GraphQL

This lists all of the available datasets and fields in Cloudflare's GraphQL API.

AccountAccessLoginRequestsAdaptiveGroups

Access login requests

FieldDescription
avg
count Number of access login API events processed
dimensions List of dimensions to group by

AccountAccessLoginRequestsAdaptiveGroupsAvg

FieldDescription
sampleInterval Average sample interval

AccountAccessLoginRequestsAdaptiveGroupsDimensions

FieldDescription
appId Access application ID
approvingPolicyId Policy ID that approved the user
cfRayId CF ray id
country Country tag
date The date the access login event was emitted
datetime The date and time the access login event was emitted
datetimeMinute The date and time the access login event was emitted truncated to the minute
deviceId Device ID
hasExistingJWT Has existing JWT (0 = false, 1 = true)
hasGatewayEnabled Has Gateway enabled (0 = false, 1 = true)
hasWarpEnabled Has WARP enabled (0 = false, 1 = true)
identityProvider Identity provider
ipAddress User IP address
isSuccessfulLogin If the login was successful (0 = false, 1 = true)
mtlsCertSerialId MTLS certificate serial ID
mtlsCommonName MTLS common name
mtlsStatus MTLS status (may show error message if status is not successful)
serviceTokenId Service token ID
userUuid User UUID

AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroups

Network analytics data for Advanced DNS Protection

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsAvg

FieldDescription
bitRate Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsDimensions

FieldDescription
applicationTag Application tag associated with the packet
coloCity City where the Cloudflare datacenter that received the packet is located
coloCode Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName Cloudflare datacenter that received the packet (unique site identifier)
date Date that the packet was received
datetime Date and time that the packet was received
datetimeFifteenMinutes Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName Name of ASN associated with the destination IP of the packet, if available
destinationCountry Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationGeohash Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort Value of the Destination Port header field in the TCP or UDP packet
direction Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
dnsQueryName The requested domain name in the DNS query
dnsQueryType The query type in the DNS query
ethertype Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum Value of the Checkusm header field in the GRE packet
greEthertype Value of the Ethertype header field in the GRE packet
greHeaderLength Length of the GRE packet header, in bytes
greKey Value of the Key header field in the GRE packet
greSequenceNumber Value of the Sequence Number header field in the GRE packet
greVersion Value of the Version header field in the GRE packet
icmpChecksum Value of the Checkusm header field in the ICMP packet
icmpCode Value of the Code header field in the ICMP packet
icmpType Value of the Type header field in the ICMP packet
ipDestinationAddress Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum Value of the Checksum header field in the IPv4 packet
ipv4DontFragment Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification Value of the Identification header field in the IPv4 packet
ipv4Options List of Options numbers included in the IPv4 packet header
ipv6Dscp Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel Value of the Flow Label header field in the IPv6 packet
ipv6Identification Value of the Identification extension header field in the IPv6 packet
leaseTag IP lease tag associated with the packet
mitigationReason Reason for applying a mitigation to the packet, if any
mitigationScope Whether the packet matched a local or global mitigation, if any (possible values: local, global)
outcome The action that was taken on the packet (possible values: pass, drop)
prefixTag IP prefix tag associated with the packet
sampleInterval ABR sample interval
sourceAsn ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName Name of ASN associated with the source IP of the packet, if available
sourceCountry Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceGeohash Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum Value of the Checkusm header field in the TCP packet
tcpDataOffset Value of the Data Offset header field in the TCP packet
tcpFlags Value of the Flags header field in the TCP packet
tcpFlagsString Human-readable string representation of the Flags header field in the TCP packet
tcpMss Value of the MSS option header field in the TCP packet
tcpOptions List of Options numbers included in the TCP packet header
tcpSackBlocks Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale Value of the Window Scale option header field in the TCP packet
tcpWindowSize Value of the Window Size header field in the TCP packet
udpChecksum Value of the Checkusm header field in the UDP packet
udpPayloadLength Value of the Payload Length header field in the UDP packet
verdict The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop)

AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsSum

FieldDescription
bits Sum of bits received
packets Sum of packets received

AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroups

Network analytics data for Advanced TCP Protection

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsAvg

FieldDescription
bitRate Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsDimensions

FieldDescription
applicationTag Application tag associated with the packet
coloCity City where the Cloudflare datacenter that received the packet is located
coloCode Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName Cloudflare datacenter that received the packet (unique site identifier)
date Date that the packet was received
datetime Date and time that the packet was received
datetimeFifteenMinutes Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName Name of ASN associated with the destination IP of the packet, if available
destinationCountry Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationGeohash Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort Value of the Destination Port header field in the TCP or UDP packet
direction Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
ethertype Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum Value of the Checkusm header field in the GRE packet
greEthertype Value of the Ethertype header field in the GRE packet
greHeaderLength Length of the GRE packet header, in bytes
greKey Value of the Key header field in the GRE packet
greSequenceNumber Value of the Sequence Number header field in the GRE packet
greVersion Value of the Version header field in the GRE packet
icmpChecksum Value of the Checkusm header field in the ICMP packet
icmpCode Value of the Code header field in the ICMP packet
icmpType Value of the Type header field in the ICMP packet
ipDestinationAddress Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum Value of the Checksum header field in the IPv4 packet
ipv4DontFragment Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification Value of the Identification header field in the IPv4 packet
ipv4Options List of Options numbers included in the IPv4 packet header
ipv6Dscp Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel Value of the Flow Label header field in the IPv6 packet
ipv6Identification Value of the Identification extension header field in the IPv6 packet
leaseTag IP lease tag associated with the packet
mitigationReason Reason for applying a mitigation to the packet, if any
mitigationScope Whether the packet matched a local or global mitigation, if any (possible values: local, global)
outcome The action that was taken on the packet (possible values: pass, drop)
prefixTag IP prefix tag associated with the packet
protocolState State of the packet in the context of the protocol, if available
sampleInterval ABR sample interval
sourceAsn ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName Name of ASN associated with the source IP of the packet, if available
sourceCountry Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceGeohash Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum Value of the Checkusm header field in the TCP packet
tcpDataOffset Value of the Data Offset header field in the TCP packet
tcpFlags Value of the Flags header field in the TCP packet
tcpFlagsString Human-readable string representation of the Flags header field in the TCP packet
tcpMss Value of the MSS option header field in the TCP packet
tcpOptions List of Options numbers included in the TCP packet header
tcpSackBlocks Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale Value of the Window Scale option header field in the TCP packet
tcpWindowSize Value of the Window Size header field in the TCP packet
udpChecksum Value of the Checkusm header field in the UDP packet
udpPayloadLength Value of the Payload Length header field in the UDP packet
verdict The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop)

AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsSum

FieldDescription
bits Sum of bits received
packets Sum of packets received

AccountAiGatewayCacheAdaptiveGroups

AI Gateway Cache

FieldDescription
count Total number of requests for an account with caching enabled: including hits and misses
dimensions List of dimensions to group by

AccountAiGatewayCacheAdaptiveGroupsDimensions

FieldDescription
cacheOp Cache Hit or Miss: 1 = cache hit, 0 = cache miss
date The date when trigger was triggerd
datetimeFifteenMinutes The date and time truncated to fifteen minutes
datetimeFiveMinutes The date and time truncated to five minutes
datetimeHour The date and time truncated to the hour
datetimeMinute The date and time truncated to the minute
gateway Gateway name
model Which model was the request sent to
provider Which provider was the request sent to
tokensIn Number of tokens in the request
tokensOut Number of tokens in the response

AccountAiGatewayErrorsAdaptiveGroups

AI Gateway Errors

FieldDescription
count Number of errors
dimensions List of dimensions to group by

AccountAiGatewayErrorsAdaptiveGroupsDimensions

FieldDescription
date The date when trigger was triggerd
datetimeFifteenMinutes The date and time truncated to fifteen minutes
datetimeFiveMinutes The date and time truncated to five minutes
datetimeHour The date and time truncated to the hour
datetimeMinute The date and time truncated to the minute
gateway Gateway name
model Which models was the request sent to
provider Which provider was the request sent to

