliAttackScore | Beta. WAF score for a SQLi attack |
wafXssAttackScore | Beta. WAF score for a XSS attack |
zoneVersion | The version of a zone |
ZoneFirewallEventsAdaptiveByTimeGroupsFilter_InputObject
Field | Description |
---|---|
ZoneFirewallEventsAdaptiveByTimeGroupsOrderBy
Field | Description |
---|---|
ZoneFirewallEventsAdaptiveByTimeGroupsSum
Field | Description |
---|---|
botDetectionIdArray | Array of bot management detection ids |
botDetectionIdCountArray | Count array of bot management detection ids. Elements in this array correspond to elements in botDetectionIdArray by index. |
botDetectionTagArray | Array of bot management detection tags |
botDetectionTagCountArray | Count array of bot management detection tags. Elements in this array correspond to elements in botDetectionTagArray by index. |
ZoneFirewallEventsAdaptiveFilter_InputObject
Field | Description |
---|---|
ZoneFirewallEventsAdaptiveGroups
Aggregated Firewall events with adaptive sampling
Field | Description |
---|---|
avg | The average value used for sample interval |
count | The sum of sample interval values |
dimensions | List of dimensions to group by |
sum |
ZoneFirewallEventsAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval |
ZoneFirewallEventsAdaptiveGroupsDimensions
Field | Description |
---|---|
action | The code of the first-class action the Cloudflare Firewall took on this request |
apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
apiGatewayMatchedHost | API Gateway host matched at the edge |
botDetectionIds | Array of detections ids that matched this request |
botDetectionTags | Array of detections tags that matched this request |
botScore | The final score originated from bot management detections. |
botScoreSrcName | Name of the source detection which generated the bot management score. |
clientASNDescription | The ASN of the visitor as string |
clientAsn | The ASN number of the visitor |
clientCountryName | Country from which request originated |
clientIP | The visitor's IP address (IPv4 or IPv6) |
clientIPClass | The classification of the visitor's IP address, possible values are: unknown | clean | badHost | searchEngine | allowlist | greylist | monitoringService | securityScanner | noRecord | scan | backupService | mobilePlatform | tor |
clientRefererHost | The referer host |
clientRefererPath | The referer path requested by visitor |
clientRefererQuery | The referer query-string was requested by the visitor |
clientRefererScheme | The referer url scheme requested by the visitor |
clientRequestHTTPHost | The HTTP hostname requested by the visitor |
clientRequestHTTPMethodName | The HTTP method used by the visitor |
clientRequestHTTPProtocol | The version of HTTP protocol requested by the visitor |
clientRequestPath | The path requested by visitor |
clientRequestQuery | The query-string was requested by the visitor |
clientRequestScheme | The url scheme requested by the visitor |
contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
contentScanNumObj | Number of scannable content objects |
contentScanObjResults | Array of scan results in order of detection |
contentScanObjSizes | Array of scan sizes in order of detection |
contentScanObjTypes | Array of content types in order of detection |
date | The date the event occurred at the edge |
datetime | The date and time the event occurred at the edge |
datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
datetimeHour | The date and time the event occurred at the edge truncated to hours |
datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
description | The description of the rule triggered by this request |
edgeColoName | The airport code of the Cloudflare datacenter that served this request |
edgeResponseStatus | HTTP response status code returned to browser |
httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion ): Version associated with HTTP Application |
ja3Hash | MD5 hash of the JA3 TLS fingerprint |
ja4 | JA4 TLS fingerprint |
kind | The kind of event, currently only possible values are: firewall |
matchIndex | Rules match index in the chain |
originResponseStatus | HTTP origin response status code returned to browser |
originatorRayName | The RayId of the request that issued the challenge/jschallenge |
rayName | The RayId of the request |
ref | The ref-field is a user-defined rule identifier that can be set via the API for some firewall products and allows users to label their rules individually alongside cloudflare provided identifiers (only available to entitled customers) |
ruleId | The Cloudflare security product-specific RuleId triggered by this request |
rulesetId | The Cloudflare security product-specific RulesetId triggered by this request |
sampleInterval | ABR sample interval |
source | The Cloudflare security product triggered by this request |
userAgent | visitor's user-agent string |
wafAttackScore | Beta. Overall request score generated by the WAF detection module |
wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
wafMlAttackScore | DEPRECATED (Field is replaced with wafAttackScore ): Beta. Overall request score generated by the WAF ML detection module |
wafMlSqliAttackScore | DEPRECATED (Field is replaced with wafSqliAttackScore ): Beta. WAF ML score for an SQLi attack |
wafMlXssAttackScore | DEPRECATED (Field is replaced with wafXssAttackScore ): Beta. WAF ML score for an XSS attack |
wafRceAttackScore | Beta. WAF score for a RCE attack |
wafSqliAttackScore | Beta. WAF score for a SQLi attack |
wafXssAttackScore | Beta. WAF score for a XSS attack |
zoneVersion | The version of a zone |
ZoneFirewallEventsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZoneFirewallEventsAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneFirewallEventsAdaptiveGroupsSum
Field | Description |
---|---|
botDetectionIdArray | Array of bot management detection ids |
botDetectionIdCountArray | Count array of bot management detection ids. Elements in this array correspond to elements in botDetectionIdArray by index. |
botDetectionTagArray | Array of bot management detection tags |
botDetectionTagCountArray | Count array of bot management detection tags. Elements in this array correspond to elements in botDetectionTagArray by index. |
ZoneFirewallEventsAdaptiveJa4SignalsElem
Field | Description |
---|---|
signalName | Signal name |
signalValue | Signal value |
ZoneFirewallEventsAdaptiveMetadataElem
Field | Description |
---|---|
key | The key of the metadata. Key format can vary by Cloudflare security product and can change over time. |
value | The value of the metadata. Value format can vary by Cloudflare security product and can change over time. |
ZoneFirewallEventsAdaptiveOrderBy
Field | Description |
---|---|
ZoneHealthCheckEventsAdaptive
Raw Health Check events with adaptive sampling
Field | Description |
---|---|
date | The date the event was written to the database |
datetime | The date and time the event was written to the database |
eventId | The event id that created this healthcheck event |
expectedResponseCodes | The expected response codes for the health check |
failureReason | Reason why the health check failed |
fqdn | Fully qualified domain name of the origin (if available) |
healthChanged | 1 if the origin health status has changed since the last health check, 0 otherwise |
healthCheckId | A unique identifier for the health check |
healthCheckName | Human-identifiable health check name |
healthStatus | Origin health status |
originIP | IP address of the origin |
originResponseStatus | HTTP status code returned by the origin |
region | Region where the health check occurred |
rttMs | RTT (milliseconds) to reach the origin |
sampleInterval | ABR sample interval |
scope | Geographic aggregation level of the health status |
tcpConnMs | Time taken for the tcp connection to be established |
timeToFirstByteMs | Time taken for the first byte to be received once connection is available |
tlsHandshakeMs | Time taken for the tls handshake to be completed |
ZoneHealthCheckEventsAdaptiveFilter_InputObject
Field | Description |
---|---|
ZoneHealthCheckEventsAdaptiveGroups
Aggregated Health Check events with adaptive sampling
Field | Description |
---|---|
avg | The average value for a metric |
count | The number of values for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
ZoneHealthCheckEventsAdaptiveGroupsAvg
Field | Description |
---|---|
rttMs | Average RTT (milliseconds) |
sampleInterval | Average sample interval |
tcpConnMs | Average TCP Connection time (milliseconds) |
timeToFirstByteMs | Average Time To First Byte (milliseconds) |
tlsHandshakeMs | Average TLS Handshake time (milliseconds) |
ZoneHealthCheckEventsAdaptiveGroupsDimensions
Field | Description |
---|---|
date | The date the event was written to the database |
datetime | Datetime the event was written to the database |
datetimeFifteenMinutes | Datetime the event was written to the database truncated to a multiple of 15 minutes |
datetimeFiveMinutes | Datetime the event was written to the database truncated to a multiple of 5 minutes |
datetimeHour | Datetime the event was written to the database truncated to the hour |
datetimeMinute | Datetime the event was written to the database truncated to the minute |
failureReason | Reason why the health check failed |
fqdn | Fully qualified domain name of the origin (if available) |
healthChanged | 1 if the origin health status has changed since the last health check, 0 otherwise |
healthCheckId | A unique identifier for the health check |
healthCheckName | Human-identifiable health check name |
healthStatus | Origin health status |
originIP | IP address of the origin |
originResponseStatus | HTTP status code returned by the origin |
region | Region where the health check occurred |
rttMs | RTT (milliseconds) to reach the origin |
sampleInterval | ABR sample interval |
scope | Geographic aggregation level of the health status |
tcpConnMs | Time taken for the tcp connection to be established |
timeToFirstByteMs | Time taken for the first byte to be received once connection is available |
tlsHandshakeMs | Time taken for the tls handshake to be completed |
ZoneHealthCheckEventsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZoneHealthCheckEventsAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneHealthCheckEventsAdaptiveGroupsSum
Field | Description |
---|---|
healthStatus |
ZoneHealthCheckEventsAdaptiveOrderBy
Field | Description |
---|---|
ZoneHttpRequests1dByColoGroups
Daily rollups of request data by colo
Field | Description |
---|---|
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
ZoneHttpRequests1dByColoGroupsCountryMapElem