AccountAiGatewayRequestsAdaptiveGroups

AI Gateway Requests

FieldDescription
count Number of processed requests
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountAiGatewayRequestsAdaptiveGroupsDimensions

FieldDescription
cached Was the response served from cache?: 1 = cache hit, 0 = cache misss
date The date when trigger was triggered
datetimeFifteenMinutes The date and time truncated to fifteen minutes
datetimeFiveMinutes The date and time truncated to five minutes
datetimeHour The date and time truncated to the hour
datetimeMinute The date and time truncated to the minute
error Was the response an error: 1 , 0 for no error
gateway Gateway name
model Which models was the request sent to
provider Which provider was the request sent to
rateLimited Was the request rate limited?: 1 = rate limit applied, 0 = rate limit not applied
tokensIn Number of tokens in the request
tokensOut Number of tokens in the response

AccountAiGatewayRequestsAdaptiveGroupsSum

FieldDescription
cachedTokensIn Sum of cached tokens in
cachedTokensOut Sum of cached tokens out
uncachedTokensIn Sum of uncached tokens in
uncachedTokensOut Sum of uncached tokens out

AccountAiInferenceAdaptive

AI Inference logs with adaptive sampling

FieldDescription
costMetricName1 Name for cost metric 1
costMetricName2 Name for cost metric 2
costMetricValue1 Value for cost metric 1
costMetricValue2 Value for cost metric 2
datetime The date when inferance was triggered
errorCode Error code
inferenceTimeMs Inference time ms
modelId ModelId that was trigger to inference
modelIsBeta Model that was trigger to inference is Beta
neurons Monetization unit
requestBytesIn Request size in bytes
requestBytesOut Request size out bytes
requestSource Source who triggered (worker binding, pages binding, rest api)
sampleInterval ABR sample interval

AccountAiInferenceAdaptiveGroups

Aggregated AI Inference logs with adaptive sampling

FieldDescription
count Total number of inferences for an account
dimensions List of dimensions to group by
sum

AccountAiInferenceAdaptiveGroupsDimensions

FieldDescription
costMetricName1 Name for cost metric 1
costMetricName2 Name for cost metric 2
costMetricValue1 Value for cost metric 1
costMetricValue2 Value for cost metric 2
date The date when starts the inference
datetimeFifteenMinutes The date and time truncated to fifteen minutes
datetimeFiveMinutes The date and time truncated to five minutes
datetimeHour The date and time truncated to the hour
datetimeMinute The date and time truncated to the minute
errorCode Error code
inferenceTimeMs Inference time ms
modelId ModelId that was trigger to inference
modelIsBeta Model that was trigger to inference is Beta
neurons Monetization unit
requestBytesIn Request size in bytes
requestBytesOut Request size out bytes
requestSource Source who triggered (worker binding, pages binding, rest api)

AccountAiInferenceAdaptiveGroupsSum

FieldDescription
totalCostMetricValue1 Total value for cost metric 1
totalCostMetricValue2 Total value for cost metric 2
totalInferenceTimeMs Total inference time ms
totalNeurons Total neurons
totalRequestBytesIn Total bytes in per request
totalRequestBytesOut Total bytes out per request

AccountBrowserRenderingEventsAdaptive

Browser Rendering events with adaptive sampling

FieldDescription
browserCloseReason Browser session close code. Enum (-1, N/A) (0, Unknown) (1, NormalClosure) (2, BrowserIdle) (3, ClientClosedEarly) (4, ChromiumChrashed) (5, ClientAbnormalClosure) (6, ServerAbnormalClosure) (7, ClientError) (8, ServerError) (9, WorkerError) (10, ClientNeverConnected) (11, BrowserSessionEvicted)
browserEndTime Browser session end time
browserStartTime Browser session start time
connectionEndTime When worker ended devtools connection to browser session
connectionId Worker connection ID, when available
connectionStartTime When worker started devtools connection to browser session
datetime The time of the event
sampleInterval ABR sample interval
scriptName Name of worker who initiated the request
sessionId Browser session ID