Field | Description |
---|---|
clientCountryName | Country from which request originated |
requests | |
threats | Requests classified as threats |
ZoneHttpRequests1dByColoGroupsDimensions
Field | Description |
---|---|
coloCode | Code of edge server |
date | Request date |
ZoneHttpRequests1dByColoGroupsFilter_InputObject
Field | Description |
---|---|
ZoneHttpRequests1dByColoGroupsOrderBy
Field | Description |
---|---|
ZoneHttpRequests1dByColoGroupsResponseStatusMapElem
Field | Description |
---|---|
edgeResponseStatus | HTTP response status code returned to client |
requests |
ZoneHttpRequests1dByColoGroupsSum
Field | Description |
---|---|
bytes | Bytes returned to client |
cachedBytes | Bytes returned to client from cache |
cachedRequests | Requests served from cache |
countryMap | |
requests | |
responseStatusMap | |
threatPathingMap |
ZoneHttpRequests1dByColoGroupsThreatPathingMapElem
Field | Description |
---|---|
requests | |
threatPathingName | Threat type |
ZoneHttpRequests1dGroups
Daily rollups of request data
Field | Description |
---|---|
avg | The average value for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
uniq | The number of unique values for a metric per dimension |
ZoneHttpRequests1dGroupsAvg
Field | Description |
---|---|
bytes | |
sampleInterval | Average sample interval |
ZoneHttpRequests1dGroupsBrowserMapElem
Field | Description |
---|---|
pageViews | Successful requests for HTML content |
uaBrowserFamily | Browser type |
ZoneHttpRequests1dGroupsClientHTTPVersionMapElem
Field | Description |
---|---|
clientHTTPProtocol | HTTP version |
requests |
ZoneHttpRequests1dGroupsClientSSLMapElem
Field | Description |
---|---|
clientSSLProtocol | Protocol version |
requests |
ZoneHttpRequests1dGroupsContentTypeMapElem
Field | Description |
---|---|
bytes | Bytes returned to client |
edgeResponseContentTypeName | Content type returned to client |
requests |
ZoneHttpRequests1dGroupsCountryMapElem
Field | Description |
---|---|
bytes | Bytes returned to client |
clientCountryName | Country from which request originated |
requests | |
threats | Requests classified as threats |
ZoneHttpRequests1dGroupsDimensions
Field | Description |
---|---|
date | Request date |
ZoneHttpRequests1dGroupsFilter_InputObject
Field | Description |
---|---|
ZoneHttpRequests1dGroupsIpClassMapElem
Field | Description |
---|---|
ipType | IP class |
requests |
ZoneHttpRequests1dGroupsOrderBy
Field | Description |
---|---|
ZoneHttpRequests1dGroupsResponseStatusMapElem
Field | Description |
---|---|
edgeResponseStatus | HTTP response status code returned to client |
requests |
ZoneHttpRequests1dGroupsSum
Field | Description |
---|---|
browserMap | |
bytes | Bytes returned to client |
cachedBytes | Bytes returned to client from cache |
cachedRequests | Requests served from cache |
clientHTTPVersionMap | |
clientSSLMap | |
contentTypeMap | |
countryMap | |
encryptedBytes | Bytes returned to client using SSL/TLS protocol |
encryptedRequests | Requests served using SSL/TLS protocol |
ipClassMap | |
pageViews | Successful requests for HTML content |
requests | |
responseStatusMap | |
threatPathingMap | |
threats | Requests classified as threats |
ZoneHttpRequests1dGroupsThreatPathingMapElem
Field | Description |
---|---|
requests | |
threatPathingName | Threat type |
ZoneHttpRequests1dGroupsUniq
Field | Description |
---|---|
uniques | A number of unique IPs |
ZoneHttpRequests1hGroups
Hourly rollups of request data
Field | Description |
---|---|
avg | The average value for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
uniq | The number of unique values for a metric per dimension |
ZoneHttpRequests1hGroupsAvg
Field | Description |
---|---|
bytes | |
sampleInterval | Average sample interval |
ZoneHttpRequests1hGroupsBrowserMapElem
Field | Description |
---|---|
pageViews | Successful requests for HTML content |
uaBrowserFamily | Browser type |
ZoneHttpRequests1hGroupsClientHTTPVersionMapElem
Field | Description |
---|---|
clientHTTPProtocol | HTTP version |
requests |
ZoneHttpRequests1hGroupsClientSSLMapElem
Field | Description |
---|---|
clientSSLProtocol | Protocol version |
requests |
ZoneHttpRequests1hGroupsContentTypeMapElem
Field | Description |
---|---|
bytes | Bytes returned to client |
edgeResponseContentTypeName | Content type returned to client |
requests |
ZoneHttpRequests1hGroupsCountryMapElem
Field | Description |
---|---|
bytes | Bytes returned to client |
clientCountryName | Country from which request originated |
requests | |
threats | Requests classified as threats |
ZoneHttpRequests1hGroupsDimensions
Field | Description |
---|---|
date | Request date |
datetime | Request datetime truncated to the hour |
ZoneHttpRequests1hGroupsFilter_InputObject
Field | Description |
---|---|
ZoneHttpRequests1hGroupsIpClassMapElem
Field | Description |
---|---|
ipType | IP class |
requests |
ZoneHttpRequests1hGroupsOrderBy
Field | Description |
---|---|
ZoneHttpRequests1hGroupsResponseStatusMapElem
Field | Description |
---|---|
edgeResponseStatus | HTTP response status code returned to client |
requests |
ZoneHttpRequests1hGroupsSum
Field | Description |
---|---|
browserMap | |
bytes | Bytes returned to client |
cachedBytes | Bytes returned to client from cache |
cachedRequests | Requests served from cache |
clientHTTPVersionMap | |
clientSSLMap | |
contentTypeMap | |
countryMap | |
encryptedBytes | Bytes returned to client using SSL/TLS protocol |
encryptedRequests | Requests served using SSL/TLS protocol |
ipClassMap | |
pageViews | Successful requests for HTML content |
requests | |
responseStatusMap | |
threatPathingMap | |
threats | Requests classified as threats |
ZoneHttpRequests1hGroupsThreatPathingMapElem
Field | Description |
---|---|
requests | |
threatPathingName | Threat type |
ZoneHttpRequests1hGroupsUniq
Field | Description |
---|---|
uniques | A number of unique IPs |
ZoneHttpRequests1mByColoGroups
Minutely rollups of request data by colo
Field | Description |
---|---|
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
ZoneHttpRequests1mByColoGroupsCountryMapElem
Field | Description |
---|---|
clientCountryName | Country from which request originated |
requests | |
threats | Requests classified as threats |
ZoneHttpRequests1mByColoGroupsDimensions
Field | Description |
---|---|
coloCode | Code of edge server |
date | Request date |
datetime | Request datetime |
datetimeFifteenMinutes | Request datetime truncated to multiple of 15 minutes |
datetimeHalfOfHour | Request datetime truncated to multiple of 30 minutes |
datetimeHour | Request datetime truncated to the hour |
ZoneHttpRequests1mByColoGroupsFilter_InputObject
Field | Description |
---|---|
ZoneHttpRequests1mByColoGroupsOrderBy
Field | Description |
---|---|
ZoneHttpRequests1mByColoGroupsResponseStatusMapElem
Field | Description |
---|---|
edgeResponseStatus | HTTP response status code returned to client |
requests |
ZoneHttpRequests1mByColoGroupsSum
Field | Description |
---|---|
bytes | Bytes returned to client |
cachedBytes | Bytes returned to client from cache |
cachedRequests | Requests served from cache |
countryMap | |
requests | |
responseStatusMap | |
threatPathingMap |
ZoneHttpRequests1mByColoGroupsThreatPathingMapElem
Field | Description |
---|---|
requests | |
threatPathingName | Threat type |
ZoneHttpRequests1mGroups
Minutely rollups of request data
Field | Description |
---|---|
avg | The average value for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
uniq | The number of unique values for a metric per dimension |
ZoneHttpRequests1mGroupsAvg
Field | Description |
---|---|
bytes | |
sampleInterval | Average sample interval |
ZoneHttpRequests1mGroupsBrowserMapElem
Field | Description |
---|---|
pageViews | Successful requests for HTML content |
uaBrowserFamily | Browser type |
ZoneHttpRequests1mGroupsClientHTTPVersionMapElem
Field | Description |
---|---|
clientHTTPProtocol | HTTP version |
requests |
ZoneHttpRequests1mGroupsClientSSLMapElem
Field | Description |
---|---|
clientSSLProtocol | Protocol version |
requests |
ZoneHttpRequests1mGroupsContentTypeMapElem
Field | Description |
---|---|
bytes | Bytes returned to client |
edgeResponseContentTypeName | Content type returned to client |
requests |
ZoneHttpRequests1mGroupsCountryMapElem
Field | Description |
---|---|
bytes | Bytes returned to client |
clientCountryName | Country from which request originated |
requests | |
threats | Requests classified as threats |
ZoneHttpRequests1mGroupsDimensions
Field | Description |
---|---|
date | Request date |
datetime | Request datetime, truncated to the minute |
datetimeDay | Request datetime truncated to the day |
datetimeFifteenMinutes | Request datetime truncated to multiple of 15 minutes |
datetimeFiveMinutes | Request datetime truncated to multiple of 5 minutes |
datetimeHalfOfHour | Request datetime truncated to multiple of 30 minutes |
datetimeHour | Request datetime truncated to the hour |
datetimeMinute | DEPRECATED (Field is replaced with datetime ): Request datetime truncated to the minute |
ZoneHttpRequests1mGroupsFilter_InputObject
Field | Description |
---|---|
ZoneHttpRequests1mGroupsIpClassMapElem
Field | Description |
---|---|
ipType | IP class |
requests |
ZoneHttpRequests1mGroupsOrderBy
Field | Description |
---|---|
ZoneHttpRequests1mGroupsResponseStatusMapElem
Field | Description |
---|---|
edgeResponseStatus | HTTP response status code returned to client |
requests |
ZoneHttpRequests1mGroupsSum
Field | Description |
---|---|
browserMap | |
bytes | Bytes returned to client |
cachedBytes | Bytes returned to client from cache |
cachedRequests | Requests served from cache |
clientHTTPVersionMap | |
clientSSLMap | |
contentTypeMap | |
countryMap | |
encryptedBytes | Bytes returned to client using SSL/TLS protocol |
encryptedRequests | Requests served using SSL/TLS protocol |
ipClassMap | |
pageViews | Successful requests for HTML content |
requests | |
responseStatusMap | |
threatPathingMap | |
threats | Requests classified as threats |
ZoneHttpRequests1mGroupsThreatPathingMapElem
Field | Description |
---|---|
requests | |
threatPathingName | Threat type |
ZoneHttpRequests1mGroupsUniq
Field | Description |
---|---|
uniques | A number of unique IPs |
ZoneHttpRequestsAdaptive
Raw HTTP requests with adaptive sampling
Field | Description |
---|---|
apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
apiGatewayMatchedHost | API Gateway host matched at the edge |
botDetectionIds | Array of detections ids that matched this request |
botDetectionTags | Array of detections tags that matched this request |
botManagementDecision | Judgement of the bot management system |