AccountBrowserRenderingEventsAdaptiveGroups

Aggregated Browser Rendering events with adaptive sampling

FieldDescription
count Total number of events for an account
dimensions List of dimensions to group by
max The maximum value for a metric per dimension
min The minimum value for a metric per dimension
uniq

AccountBrowserRenderingEventsAdaptiveGroupsDimensions

FieldDescription
browserCloseReason Browser session close code. Enum (-1, N/A) (0, Unknown) (1, NormalClosure) (2, BrowserIdle) (3, ClientClosedEarly) (4, ChromiumChrashed) (5, ClientAbnormalClosure) (6, ServerAbnormalClosure) (7, ClientError) (8, ServerError) (9, WorkerError) (10, ClientNeverConnected) (11, BrowserSessionEvicted)
connectionId Worker connection ID, when available
date The date of the event
datetimeFifteenMinutes The date and time of the event truncated to fifteen minutes
datetimeFiveMinutes The date and time of the event truncated to five minutes
datetimeHour The date and time of the event truncated to the hour
datetimeMinute The date and time of the event truncated to the minute
scriptName Name of worker who initiated the request
sessionId Browser session ID

AccountBrowserRenderingEventsAdaptiveGroupsMax

FieldDescription
finalBrowserCloseReason Browser close reason
latestBrowserEndTime Browser end time

AccountBrowserRenderingEventsAdaptiveGroupsMin

FieldDescription
earliestBrowserStartTime Browser start time

AccountBrowserRenderingEventsAdaptiveGroupsUniq

FieldDescription
connectionIdCount Unique worker connections
sessionIdCount Unique browser sessions

AccountCallsStatusAdaptive

(TESTING ONLY, NOT FOR PRODUCTION) Raw Calls events with adaptive sampling

FieldDescription
appId The appId that generated traffic
datetime The date and time the event was recorded
event The description of the event related to a session or a track
sessionId The generated string that identifies a PeerConnection
trackId The track identifier provided to us within a PeerConnection

AccountCallsTurnUsageAdaptiveGroups

Aggregated Calls TURN bandwidth usage with adaptive sampling"

FieldDescription
avg
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountCallsTurnUsageAdaptiveGroupsAvg

FieldDescription
concurrentConnectionsFifteenMinutes Average concurrent connections when grouped by datetimeFifteenMinutes
concurrentConnectionsFiveMinutes Average concurrent connections when grouped by datetimeFiveMinutes
concurrentConnectionsHour Average concurrent connections when grouped by datetimeHour
concurrentConnectionsMinute Average concurrent connections when grouped by datetimeMinute

AccountCallsTurnUsageAdaptiveGroupsDimensions

FieldDescription
customIdentifier The customIdentifier (provided when credential was generated) that generated traffic
date Calls TURN bandwidth metrics date
datetimeFifteenMinutes Calls TURN bandwidth metrics timestamp, truncated to fifteen minutes
datetimeFiveMinutes Calls TURN bandwidth metrics timestamp, truncated to five minutes
datetimeHour Calls TURN bandwidth metrics timestamp, truncated to the hour
datetimeMinute Calls TURN bandwidth metrics timestamp, truncated to the minute
keyId The credentials created by this keyId that generated traffic
username The username from credential that generated traffic

AccountCallsTurnUsageAdaptiveGroupsSum

FieldDescription
egressBytes The total bytes sent by Calls TURN, observed over the queried time period
ingressBytes The total bytes received by Calls TURN, observed over the queried time period

AccountCallsUsageAdaptiveGroups

Beta. Aggregated Calls SFU bandwidth usage with adaptive sampling

FieldDescription
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountCallsUsageAdaptiveGroupsDimensions

FieldDescription
appId The appId that generated traffic
date Calls bandwidth metrics date
datetimeFifteenMinutes Calls bandwidth metrics timestamp, truncated to fifteen minutes
datetimeFiveMinutes Calls bandwidth metrics timestamp, truncated to five minutes
datetimeHour Calls bandwidth metrics timestamp, truncated to the hour
datetimeMinute Calls bandwidth metrics timestamp, truncated to the minute
sessionId The generated string that identifies a PeerConnection
trackId The track identifier provided to us within a PeerConnection
trackType Describes if the track contains video, audio, or data

AccountCallsUsageAdaptiveGroupsSum

FieldDescription
egressBytes The total bytes sent by Calls, observed over the queried time period
ingressBytes The total bytes received by Calls, observed over the queried time period

AccountCdnNetworkAnalyticsAdaptiveGroups

Network analytics data for Cloudflare CDN traffic

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountCdnNetworkAnalyticsAdaptiveGroupsAvg

FieldDescription
bitRate Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountCdnNetworkAnalyticsAdaptiveGroupsDimensions

FieldDescription
applicationTag Application tag associated with the packet
coloCity City where the Cloudflare datacenter that received the packet is located
coloCode Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName Cloudflare datacenter that received the packet (unique site identifier)
date Date that the packet was received
datetime Date and time that the packet was received
datetimeFifteenMinutes Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName Name of ASN associated with the destination IP of the packet, if available
destinationCountry Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationDeviceTag Device tag associated with the destination IP of the packet
destinationGeohash Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort Value of the Destination Port header field in the TCP or UDP packet
direction Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
ethertype Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum Value of the Checkusm header field in the GRE packet
greEthertype Value of the Ethertype header field in the GRE packet
greHeaderLength Length of the GRE packet header, in bytes
greKey Value of the Key header field in the GRE packet
greSequenceNumber Value of the Sequence Number header field in the GRE packet
greVersion Value of the Version header field in the GRE packet
icmpChecksum Value of the Checkusm header field in the ICMP packet
icmpCode Value of the Code header field in the ICMP packet
icmpType Value of the Type header field in the ICMP packet
ipDestinationAddress Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum Value of the Checksum header field in the IPv4 packet
ipv4DontFragment Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification Value of the Identification header field in the IPv4 packet
ipv4Options List of Options numbers included in the IPv4 packet header
ipv6Dscp Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel Value of the Flow Label header field in the IPv6 packet
ipv6Identification Value of the Identification extension header field in the IPv6 packet
leaseTag IP lease tag associated with the packet
mitigationSystem Which system dropped the packet (possible values: dosd, flowtrackd, magic-firewall)
outcome The action that was taken on the packet (possible values: pass, drop)
popName Cloudflare PoP that received the packet (unique site identifier)
prefixTag IP prefix tag associated with the packet
sampleInterval ABR sample interval
sourceAsn ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName Name of ASN associated with the source IP of the packet, if available
sourceCountry Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceDeviceTag Device tag associated with the source IP of the packet
sourceGeohash Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum Value of the Checkusm header field in the TCP packet
tcpDataOffset Value of the Data Offset header field in the TCP packet
tcpFlags Value of the Flags header field in the TCP packet
tcpFlagsString Human-readable string representation of the Flags header field in the TCP packet
tcpMss Value of the MSS option header field in the TCP packet
tcpOptions List of Options numbers included in the TCP packet header
tcpSackBlocks Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale Value of the Window Scale option header field in the TCP packet
tcpWindowSize Value of the Window Size header field in the TCP packet
udpChecksum Value of the Checkusm header field in the UDP packet
udpPayloadLength Value of the Payload Length header field in the UDP packet

AccountCdnNetworkAnalyticsAdaptiveGroupsSum

FieldDescription
bits Sum of bits received
packets Sum of packets received

AccountD1AnalyticsAdaptiveGroups

Beta. Aggregated D1 analytics with adaptive sampling

FieldDescription
avg The average value for a metric per dimension
count Number of requests to D1 processed
dimensions List of dimensions to group by
quantiles Quantiles of a metric per dimension
sum The sum of values for a metric per dimension

AccountD1AnalyticsAdaptiveGroupsAvg

FieldDescription
queryBatchResponseBytes The total number of bytes in the response, including all returned rows and metadata (average/mean).
queryBatchTimeMs Query batch response time in milliseconds (average/mean).
sampleInterval The average value used for sample interval