botScore | The final score originated from bot management detections. |
botScoreBucketBy10 | Range of the bot management score |
botScoreSrcName | Name of the source detection which generated the bot management score. |
cacheReserveUsed | Used Cache Reserve to serve the response |
cacheStatus | Cache status |
clientASNDescription | The ASN of the visitor as string |
clientAsn | The ASN number of the visitor |
clientCountryName | Country from which request originated |
clientDeviceType | |
clientIP | The visitor's IP address (IPv4 or IPv6) |
clientRefererHost | The referrer host |
clientRequestHTTPHost | The HTTP hostname requested by the visitor |
clientRequestHTTPMethodName | HTTP method of client request |
clientRequestHTTPProtocol | The version of HTTP protocol requested by the visitor |
clientRequestPath | The path requested by visitor |
clientRequestQuery | Query parameters of client request |
clientRequestReferer | HTTP request referrer |
clientRequestScheme | The url scheme requested by the visitor |
clientSSLProtocol | SSL protocol version |
coloCode | |
contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
contentScanNumObj | Number of scannable content objects |
contentScanObjResults | Array of scan results in order of detection |
contentScanObjSizes | Array of scan sizes in order of detection |
contentScanObjTypes | Array of content types in order of detection |
date | The date the event occurred at the edge |
datetime | The date and time the event occurred at the edge |
datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
datetimeHour | The date and time the event occurred at the edge truncated to hours |
datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
edgeDnsResponseTimeMs | The time elapsed resolving a CNAME if it was required to reach your origin |
edgeResponseContentTypeName | |
edgeResponseStatus | HTTP response status code returned to browser |
edgeTimeToFirstByteMs | The time elapsed between processing the first byte of the request until when we started sending a response |
httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion ): Version associated with HTTP Application |
isCrossZoneSubrequest | '1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise. |
ja3Hash | MD5 hash of the JA3 TLS fingerprint |
ja4 | JA4 TLS fingerprint |
ja4Signals | Inter-request statistics computed for this JA4 across Cloudflare's entire global edge network |
leakedCredentialCheckResult | The distinct result of checking for leaked credentials |
originASN | |
originASNDescription | ASN associated with origin |
originIP | |
originResponseDurationMs | |
originResponseStatus | HTTP origin response status code returned to browser |
rayName | The RayId of the request |
requestSource | |
securityAction | The code of the first-class action the Cloudflare Firewall took on this request |
securitySource | The Cloudflare security product triggered by this request |
upperTierColoName | |
userAgent | visitor's user-agent string |
userAgentBrowser | Browser parsed from the user agent |
userAgentOS | OS parsed from the user agent |
wafAttackScore | Beta. Overall request score generated by the WAF detection module |
wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
wafRceAttackScore | Beta. WAF score for a RCE attack |
wafSqliAttackScore | Beta. WAF score for a SQLi attack |
wafXssAttackScore | Beta. WAF score for a XSS attack |
xRequestedWith | The X-Requested-With header of the client request |
zoneVersion | The version of a zone |
ZoneHttpRequestsAdaptiveFilter_InputObject
Field | Description |
---|---|
ZoneHttpRequestsAdaptiveGroups
Aggregated HTTP requests data with adaptive sampling
Field | Description |
---|---|
avg | The average value used for sample interval |
confidence | ALPHA - DO NOT USE |
count | The number of values for a metric per dimension |
dimensions | List of dimensions to group by |
quantiles | Quantiles of a metric per dimension |
ratio | The ratio of a range of status codes, between 0 and 1 |
sum | The sum of values for a metric per dimension |
ZoneHttpRequestsAdaptiveGroupsAvg
Field | Description |
---|---|
crossZoneSubrequests | The proportion of requests that were inititiated by a Cloudflare Worker on another zone |
edgeDnsResponseTimeMs | |
edgeTimeToFirstByteMs | |
originResponseDurationMs | The average originResponseDuration, in milliseconds, excluding 0 values (i.e. cached ones) |
sampleInterval |
ZoneHttpRequestsAdaptiveGroupsConfidence
Field | Description |
---|---|
count | The number of values for a metric per dimension, with confidence intervals |
level | Confidence level that was requested |
sum | The sum of values for a metric per dimension, with confidence intervals |
ZoneHttpRequestsAdaptiveGroupsDimensions
Field | Description |
---|---|
apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
apiGatewayMatchedHost | API Gateway host matched at the edge |
botDetectionIds | Array of detections ids that matched this request |
botDetectionTags | Array of detections tags that matched this request |
botManagementDecision | Judgement of the bot management system |
botScore | The final score originated from bot management detections. |
botScoreBucketBy10 | Range of the bot management score |
botScoreSrcName | Name of the source detection which generated the bot management score. |
cacheReserveUsed | Used Cache Reserve to serve the response |
cacheStatus | |
clientASNDescription | The ASN of the visitor as string |
clientAsn | |
clientCountryName | Country from which request originated |
clientDeviceType | |
clientIP | |
clientRefererHost | The referrer host |
clientRequestHTTPHost | Host requested by the client |
clientRequestHTTPMethodName | HTTP method of client request |
clientRequestHTTPProtocol | HTTP protocol version |
clientRequestPath | Path of client request |
clientRequestQuery | Query parameters of client request |
clientRequestReferer | HTTP request referrer |
clientRequestScheme | HTTP request URI scheme (http/https) |
clientSSLProtocol | SSL protocol version |
coloCode | |
contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
contentScanNumObj | Number of scannable content objects |
contentScanObjResults | Array of scan results in order of detection |
contentScanObjSizes | Array of scan sizes in order of detection |
contentScanObjTypes | Array of content types in order of detection |
date | The date the event occurred at the edge |
datetime | The date and time the event occurred at the edge |
datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
datetimeHour | The date and time the event occurred at the edge truncated to hours |
datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
edgeDnsResponseTimeMs | The time elapsed resolving a CNAME if it was required to reach your origin |
edgeResponseContentTypeName | |
edgeResponseStatus | |
edgeTimeToFirstByteMs | The time elapsed between processing the first byte of the request until when we started sending a response |
httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion ): Version associated with HTTP Application |
isCrossZoneSubrequest | '1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise. |
ja3Hash | MD5 hash of the JA3 TLS fingerprint |
ja4 | JA4 TLS fingerprint |
leakedCredentialCheckResult | The distinct result of checking for leaked credentials |
originASN | |
originASNDescription | ASN associated with origin |
originIP | |
originResponseDurationMs | |
originResponseStatus | HTTP response status code returned by the origin |
requestSource | |
sampleInterval | ABR sample interval |
securityAction | The code of the first-class action the Cloudflare Firewall took on this request |
securitySource | The Cloudflare security product triggered by this request |
upperTierColoName | |
userAgent | |
userAgentBrowser | Browser parsed from the user agent |
userAgentOS | OS parsed from the user agent |
wafAttackScore | Beta. Overall request score generated by the WAF detection module |
wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
wafRceAttackScore | Beta. WAF score for a RCE attack |
wafSqliAttackScore | Beta. WAF score for a SQLi attack |
wafXssAttackScore | Beta. WAF score for a XSS attack |
xRequestedWith | The X-Requested-With header of the client request |
zoneVersion | The version of a zone |
ZoneHttpRequestsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZoneHttpRequestsAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneHttpRequestsAdaptiveGroupsQuantiles
Field | Description |
---|---|
edgeDnsResponseTimeMsP50 | 50th percentile DNS Response Time (milliseconds) |
edgeDnsResponseTimeMsP95 | 95th percentile DNS Response Time (milliseconds) |
edgeDnsResponseTimeMsP99 | 99th percentile DNS Response Time (milliseconds) |
edgeTimeToFirstByteMsP50 | 50th percentile Time To First Byte (milliseconds) |
edgeTimeToFirstByteMsP95 | 95th percentile Time To First Byte (milliseconds) |
edgeTimeToFirstByteMsP99 | 99th percentile Time To First Byte (milliseconds) |
originResponseDurationMsP50 | 50th percentile Origin Response Duration (milliseconds) |
originResponseDurationMsP95 | 95th percentile Origin Response Duration (milliseconds) |
originResponseDurationMsP99 | 99th percentile Origin Response Duration (milliseconds) |
ZoneHttpRequestsAdaptiveGroupsRatio
Field | Description |
---|---|
status4xx | |
status5xx |
ZoneHttpRequestsAdaptiveGroupsSum
Field | Description |
---|---|
botDetectionIdArray | Array of bot management detection ids |
botDetectionIdCountArray | Count array of bot management detection ids. Elements in this array correspond to elements in botDetectionIdArray by index. |
botDetectionTagArray | Array of bot management detection tags |
botDetectionTagCountArray | Count array of bot management detection tags. Elements in this array correspond to elements in botDetectionTagArray by index. |
crossZoneSubrequests | The number of requests that were inititiated by a Cloudflare Worker on another zone |
edgeDnsResponseTimeMs | |
edgeResponseBytes | |
edgeTimeToFirstByteMs | |
originResponseDurationMs | |
visits | The number of requests by end-users that were initiated from a different website (i.e. where the request HTTP Referer header does not match the host in the HTTP Host header) |
ZoneHttpRequestsAdaptiveGroupsSumConfidence
Field | Description |
---|---|
edgeResponseBytes | Confidence interval for the corresponding point estimate |
ZoneHttpRequestsAdaptiveJa4SignalsElem
Field | Description |
---|---|
signalName | Signal name |
signalValue | Signal value |
ZoneHttpRequestsAdaptiveOrderBy
Field | Description |
---|---|
ZoneHttpRequestsOverviewAdaptiveGroups
A high-level summary of HTTP requests made by end users.
Field | Description |
---|---|
avg | The average value for a metric per dimension |
dimensions | List of dimensions to group by |
ratio | The ratio of a metric in comparison to the rest of the traffic, between 0 and 1 |
sum | The sum of values for a metric per dimension |
ZoneHttpRequestsOverviewAdaptiveGroupsAvg
Field | Description |
---|---|
originResponseDurationMs | The average originResponseDuration, in milliseconds, excluding 0 values (i.e. cached ones) |
sampleInterval | Average sample interval |
ZoneHttpRequestsOverviewAdaptiveGroupsDimensions
Field | Description |
---|---|
clientCountryName | Country from which request originated |
clientRequestHTTPProtocol | HTTP protocol version |
clientSSLProtocol | SSL protocol version |
date | The date the event occurred at the edge |
datetime | The date and time the event occurred at the edge |
datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
datetimeHour | The date and time the event occurred at the edge truncated to hours |
datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
edgeResponseContentTypeName | Content type returned to client |
edgeResponseStatus | HTTP response status code returned to client |
httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion ): Version associated with HTTP Application |
userAgentBrowser | Browser parsed from the user agent |
zoneVersion | The version of a zone |
ZoneHttpRequestsOverviewAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZoneHttpRequestsOverviewAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneHttpRequestsOverviewAdaptiveGroupsRatio
Field | Description |
---|---|
cachedBytes | |
cachedRequests | |
encryptedBytes | |
encryptedRequests | |
status4xx | |
status5xx |
ZoneHttpRequestsOverviewAdaptiveGroupsSum
Field | Description |
---|---|
bytes | |
cachedBytes | Bytes returned to client from cache |
cachedRequests | Requests served from cache |
pageViews | Successful requests for HTML content |
requests | |
visits | The number of requests by end-users that were initiated from a different website (i.e. where the request HTTP Referer header does not match the host in the HTTP Host header) |
ZoneImageResizingRequests1mGroups
Minutely rollups of Image Resizing requests
Field | Description |
---|---|
count | Counts a number of rows per specific dimensions |
dimensions | List of dimensions to group by |
sum | Calculates a sum of each field per speicific dimensions |
ZoneImageResizingRequests1mGroupsDimensions
Field | Description |
---|---|
contentType | |
date | |
datetime | |
datetimeFifteenMinutes | |
datetimeFiveMinutes | |
datetimeHour | |
datetimeMinute | |
resizeError | Error description when a resized image was requested but could not be served |
ZoneImageResizingRequests1mGroupsFilter_InputObject
Field | Description |
---|---|
ZoneImageResizingRequests1mGroupsOrderBy
Field | Description |
---|---|
ZoneImageResizingRequests1mGroupsSum
Field | Description |
---|---|
originalBytes | The size of the image before resizing |
originalPixels | The area of the image before resizing |
requests | Count of image resizing requests |
resizedBytes | The size of the image after resizing |
resizedPixels | The area of the image after resizing |
ZoneLoadBalancingRequestsAdaptive
Raw Load Balancing origin requests with adaptive sampling
Field | Description |
---|---|
coloCode | IATA airport code of data center that received the request |
datetime | Request datetime |
errorType | Error generated when selecting an origin |
lbName | Load balancer name |
numberOriginsSelected | Number of origins that were selected and returned to the client |
origins | All origins in the pool that was selected based on steering policy |
pools | List of pools from which a pool will be selected based on steering policy |
proxied | Whether traffic is proxied through the Cloudflare network (orange-clouded) |
region | Load balancing region where request originated |
sampleInterval | ABR sample interval |
selectedOriginIndex | Index of the selected origin from the list of all origins. If multiple origins were selected, this is the index of the first origin in that list |
selectedPoolAvgRttMs | Average RTT (milliseconds) to reach the origins within the selected pool |
selectedPoolHealthChecksEnabled | Health checks active status for the selected pool |
selectedPoolHealthy | Health status for the selected pool |
selectedPoolId | A unique identifier for the selected pool |
selectedPoolIndex | Index of the selected pool from the list of all pools |
selectedPoolName | Name for the selected pool |
sessionAffinity | Type of session affinity enabled |
sessionAffinityStatus | Current status of session affinity |
steeringPolicy | Policy by which the load balancer will route traffic |
ZoneLoadBalancingRequestsAdaptiveFilter_InputObject
Field | Description |
---|---|
ZoneLoadBalancingRequestsAdaptiveGroups
Aggregated Load Balancing origin requests with adaptive sampling
Field | Description |
---|---|
avg | |
count | The number of values for a metric per dimension |
dimensions | List of dimensions to group by |
ZoneLoadBalancingRequestsAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval | Average sample interval |
ZoneLoadBalancingRequestsAdaptiveGroupsDimensions
Field | Description |
---|---|
coloCode | IATA airport code of data center that received the request |
datetime | Request datetime |
datetimeFifteenMinutes | Request datetime truncated to multiple of 15 minutes |
datetimeFiveMinutes | Request datetime truncated to multiple of 5 minutes |
datetimeHalfOfHour | Request datetime truncated to multiple of 30 minutes |
datetimeHour | Request datetime truncated to the hour |
datetimeMinute | Request datetime truncated to multiple of 1 minute |
errorType | Error generated when selecting an origin |
lbName | Load balancer name |
multipleOriginsSelected | Indicates whether multiple origins were returned to the client |
numberOriginsSelected | Number of origins that were selected and returned to the client |
proxied | Whether traffic is proxied through the Cloudflare network (orange-clouded) |
region | Load balancing region where request originated |
sampleInterval | ABR sample interval |
selectedOriginIndex | Index of the selected origin from the list of all origins. If multiple origins were selected, this is the index of the first origin in that list |
selectedOriginName | Name of the selected origin |
selectedOriginNames | Names of each selected origin |
selectedPoolAvgRttMs | Dynamic Latency: RTT (milliseconds) to reach the origin pool |
selectedPoolHealthChecksEnabled | Health checks status for the selected pool |
selectedPoolHealthy | Health status for the selected pool |
selectedPoolId | A unique identifier for the selected pool |
selectedPoolIndex | Index of the selected pool from the list of all pools |
selectedPoolName | Name for the selected pool |
sessionAffinityEnabled | Type of session affinity enabled |
sessionAffinityStatus | Current status of session affinity |
steeringPolicy | Policy by which the load balancer will route traffic |
ZoneLoadBalancingRequestsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZoneLoadBalancingRequestsAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneLoadBalancingRequestsAdaptiveOrderBy
Field | Description |
---|---|
ZoneLoadBalancingRequestsAdaptiveOriginsElem
Field | Description |
---|---|
fqdn | Fully qualified domain name of the origin (if available) |
health | Origin health status |
ipv4 | IPv4 Address of the origin |
ipv6 | IPv6 address of the origin |
originName | Origin name |
selected | All the origins that were returned to the client |
weight | Ratio of traffic that will be distributed to this origin among all origins in the pool |
ZoneLoadBalancingRequestsAdaptivePoolsElem
Field | Description |
---|---|
avgRttMs | Dynamic Latency: RTT (milliseconds) to reach the origin pool |
distance | Distance to Pool KM |
healthCheckEnabled | Health checks status |
healthy | Pool health status |
id | A unique identifier for the pool |
poolName | Pool name |
ZoneLogpushHealthAdaptiveGroups
Beta. Logpush job health metrics
Field | Description |
---|---|
avg | |
count | The number of values for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
ZoneLogpushHealthAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval | Average sample interval |
ZoneLogpushHealthAdaptiveGroupsDimensions
Field | Description |
---|---|
date | Date that we completed pushing the log batch |
datetime | Datetime that we completed pushing the log batch |
datetimeFifteenMinutes | Datetime that we completed pushing the log batch, truncated to multiple of 15 minutes |
datetimeFiveMinutes | Datetime that we completed pushing the log batch, truncated to multiple of 5 minutes |
datetimeHour | Datetime that we completed pushing the log batch, truncated to the hour |
datetimeMinute | Datetime that we completed pushing the log batch, truncated to the minute |
destinationType | Destination type, e.g. 'S3' or 'GCS' |
final | Cloudflare may attempt to push a batch of logs multiple times if we encounter a failure. This field will be set to 'true' if this was the last push attempt for this batch of logs. If this field is set to false, it means the push failed but another retry was attempted. If this field is set to true and status >= 300, then the batch of logs failed to push and log data was lost. If you want to count the total number of logs that succeeded or failed, you should always set final = true. |
jobId | The Logpush Job ID |
status | HTTP response status code of the log destination |
ZoneLogpushHealthAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZoneLogpushHealthAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneLogpushHealthAdaptiveGroupsSum
Field | Description |
---|---|
bytes | Bytes of uncompressed log data pushed |
bytesCompressed | Bytes of compressed log data pushed |
records | A count of the total number of records pushed. |
ZoneNelReportsAdaptiveGroups
Data to visualize network error logs
Field | Description |
---|---|
avg | |
count | The number of NEL Reports |
dimensions | List of dimensions to group by |
ZoneNelReportsAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval | Average sample interval |
ZoneNelReportsAdaptiveGroupsDimensions
Field | Description |
---|---|
clientIPASN | Client ASN |
clientIPASNDescription | Client ASN Description |
clientIPCountry | Client Country |
clientIPCountryCode | 2 letter client country code using ISO 3166-1 alpha-2 syntax |
clientIPVersion | IP Version the client used to connect |