AccountD1AnalyticsAdaptiveGroupsDimensions

FieldDescription
databaseId The UUID of a D1 database
date The date the D1 request was received
datetimeFifteenMinutes The date and time the D1 request was received truncated to fifteen minutes
datetimeFiveMinutes The date and time the D1 request was received truncated to five minutes
datetimeHour The date and time the D1 request was received truncated to the hour
datetimeMinute The date and time the D1 request was received truncated to the minute

AccountD1AnalyticsAdaptiveGroupsQuantiles

FieldDescription
queryBatchResponseBytesP50 The total number of bytes in the response, including all returned rows and metadata (50th percentile).
queryBatchResponseBytesP90 The total number of bytes in the response, including all returned rows and metadata (90th percentile).
queryBatchTimeMsP50 Query batch response time in milliseconds (50th percentile).
queryBatchTimeMsP90 Query batch response time in milliseconds (90th percentile).

AccountD1AnalyticsAdaptiveGroupsSum

FieldDescription
queryBatchResponseBytes The total number of bytes in the response, including all returned rows and metadata.
readQueries The number of read queries.
rowsRead The number of rows your queries read.
rowsWritten The number of rows your queries wrote.
writeQueries The number of write queries.

AccountD1QueriesAdaptiveGroups

Beta. D1 query metrics with adaptive sampling

FieldDescription
avg The average value for a metric per dimension
count Number of D1 queries processed
dimensions List of dimensions to group by
quantiles Quantiles of a metric per dimension
sum The sum of values for a metric per dimension

AccountD1QueriesAdaptiveGroupsAvg

FieldDescription
queryDurationMs The average duration queries in D1 took, observed over the queried time period.
rowsRead The average number of rows scanned, observed over the queried time period.
rowsReturned The average number of rows returned, observed over the queried time period.
rowsWritten The average number of rows written, observed over the queried time period.
sampleInterval The average value used for sample interval

AccountD1QueriesAdaptiveGroupsDimensions

FieldDescription
databaseId The UUID of a D1 database
date D1 query sample timestamp
datetimeFifteenMinutes D1 query sample timestamp, truncated to fifteen minutes
datetimeFiveMinutes D1 query sample timestamp, truncated to five minutes
datetimeHour D1 query sample timestamp, truncated to the hour
datetimeMinute D1 query sample timestamp, truncated to the minute
query The SQL query that ran on a D1 database, with parameterized values replaced with placeholders.

AccountD1QueriesAdaptiveGroupsQuantiles

FieldDescription
queryDurationMsP50 50th percentile Query Duration (milliseconds)
queryDurationMsP95 95th percentile Query Duration (milliseconds)
queryDurationMsP99 99th percentile Query Duration (milliseconds)

AccountD1QueriesAdaptiveGroupsSum

FieldDescription
queryDurationMs The total duration queries in D1 took, observed over the queried time period.
rowsRead The total number of rows scanned, observed over the queried time period.
rowsReturned The total number of rows returned, observed over the queried time period.
rowsWritten The total number of rows written, observed over the queried time period.

AccountD1StorageAdaptiveGroups

Beta. D1 storage with adaptive sampling

FieldDescription
dimensions List of dimensions to group by
max The max of values for a metric per dimension

AccountD1StorageAdaptiveGroupsDimensions

FieldDescription
databaseId The UUID of a D1 database
date D1 storage sample timestamp
datetimeFifteenMinutes D1 storage sample timestamp, truncated to fifteen minutes
datetimeFiveMinutes D1 storage sample timestamp, truncated to five minutes
datetimeHour D1 storage sample timestamp, truncated to the hour
datetimeMinute D1 storage sample timestamp, truncated to the minute

AccountD1StorageAdaptiveGroupsMax

FieldDescription
databaseSizeBytes The maximum size of the database (measured in bytes) observed over the queried time period.