date | Request date from browser |
datetime | Request datetime from browser |
datetimeFifteenMinutes | Request datetime from browser, truncated to multiple of 15 minutes |
datetimeFiveMinutes | Request datetime from browser, truncated to multiple of 5 minutes |
datetimeHalfOfHour | Request datetime from browser, truncated to multiple of 30 minutes |
datetimeHour | Request datetime from browser, truncated to the hour |
datetimeMinute | Request datetime from browser, truncated to the minute |
lastKnownGoodColoCode | IATA airport code of colo the client connected to |
phase | The phase of connection the error occurred in |
protocol | HTTP Protocol used when the error occured |
type | The type of error in the phase |
ZoneNelReportsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZoneNelReportsAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZonePageShieldReportsAdaptiveGroups
Page Shield CSP reports
Field | Description |
---|---|
avg | |
count | Number of Page Shield CSP reports |
dimensions | List of dimensions to group by |
ZonePageShieldReportsAdaptiveGroupsAvg
Field | Description |
---|---|
sampleInterval | Average sample interval |
ZonePageShieldReportsAdaptiveGroupsDimensions
Field | Description |
---|---|
action | policy action, log | allow |
cspDirective | csp directive e.g 'script-src' |
date | |
datetime | The date and time the event occurred at the edge |
datetimeFifteenMinutes | Report datetime from edge, truncated to multiple of 15 minutes |
datetimeFiveMinutes | Report datetime from edge, truncated to multiple of 5 minutes |
datetimeHalfOfHour | Report datetime from edge, truncated to multiple of 30 minutes |
datetimeHour | Report datetime from edge, truncated to the hour |
datetimeMinute | Report datetime from edge, truncated to the minute |
host | hostname of the zone |
pageURL | page on which the resource was found |
policyID | The ID of the Policy |
resourceType | resource type e.g script |
url | URL of the CSP reported resource |
urlHost | hostname of the resource URL |
ZonePageShieldReportsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZonePageShieldReportsAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneSettings
Access and limitations for a zone
Field | Description |
---|---|
apiGatewayGraphqlQueryAnalyticsGroups | |
apiGatewayMatchedSessionIDsAdaptiveGroups | |
apiGatewayMatchedSessionIDsPerEndpointAdaptiveGroups | |
apiRequestSequencesGroups | |
cacheReserveOperationsAdaptiveGroups | |
cacheReserveRequestsAdaptiveGroups | |
cacheReserveStorageAdaptiveGroups | |
dmarcReportsAdaptive | |
dmarcReportsSourcesAdaptiveGroups | |
dnsAnalyticsAdaptive | |
dnsAnalyticsAdaptiveGroups | |
emailRoutingAdaptive | |
emailRoutingAdaptiveGroups | |
firewallEventsAdaptive | |
firewallEventsAdaptiveByTimeGroups | |
firewallEventsAdaptiveGroups | |
healthCheckEventsAdaptive | |
healthCheckEventsAdaptiveGroups | |
httpRequests1dByColoGroups | |
httpRequests1dGroups | |
httpRequests1hGroups | |
httpRequests1mByColoGroups | |
httpRequests1mGroups | |
httpRequestsAdaptive | |
httpRequestsAdaptiveGroups | |
httpRequestsOverviewAdaptiveGroups | |
imageResizingRequests1mGroups | |
loadBalancingRequestsAdaptive | |
loadBalancingRequestsAdaptiveGroups | |
logpushHealthAdaptiveGroups | |
nelReportsAdaptiveGroups | |
pageShieldReportsAdaptiveGroups | |
waitingRoomAnalyticsAdaptive | |
waitingRoomAnalyticsAdaptiveGroups | |
workersZoneInvocationsAdaptiveGroups | |
workersZoneSubrequestsAdaptiveGroups | |
zarazActionsAdaptiveGroups | |
zarazAnalyticsIdentitiesAdaptiveGroups | |
zarazAnalyticsOrderedTrackAdaptive | |
zarazAnalyticsOrderedTrackAdaptiveGroups | |
zarazAnalyticsTrackAdaptiveGroups | |
zarazAnalyticsTrackTrafficSourcesAdaptiveGroups | |
zarazAnalyticsTriggersAdaptiveGroups | |
zarazAnalyticsTriggersTrafficSourcesAdaptiveGroups | |
zarazTrackAdaptiveGroups | |
zarazTriggersAdaptiveGroups |
ZoneWaitingRoomAnalyticsAdaptive
Raw Waiting Room analytics logs
Field | Description |
---|---|
datetime | The date and time of the state of analytics for the waiting room |
maxEstimatedTimeMinutes | Maximum value of estimated time in minutes |
newUsersPerMinute | Actual value of new users per minute |
newUsersPerMinuteConfig | Configured value of new users per minute |
sampleInterval | ABR sample interval |
sessionDuration | Configured value of session duration |
sessionsRevoked | Actual value of sessions revoked |
timeBetweenRefreshesP50 | 50th percentile of the time between session refreshes in seconds |
timeBetweenRefreshesP75 | 75th percentile of the time between session refreshes in seconds |
timeBetweenRefreshesP90 | 90th percentile of the time between session refreshes in seconds |
timeBetweenRefreshesP95 | 95th percentile of the time between session refreshes in seconds |
timeInQueueP50 | 50th percentile of the time spent waiting in queue in seconds |
timeInQueueP75 | 75th percentile of the time spent waiting in queue in seconds |
timeInQueueP90 | 90th percentile of the time spent waiting in queue in seconds |
timeInQueueP95 | 95th percentile of the time spent waiting in queue in seconds |
timeOnOriginP50 | 50th percentile of the time spent on the origin in seconds |
timeOnOriginP75 | 75th percentile of the time spent on the origin in seconds |
timeOnOriginP90 | 90th percentile of the time spent on the origin in seconds |
timeOnOriginP95 | 95th percentile of the time spent on the origin in seconds |
totalActiveUsers | Actual value of total active users |
totalActiveUsersConfig | Configured value of total active users |
totalQueuedUsers | Total number of users that are queued |
totalTimeWaitedP50 | 50th percentile of the total time (in seconds) spent waiting in queue by users who were queued and then gained access to the origin |
totalTimeWaitedP75 | 75th percentile of the total time (in seconds) spent waiting in queue by users who were queued and then gained access to the origin |
totalTimeWaitedP90 | 90th percentile of the total time (in seconds) spent waiting in queue by users who were queued and then gained access to the origin |
totalTimeWaitedP95 | 95th percentile of the total time (in seconds) spent waiting in queue by users who were queued and then gained access to the origin |
waitingRoomId | Unique Identifier for the waiting room |
waitingRoomName | Name of the waiting room |
ZoneWaitingRoomAnalyticsAdaptiveFilter_InputObject
Field | Description |
---|---|
ZoneWaitingRoomAnalyticsAdaptiveGroups
Aggregated Waiting Room analytics logs with adaptive sampling
Field | Description |
---|---|
avg | Beta. The avg of values for a metric per dimension |
avgWeighted | Beta. The avgWeighted values for a metric per dimension |
dimensions | List of dimensions to group by |
max | Beta. The max value for a metric per dimenstion |
min | Beta. The minimum value for a metric per dimenstion |
sum | The sum for a metric per dimension. Use for shorter queries since data gets sampled after 7 days. |
ZoneWaitingRoomAnalyticsAdaptiveGroupsAvg
Field | Description |
---|---|
maxEstimatedTimeMinutes | Average of the maximum estimated wait time per minute. A negative number means no data |
newUsersPerMinute | Average rate of new users per minute. A negative number means no data |
newUsersPerMinuteConfig | Configured value of new users per minute. A negative number means no data |
sampleInterval | Average sample interval |
sessionDuration | Configured value of session duration. A negative number means no data |
sessionsRevoked | Average rate of sessions revoked. A negative number means no data |
totalActiveUsers | Average rate of total active users. A negative number means no data |
totalActiveUsersConfig | Configured value of total active users. A negative number means no data |
totalQueuedUsers | Average of total queued users |
ZoneWaitingRoomAnalyticsAdaptiveGroupsAvgWeighted
Field | Description |
---|---|
timeBetweenRefreshesP50 | Weighted average of 50th percentile of time spent between session refreshes in seconds. A negative number means no data |
timeBetweenRefreshesP75 | Weighted average of 75th percentile of time spent between session refreshes in seconds. A negative number means no data |
timeBetweenRefreshesP90 | Weighted average of 90th percentile of time spent between session refreshes in seconds. A negative number means no data |
timeBetweenRefreshesP95 | Weighted average of 95th percentile of time spent between session refreshes in seconds. A negative number means no data |
timeInQueueP50 | Weighted average of 50th percentile of time spent in queue in seconds. A negative number means no data |
timeInQueueP75 | Weighted average of 75th percentile of time spent in queue in seconds. A negative number means no data |
timeInQueueP90 | Weighted average of 90th percentile of time spent in queue in seconds. A negative number means no data |
timeInQueueP95 | Weighted average of 95th percentile of time spent in queue in seconds. A negative number means no data |
timeOnOriginP50 | Weighted average of 50th percentile of time spent on origin in seconds. A negative number means no data |
timeOnOriginP75 | Weighted average of 75th percentile of time spent on origin in seconds. A negative number means no data |
timeOnOriginP90 | Weighted average of 90th percentile of time spent on origin in seconds. A negative number means no data |
timeOnOriginP95 | Weighted average of 95th percentile of time spent on origin in seconds. A negative number means no data |
totalTimeWaitedP50 | Weighted average of 50th percentile of the total time spent waiting in queue by users who have gained access to the origin in seconds. A negative number means no data |
totalTimeWaitedP75 | Weighted average of 75th percentile of the total time spent waiting in queue by users who have gained access to the origin in seconds. A negative number means no data |
totalTimeWaitedP90 | Weighted average of 90th percentile of the total time spent waiting in queue by users who have gained access to the origin in seconds. A negative number means no data |
totalTimeWaitedP95 | Weighted average of 95th percentile of the total time spent waiting in queue by users who have gained access to the origin in seconds. A negative number means no data |
ZoneWaitingRoomAnalyticsAdaptiveGroupsDimensions
Field | Description |
---|---|
date | The date the event was written to the database |
datetime | The date and time the event was written to the database |
datetimeFifteenMinutes | The date and time the event was written to the database, truncated to a multiple of 15 minutes |
datetimeFiveMinutes | The date and time the event was written to the database, truncated to a multiple of 5 minutes |
datetimeHour | The date and time the event was written to the database, truncated to the hour |
datetimeMinute | The date and time the event was written to the database, truncated to the minute |
sampleInterval | ABR sample interval |
waitingRoomId | Unique Identifier for the waiting room |
ZoneWaitingRoomAnalyticsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZoneWaitingRoomAnalyticsAdaptiveGroupsMax
Field | Description |
---|---|
maxEstimatedTimeMinutes | The maximum value of estimated time in minutes. A negative number means no data |
newUsersPerMinute | The maximum value of the actual new users per minute. A negative number means no data |
newUsersPerMinuteConfig | The maximum value of the configured new users per minute. A negative number means no data |
sessionDuration | The maximum value of the configured session duration configuration. A negative number means no data |
sessionsRevoked | The maximum value of the actual sessions revoked. A negative number means no data |
totalActiveUsers | The maximum value of the actual total active users. A negative number means no data |
totalActiveUsersConfig | The maximum value of the configured total active users. A negative number means no data |
totalQueuedUsers | The maximum value of total number of queued users. A negative number means no data |
ZoneWaitingRoomAnalyticsAdaptiveGroupsMin
Field | Description |
---|---|
maxEstimatedTimeMinutes | The minimum value of estimated time in minutes. A negative number means no data |
newUsersPerMinute | The minimum value of the actual new users per minute. A negative number means no data |
newUsersPerMinuteConfig | The minimum value of the configured new users per minute. A negative number means either Waiting Room is in passthrough or no data |
sessionDuration | The minimum value of the configured session duration configuration. A negative number means no data |
sessionsRevoked | The minimum value of the actual sessions revoked. A negative number means no data |
totalActiveUsers | The minimum value of the actual total active users. A negative number means no data |
totalActiveUsersConfig | The minimum value of the configured total active users. A negative number means either Waiting Room is in passthrough or no data |
totalQueuedUsers | The minimum value of total number of queued users. A negative number means no data |
ZoneWaitingRoomAnalyticsAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneWaitingRoomAnalyticsAdaptiveGroupsSum
Field | Description |
---|---|
newUsersPerMinute | Sum of new users per minute. A negative number means no data |
sessionsRevoked | Sum of sessions revoked. A negative number means no data |
ZoneWaitingRoomAnalyticsAdaptiveOrderBy
Field | Description |
---|---|
ZoneWorkersZoneInvocationsAdaptiveGroups
Workers invocations with adaptive sampling
Field | Description |
---|---|
avg | The average of values for a metric per dimension |
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
ZoneWorkersZoneInvocationsAdaptiveGroupsAvg
Field | Description |
---|---|
avgCpuTime | Average CPU time used per request (in microseconds) |
ZoneWorkersZoneInvocationsAdaptiveGroupsDimensions
Field | Description |
---|---|
constantScriptId | Worker script Id |
date | Request datetime, truncated to start of a day |
datetime | Request datetime |
datetimeHour | Request datetime, truncated to start of an hour |
datetimeMinute | Request datetime, truncated to start of an minute |
httpResponseStatus | Origin HTTP response code |
status | Status of the worker invocation |
ZoneWorkersZoneInvocationsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZoneWorkersZoneInvocationsAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneWorkersZoneInvocationsAdaptiveGroupsSum
Field | Description |
---|---|
requests | Sum of Requests |
responseBodySize | Bandwidth (in bytes) returned to eyeball |
subrequests | Number of sub-requests issued by the edge worker |
totalCpuTime | Total CPU time used (in microseconds) |
ZoneWorkersZoneSubrequestsAdaptiveGroups
Workers subrequests with adaptive sampling
Field | Description |
---|---|
dimensions | List of dimensions to group by |
sum | The sum of values for a metric per dimension |
ZoneWorkersZoneSubrequestsAdaptiveGroupsDimensions
Field | Description |
---|---|
cacheStatus | Cache status |
date | Request datetime, truncated to start of a day |
datetime | Request datetime |
datetimeHour | Request datetime, truncated to start of an hour |
datetimeMinute | Request datetime, truncated to start of an minute |
httpResponseStatus | Origin HTTP response code |
ZoneWorkersZoneSubrequestsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZoneWorkersZoneSubrequestsAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneWorkersZoneSubrequestsAdaptiveGroupsSum
Field | Description |
---|---|
responseBodySize | Bandwidth (in bytes) received via subrequests |
subrequests | Number of subrequests issued by a worker |
ZoneZarazActionsAdaptiveGroups
Zaraz Actions Analytics
Field | Description |
---|---|
count | Number of processed Zaraz Actions |
dimensions | List of dimensions to group by |
ZoneZarazActionsAdaptiveGroupsDimensions
Field | Description |
---|---|
actionName | Action Name |
date | The date the Action was triggered |
datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
datetimeFiveMinutes | The date and time truncated to five minutes |
datetimeHour | The date and time truncated to the hour |
datetimeMinute | The date and time truncated to the minute |
toolName | Tool Name |
ZoneZarazActionsAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZoneZarazActionsAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneZarazAnalyticsIdentitiesAdaptiveGroups
Zaraz Analytics Identities - zaraz.identify calls
Field | Description |
---|---|
count | Number of processed Zaraz identify requests |
dimensions | List of dimensions to group by |
ZoneZarazAnalyticsIdentitiesAdaptiveGroupsDimensions
Field | Description |
---|---|
clientId | Client ID |
date | Date when zaraz.identify() method was called |
datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
datetimeFiveMinutes | The date and time truncated to five minutes |
datetimeHour | The date and time truncated to the hour |
datetimeMinute | The date and time truncated to the minute |
identity | Identity |
ZoneZarazAnalyticsIdentitiesAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZoneZarazAnalyticsIdentitiesAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneZarazAnalyticsOrderedTrackAdaptive
Zaraz Analytics Tracks ordered per session
Field | Description |
---|---|
browserName | User Agent browser name |
cityRegion | City, region |
clientId | Client ID |
colors | Color depth |
country | Country |
date | Date when track was called |
datetime | Date & time when track was called |
datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
datetimeFiveMinutes | The date and time truncated to five minutes |
datetimeHour | The date and time truncated to the hour |
datetimeMinute | The date and time truncated to the minute |
deviceModel | User Agent device model |
deviceType | User Agent device type |
deviceVendor | User Agent device vendor |
ip | IP |
language | Language |
orderInClient | Track's order number for its clientId |
orderInSession | Track's reverse order number within its session (last track having orderInSession 1) |
osName | User Agent OS name |
osVersion | User Agent OS version |
pageTitle | Page Title |
resolution | Screen resolution, cantor paired width & heigh |
reverseOrderInClient | Track's reverse order number for its clientId |
sampleInterval | ABR sample interval |
sessionId | Session ID |
timezoneOffset | Timezone Offset |
trackData | Track Data |
trackName | Track Name |
trafficSrc | Traffic Source |
ua | User Agent string |
uaObj | User Agent stringified object |
urlPath | URL Path |
viewport | Viewport, cantor paired width & heigh |
ZoneZarazAnalyticsOrderedTrackAdaptiveFilter_InputObject
Field | Description |
---|---|
ZoneZarazAnalyticsOrderedTrackAdaptiveGroups
Zaraz Analytics Tracks ordered per session
Field | Description |
---|---|
count | Number of processed Zaraz Track requests |
dimensions | List of dimensions to group by |
uniq |
ZoneZarazAnalyticsOrderedTrackAdaptiveGroupsDimensions
Field | Description |
---|---|
browserName | User Agent browser name |
cityRegion | City, region |
clientId | Client ID |
colors | Color depth |
country | Country |
date | Date when track was called |
datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
datetimeFiveMinutes | The date and time truncated to five minutes |
datetimeHour | The date and time truncated to the hour |
datetimeMinute | The date and time truncated to the minute |
deviceModel | User Agent device model |
deviceType | User Agent device type |
deviceVendor | User Agent device vendor |
ip | IP |
language | Language |
orderInClient | Track's order number for its clientId |
orderInSession | Track's reverse order number within its session (last track having orderInSession 1) |
osName | User Agent OS name |
osVersion | User Agent OS version |
pageTitle | Page Title |
resolution | Screen resolution, cantor paired width & heigh |
reverseOrderInClient | Track's reverse order number for its clientId |
sessionId | Session ID |
timezoneOffset | Timezone Offset |
trackData | Track Data |
trackName | Track Name |
trafficSrc | Traffic Source |
ua | User Agent string |
uaObj | User Agent stringified object |
urlPath | URL Path |
viewport | Viewport, cantor paired width & heigh |
ZoneZarazAnalyticsOrderedTrackAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZoneZarazAnalyticsOrderedTrackAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneZarazAnalyticsOrderedTrackAdaptiveGroupsUniq
Field | Description |
---|---|
clientIdCount | Minimum number of distinct client IDs |
sessionIdCount | Minimum number of distinct session IDs |
ZoneZarazAnalyticsOrderedTrackAdaptiveOrderBy
Field | Description |
---|---|
ZoneZarazAnalyticsTrackAdaptiveGroups
Zaraz Analytics Track - counts zaraz.track calls
Field | Description |
---|---|
count | Number of processed Zaraz Track requests |
dimensions | List of dimensions to group by |
uniq |
ZoneZarazAnalyticsTrackAdaptiveGroupsDimensions
Field | Description |
---|---|
browserName | User Agent browser name |
cityRegion | City, region |
clientId | Client ID |
colors | Color depth |
country | Country |
date | Date when track was called |
datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
datetimeFiveMinutes | The date and time truncated to five minutes |
datetimeHour | The date and time truncated to the hour |
datetimeMinute | The date and time truncated to the minute |
deviceModel | User Agent device model |
deviceType | User Agent device type |
deviceVendor | User Agent device vendor |
ip | IP |
language | Language |
osName | User Agent OS name |
osVersion | User Agent OS version |
pageTitle | Page Title |
resolution | Screen resolution, cantor paired width & heigh |
sessionId | Session ID |
timezoneOffset | Timezone Offset |
trackData | Track Data |
trackName | Track Name |
trafficSrc | Traffic Source |
ua | User Agent string |
uaObj | User Agent stringified object |
urlPath | URL Path |
viewport | Viewport, cantor paired width & heigh |
ZoneZarazAnalyticsTrackAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZoneZarazAnalyticsTrackAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneZarazAnalyticsTrackAdaptiveGroupsUniq
Field | Description |
---|---|
clientIdCount | Minimum number of distinct client IDs |
sessionIdCount | Minimum number of distinct session IDs |
ZoneZarazAnalyticsTrackTrafficSourcesAdaptiveGroups
Zaraz Analytics Track Traffic Sources
Field | Description |
---|---|
avg | |
count | Number of unique sessions |
dimensions | List of dimensions to group by |
uniq |
ZoneZarazAnalyticsTrackTrafficSourcesAdaptiveGroupsAvg
Field | Description |
---|---|
sessionDuration | Average session duration |
ZoneZarazAnalyticsTrackTrafficSourcesAdaptiveGroupsDimensions
Field | Description |
---|---|
clientId | Client ID |
duration | Session duration (seconds) |
exitPage | URL Path at session end |
firstTrafficSrc | Traffic source at session start |
landingPage | URL Path at session start |
sessionEnd | Date when the session ended |
sessionEndFifteenMinutes | The date and time truncated to fifteen minutes |
sessionEndFiveMinutes | The date and time truncated to five minutes |
sessionEndHour | The date and time truncated to the hour |
sessionEndMinute | The date and time truncated to the minute |
sessionId | Session ID |
sessionStart | Date when the session started |
sessionStartFifteenMinutes | The date and time truncated to fifteen minutes |
sessionStartFiveMinutes | The date and time truncated to five minutes |
sessionStartHour | The date and time truncated to the hour |
sessionStartMinute | The date and time truncated to the minute |
tracks | Unique track names within a session |
ZoneZarazAnalyticsTrackTrafficSourcesAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneZarazAnalyticsTrackTrafficSourcesAdaptiveGroupsUniq
Field | Description |
---|---|
clientIdCount | Minimum number of distinct client IDs |
sessionIdCount | Minimum number of distinct session IDs |
ZoneZarazAnalyticsTriggersAdaptiveGroups
Zaraz Analytics Triggers (a trigger is a set of rules that can trigger a zaraz action)
Field | Description |
---|---|
count | Number of processed Zaraz Triggers |
dimensions | List of dimensions to group by |
uniq |
ZoneZarazAnalyticsTriggersAdaptiveGroupsDimensions
Field | Description |
---|---|
browserName | User Agent browser name |
cityRegion | City, region |
clientId | Client ID |
colors | Color depth |
country | Country |
date | The date when trigger was triggerd |
datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
datetimeFiveMinutes | The date and time truncated to five minutes |
datetimeHour | The date and time truncated to the hour |
datetimeMinute | The date and time truncated to the minute |
deviceModel | User Agent device model |
deviceType | User Agent device type |
deviceVendor | User Agent device vendor |
ip | IP |
language | Language |
osName | User Agent OS name |
osVersion | User Agent OS version |
pageTitle | Page Title |
resolution | Screen resolution, cantor paired width & heigh |
sessionId | Session ID |
timezoneOffset | Timezone Offset |
trafficSrc | Traffic Source |
triggerName | Trigger Name |
ua | User Agent string |
uaObj | User Agent stringified object |
urlPath | URL Path |
viewport | Viewport, cantor paired width & heigh |
ZoneZarazAnalyticsTriggersAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZoneZarazAnalyticsTriggersAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneZarazAnalyticsTriggersAdaptiveGroupsUniq
Field | Description |
---|---|
clientIdCount | Minimum number of distinct client IDs |
sessionIdCount | Minimum number of distinct session IDs |
ZoneZarazAnalyticsTriggersTrafficSourcesAdaptiveGroups
Zaraz Analytics Triggers Traffic Sources
Field | Description |
---|---|
count | Number of unique sessions |
dimensions | List of dimensions to group by |
uniq |
ZoneZarazAnalyticsTriggersTrafficSourcesAdaptiveGroupsDimensions
Field | Description |
---|---|
clientId | Client ID |
firstTrafficSrc | Traffic source at session start |
sessionEnd | Date when the session ended |
sessionEndFifteenMinutes | The date and time truncated to fifteen minutes |
sessionEndFiveMinutes | The date and time truncated to five minutes |
sessionEndHour | The date and time truncated to the hour |
sessionEndMinute | The date and time truncated to the minute |
sessionId | Session ID |
sessionStart | Date when the session started |
sessionStartFifteenMinutes | The date and time truncated to fifteen minutes |
sessionStartFiveMinutes | The date and time truncated to five minutes |
sessionStartHour | The date and time truncated to the hour |
sessionStartMinute | The date and time truncated to the minute |
triggers | Unique trigger names within a session |
ZoneZarazAnalyticsTriggersTrafficSourcesAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneZarazAnalyticsTriggersTrafficSourcesAdaptiveGroupsUniq
Field | Description |
---|---|
clientIdCount | Minimum number of distinct client IDs |
sessionIdCount | Minimum number of distinct session IDs |
ZoneZarazTrackAdaptiveGroups
Zaraz Track Analytics - counts zaraz.track calls
Field | Description |
---|---|
count | Number of processed Zaraz Track requests |
dimensions | List of dimensions to group by |
ZoneZarazTrackAdaptiveGroupsDimensions
Field | Description |
---|---|
date | Date when track was called |
datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
datetimeFiveMinutes | The date and time truncated to five minutes |
datetimeHour | The date and time truncated to the hour |
datetimeMinute | The date and time truncated to the minute |
trackName | Track Name |
urlPath | The URL from where Track was called |
ZoneZarazTrackAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZoneZarazTrackAdaptiveGroupsOrderBy
Field | Description |
---|---|
ZoneZarazTriggersAdaptiveGroups
Zaraz Triggers Analytics (a trigger is a set of rules that can trigger a zaraz action)
Field | Description |
---|---|
count | Number of processed Zaraz Triggers |
dimensions | List of dimensions to group by |
ZoneZarazTriggersAdaptiveGroupsDimensions
Field | Description |
---|---|
date | The date when trigger was triggerd |
datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
datetimeFiveMinutes | The date and time truncated to five minutes |
datetimeHour | The date and time truncated to the hour |
datetimeMinute | The date and time truncated to the minute |
triggerName | Trigger Name |
ZoneZarazTriggersAdaptiveGroupsFilter_InputObject
Field | Description |
---|---|
ZoneZarazTriggersAdaptiveGroupsOrderBy
Field | Description |
---|---|
account
Field | Description |
---|---|
MagicWANConnectorMetricsAdaptiveGroups | Beta. Magic WAN Connector Metrics |
accessLoginRequestsAdaptiveGroups | Access login requests |
accountTag | |
advancedDnsProtectionNetworkAnalyticsAdaptiveGroups | Network analytics data for Advanced DNS Protection |
advancedTcpProtectionNetworkAnalyticsAdaptiveGroups | DEPRECATED (This node is an alias for advancedTcpProtectionNetworkAnalyticsAdaptiveGroups ; prefer using the new name instead): Network analytics data for Advanced TCP Protection |
aiGatewayCacheAdaptiveGroups | AI Gateway Cache |
aiGatewayErrorsAdaptiveGroups | AI Gateway Errors |
aiGatewayRequestsAdaptiveGroups | AI Gateway Requests |
aiInferenceAdaptive | AI Inference logs with adaptive sampling |
aiInferenceAdaptiveGroups | Aggregated AI Inference logs with adaptive sampling |
browserRenderingEventsAdaptive | Browser Rendering events with adaptive sampling |
browserRenderingEventsAdaptiveGroups | Aggregated Browser Rendering events with adaptive sampling |
callsStatusAdaptive | (TESTING ONLY, NOT FOR PRODUCTION) Raw Calls events with adaptive sampling |
callsTurnUsageAdaptiveGroups | Beta. Aggregated Calls TURN bandwidth usage with adaptive sampling |
callsUsageAdaptiveGroups | Beta. Aggregated Calls SFU bandwidth usage with adaptive sampling |
cdnNetworkAnalyticsAdaptiveGroups | Network analytics data for Cloudflare CDN traffic |
d1AnalyticsAdaptiveGroups | Beta. Aggregated D1 analytics with adaptive sampling |
d1QueriesAdaptiveGroups | Beta. D1 query metrics with adaptive sampling |
d1StorageAdaptiveGroups | Beta. D1 storage with adaptive sampling |
dosdAttackAnalyticsGroups | Attack analytics metadata for attacks detected by dosd |
dosdNetworkAnalyticsAdaptiveGroups | Network analytics data for dosd |
durableObjectsInvocationsAdaptiveGroups | Durable Objects invocations with adaptive sampling |
durableObjectsPeriodicGroups | Durable Objects periodic metrics |
durableObjectsStorageGroups | Durable Objects storage metrics |
durableObjectsSubrequestsAdaptiveGroups | Durable Objects subrequests with adaptive sampling |
fbmAttackAnalyticsGroups | FBM analytics metadata for attacks detected by dosd |
firewallEventsAdaptive | Raw Firewall events with adaptive sampling |
firewallEventsAdaptiveGroups | Aggregated Firewall events with adaptive sampling |
flowtrackdNetworkAnalyticsAdaptiveGroups | DEPRECATED (This node is an alias for advancedTcpProtectionNetworkAnalyticsAdaptiveGroups ; prefer using the new name instead): Network analytics data for flowtrackd |
gatewayL4DownstreamSessionsAdaptiveGroups | Aggregated metrics about downstream (client to edge) L4 Gateway Sessions. Metrics are reported on TCP or UDP session close |
gatewayL4SessionsAdaptiveGroups | BETA - Aggregate counts of Gateway L4 sessions with adaptive sampling |
gatewayL4UpstreamSessionsAdaptiveGroups | Aggregated metrics about upstream (edge to client) L4 Gateway Sessions. Metrics are reported on TCP, QUIC or UDP session close |
gatewayL7RequestsAdaptiveGroups | BETA - Aggregate counts of Gateway L7 requests with adaptive sampling |
gatewayResolverByCategoryAdaptiveGroups | BETA - Aggregate counts of Gateway Resolver queries by category with adaptive sampling |
gatewayResolverByCustomResolverGroups | Stats on dns custom resolvers |
gatewayResolverByRuleExecutionPerformanceAdaptiveGroups | Total time spent on executing firewall rules at the edge |
gatewayResolverQueriesAdaptiveGroups | BETA - Aggregate counts of Gateway Resolver queries with adaptive sampling |
httpRequests1dGroups | Daily rollups of request data |
httpRequests1hGroups | Hourly rollups of request data |
httpRequests1mGroups | Minutely rollups of request data |
httpRequestsAdaptive | Raw HTTP requests with adaptive sampling |
httpRequestsAdaptiveGroups | Aggregated HTTP requests data with adaptive sampling |
httpRequestsOverviewAdaptiveGroups | A high-level summary of HTTP requests made by end users. |
hyperdriveQueriesAdaptiveGroups | Hyperdrive query events with adaptive sampling. |
imagesRequestsAdaptiveGroups | A high-level summary of Cloudflare Images served to end users. |
imagesUniqueTransformations | Image unique transfromations per day |
kvOperationsAdaptiveGroups | KV operations data with adaptive sampling |
kvStorageAdaptiveGroups | KV stored data with adaptive sampling |
logpushHealthAdaptiveGroups | Beta. Logpush job health metrics |
magicFirewallNetworkAnalyticsAdaptiveGroups | Network analytics data for Magic Firewall |
magicFirewallRateLimitNetworkAnalyticsAdaptiveGroups | Network analytics data for Magic Firewall Ratelimiting |
magicFirewallSamplesAdaptiveGroups | Data to visualize traffic allowed and blocked by Magic Firewall rules |
magicIDPSNetworkAnalyticsAdaptiveGroups | Network analytics data for Magic IDS |
magicTransitNetworkAnalyticsAdaptiveGroups | Network analytics data for Magic Transit traffic |
magicTransitTunnelHealthChecksAdaptiveGroups | Beta. Magic Transit Health check results for customer GRE Tunnels with adaptive sampling (ABR). |
magicTransitTunnelTrafficAdaptiveGroups | Bandwidth usage metric of a Magic Transit tunnel. |
mnmFlowDataAdaptiveGroups | Flow data collected through Magic Network Monitoring |
nelReportsAdaptiveGroups | Data to visualize network error logs |
ohttpMetricsAdaptive | oHTTP request metrics with adaptive sampling |
ohttpMetricsAdaptiveGroups | Aggregated oHTTP request metrics with adaptive sampling |
pagesFunctionsInvocationsAdaptiveGroups | Pages Functions invocations with adaptive sampling |
queueBacklogAdaptiveGroups | Beta. Queue backlog data with adaptive sampling. Queues that are not being written to, or read from, will not return data, even if they have a backlog. |
queueConsumerMetricsAdaptiveGroups | Beta. Queue consumer metrics with adaptive sampling. Inactive queues will not return data. |
queueDelayedBacklogAdaptiveGroups | Beta. Queue delayed backlog data with adaptive sampling. Queues that are not being written to, or read from, will not return data, even if they have a backlog. |
queueMessageOperationsAdaptiveGroups | Beta. Queue message operation data with adaptive sampling |
r2OperationsAdaptiveGroups | Beta. R2 operations with adaptive sampling |
r2StorageAdaptiveGroups | Beta. R2 storage with adaptive sampling |
rumPageloadEventsAdaptiveGroups | Beta. Aggregated RUM pageload event metrics with adaptive sampling |
rumPerformanceEventsAdaptiveGroups | Beta. Aggregated RUM performance event metrics with adaptive sampling |
rumWebVitalsEventsAdaptive | Beta. RUM Web Vitals event metrics with adaptive sampling |
rumWebVitalsEventsAdaptiveGroups | Beta. Aggregated RUM Web Vitals event metrics with adaptive sampling |
settings | |
sinkholeRequestLogsAdaptive | Sinkhole Request Logs |
sinkholeRequestLogsAdaptiveGroups | Sinkhole Request Logs |
sippyOperationsAdaptiveGroups | Sippy operations with adaptive sampling |
spectrumNetworkAnalyticsAdaptiveGroups | Network analytics data for Spectrum traffic |
storageTraces | Storage Tracing Information |
streamMinutesViewedAdaptiveGroups | A high-level summary of Cloudflare Stream minutes viewed. |
turnstileAdaptiveGroups | Beta. Cloudflare Turnstile aggregated events with adaptive sampling |
vectorizeQueriesAdaptiveGroups | Beta. Vectorize usage with adaptive sampling |
vectorizeStorageAdaptiveGroups | Beta. Vectorize storage with adaptive sampling |
vectorizeV2OperationsAdaptiveGroups | Vectorize operations with adaptive sampling |
vectorizeV2QueriesAdaptiveGroups | Vectorize queries with adaptive sampling |
vectorizeV2StorageAdaptiveGroups | Vectorize storage with adaptive sampling |
vectorizeV2WritesAdaptiveGroups | Vectorize writes with adaptive sampling |
videoBufferEventsAdaptiveGroups | Beta. Aggregated video streaming buffer event metrics with adaptive sampling |
videoPlaybackEventsAdaptiveGroups | Beta. Aggregated video streaming playback event metrics with adaptive sampling |
videoQualityEventsAdaptiveGroups | Beta. Aggregated video streaming quality change event metrics with adaptive sampling |
warpDeviceAdaptiveGroups | Beta. Warp device health events with adaptive sampling |
workerPlacementAdaptiveGroups | Worker placement metrics |
workersAnalyticsEngineAdaptiveGroups | Beta. Custom Events with adaptive sampling |
workersInvocationsAdaptive | Beta. Workers invocations with adaptive sampling |
workersInvocationsScheduled | Workers scheduled invocations |
workersOverviewDataAdaptiveGroups | Beta. Workers account overview invocation data with adaptive sampling |
workersOverviewRequestsAdaptiveGroups | Beta. Workers account overview invocation count with adaptive sampling |
workersSubrequestsAdaptiveGroups | Beta. Workers subrequests with adaptive sampling |
zarazTrackAdaptiveGroups | Zaraz Track Analytics - counts zaraz.track calls |
zarazTriggersAdaptiveGroups | Zaraz Triggers Analytics (a trigger is a set of rules that can trigger a zaraz action) |
zeroTrustPrivateNetworkDiscoveryGroups | Beta - Unique origins, applications, and users discovered for Zero Trust private networks |
zones |
organization
Field | Description |
---|---|
httpRequestsAdaptiveGroups | Aggregated HTTP requests data with adaptive sampling |
organizationTag | |
settings |
viewer
Field | Description |
---|---|
accounts | |
budget | |
organizations | |
zones |
zone
Field | Description |
---|---|
apiGatewayGraphqlQueryAnalyticsGroups | GraphQL query attributes and trends |
apiGatewayMatchedSessionIDsAdaptiveGroups | Beta. Aggregated count of Session Identifier matches |
apiGatewayMatchedSessionIDsPerEndpointAdaptiveGroups | Beta. Aggregated count of Session Identifier matches per endpoint |
apiRequestSequencesGroups | Sequences of API endpoint operations. Sequences are learned by grouping requests by AuthID. Correlation scores are estimated over a 24 hour window and are current to within 10 minutes |
cacheReserveOperationsAdaptiveGroups | Beta. Cache Reserve operations with adaptive sampling |
cacheReserveRequestsAdaptiveGroups | Cache Reserve HTTP requests data with adaptive sampling |
cacheReserveStorageAdaptiveGroups | Beta. Cache Reserve storage with adaptive sampling |
dmarcReportsAdaptive | Dmarc report records with adaptive sampling |
dmarcReportsSourcesAdaptiveGroups | Aggregated dmarc reports by sources logs with adaptive sampling |
dnsAnalyticsAdaptive | Analytics data for DNS queries (currently, only Foundation DNS zones are supported) |
dnsAnalyticsAdaptiveGroups | Analytics data for DNS queries (currently, only Foundation DNS zones are supported) |
emailRoutingAdaptive | Beta. Raw email routing logs with adaptive sampling |
emailRoutingAdaptiveGroups | Beta. Aggregated email routing logs with adaptive sampling |
firewallEventsAdaptive | Raw Firewall events with adaptive sampling |
firewallEventsAdaptiveByTimeGroups | Aggregated Firewall events with adaptive sampling grouped by time |
firewallEventsAdaptiveGroups | Aggregated Firewall events with adaptive sampling |
healthCheckEventsAdaptive | Raw Health Check events with adaptive sampling |
healthCheckEventsAdaptiveGroups | Aggregated Health Check events with adaptive sampling |
httpRequests1dByColoGroups | DEPRECATED (Node is replaced with more capable httpRequestsAdaptiveGroups ): Daily rollups of request data by colo |
httpRequests1dGroups | Daily rollups of request data |
httpRequests1hGroups | Hourly rollups of request data |
httpRequests1mByColoGroups | DEPRECATED (Node is replaced with more capable httpRequestsAdaptiveGroups ): Minutely rollups of request data by colo |
httpRequests1mGroups | Minutely rollups of request data |
httpRequestsAdaptive | Raw HTTP requests with adaptive sampling |
httpRequestsAdaptiveGroups | Aggregated HTTP requests data with adaptive sampling |
httpRequestsOverviewAdaptiveGroups | A high-level summary of HTTP requests made by end users. |
imageResizingRequests1mGroups | Minutely rollups of Image Resizing requests |
loadBalancingRequestsAdaptive | Raw Load Balancing origin requests with adaptive sampling |
loadBalancingRequestsAdaptiveGroups | Aggregated Load Balancing origin requests with adaptive sampling |
logpushHealthAdaptiveGroups | Beta. Logpush job health metrics |
nelReportsAdaptiveGroups | Data to visualize network error logs |
pageShieldReportsAdaptiveGroups | Page Shield CSP reports |
settings | |
waitingRoomAnalyticsAdaptive | Raw Waiting Room analytics logs |
waitingRoomAnalyticsAdaptiveGroups | Aggregated Waiting Room analytics logs with adaptive sampling |
workersZoneInvocationsAdaptiveGroups | Workers invocations with adaptive sampling |
workersZoneSubrequestsAdaptiveGroups | Workers subrequests with adaptive sampling |
zarazActionsAdaptiveGroups | Zaraz Actions Analytics |
zarazAnalyticsIdentitiesAdaptiveGroups | Zaraz Analytics Identities - zaraz.identify calls |
zarazAnalyticsOrderedTrackAdaptive | Zaraz Analytics Tracks ordered per session |
zarazAnalyticsOrderedTrackAdaptiveGroups | Zaraz Analytics Tracks ordered per session |
zarazAnalyticsTrackAdaptiveGroups | Zaraz Analytics Track - counts zaraz.track calls |
zarazAnalyticsTrackTrafficSourcesAdaptiveGroups | Zaraz Analytics Track Traffic Sources |
zarazAnalyticsTriggersAdaptiveGroups | Zaraz Analytics Triggers (a trigger is a set of rules that can trigger a zaraz action) |
zarazAnalyticsTriggersTrafficSourcesAdaptiveGroups | Zaraz Analytics Triggers Traffic Sources |
zarazTrackAdaptiveGroups | Zaraz Track Analytics - counts zaraz.track calls |
zarazTriggersAdaptiveGroups | Zaraz Triggers Analytics (a trigger is a set of rules that can trigger a zaraz action) |
zoneTag |