AccountDosdAttackAnalyticsGroups

Attack analytics metadata for attacks detected by dosd

FieldDescription
attackId Unique identifier of the mitigation that matched the packet, if any
attackType DEPRECATED (Use attackVector for a richer description of the attack): Type of attack traffic
attackVector Description of attack vector
bits Sum of bits received during the attack
commonTcpFlags Common TCP flags used by attack traffic, if any
commonTcpFlagsNames Names of common TCP flags used by attack traffic, if any
destinationIp Fixed destination IP used by attack traffic, if any
destinationPort Fixed destination port used by attack traffic, if any
droppedBits Sum of bits dropped during the attack
droppedPackets Sum of packets dropped during the attack
endDatetime Date and time that the attack ended; not available for ongoing attacks
ipProtocol Fixed protocol used by attack traffic, if any
ipProtocolName Fixed protocol used by attack traffic, if any
mitigationReason Type of mitigation applied to attack traffic
mitigationScope Whether mitigation was applied in only some locations or globally
mitigationType Type of mitigation applied to attack traffic
packets Sum of packets received during the attack
ruleId Unique identifier of the rule that matched the packet, if any
ruleName Human-readable name of the rule that matched the packet, if any
rulesetId Unique identifier of the ruleset containing the rule that matched the packet, if any
rulesetOverrideId Unique identifier of the ruleset override containing the rule that matched the packet, if any
sourceIp Fixed source IP used by attack traffic, if any
sourcePort Fixed source port used by attack traffic, if any
startDatetime Date and time that the attack started
tcpFlags Fixed TCP flags used by attack traffic, if any
tcpFlagsNames Names of fixed TCP flags used by attack traffic, if any

AccountDosdNetworkAnalyticsAdaptiveGroups

Network analytics data for dosd

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountDosdNetworkAnalyticsAdaptiveGroupsAvg

FieldDescription
bitRate Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountDosdNetworkAnalyticsAdaptiveGroupsDimensions

FieldDescription
applicationTag Application tag associated with the packet
attackId Unique identifier of the mitigation that matched the packet, if any
attackVector Attack vector of the rule that matched the packet, if any
coloCity City where the Cloudflare datacenter that received the packet is located
coloCode Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName Cloudflare datacenter that received the packet (unique site identifier)
date Date that the packet was received
datetime Date and time that the packet was received
datetimeFifteenMinutes Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName Name of ASN associated with the destination IP of the packet, if available
destinationCountry Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationGeohash Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort Value of the Destination Port header field in the TCP or UDP packet
direction Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
ethertype Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum Value of the Checkusm header field in the GRE packet
greEthertype Value of the Ethertype header field in the GRE packet
greHeaderLength Length of the GRE packet header, in bytes
greKey Value of the Key header field in the GRE packet
greSequenceNumber Value of the Sequence Number header field in the GRE packet
greVersion Value of the Version header field in the GRE packet
icmpChecksum Value of the Checkusm header field in the ICMP packet
icmpCode Value of the Code header field in the ICMP packet
icmpType Value of the Type header field in the ICMP packet
ipDestinationAddress Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum Value of the Checksum header field in the IPv4 packet
ipv4DontFragment Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification Value of the Identification header field in the IPv4 packet
ipv4Options List of Options numbers included in the IPv4 packet header
ipv6Dscp Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel Value of the Flow Label header field in the IPv6 packet
ipv6Identification Value of the Identification extension header field in the IPv6 packet
leaseTag IP lease tag associated with the packet
mitigationReason Reason for applying a mitigation to the packet, if any
mitigationScope Whether the packet matched a local or global mitigation, if any (possible values: local, global)
outcome The action that was taken on the packet (possible values: pass, drop)
prefixTag IP prefix tag associated with the packet
protocolState State of the packet in the context of the protocol, if available
ruleId Unique identifier of the rule that matched the packet, if any
ruleName Human-readable name of the rule that matched the packet, if any
rulesetId Unique identifier of the ruleset containing the rule that matched the packet, if any
rulesetOverrideId Unique identifier of the ruleset override containing the rule that matched the packet, if any
sampleInterval ABR sample interval
sourceAsn ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName Name of ASN associated with the source IP of the packet, if available
sourceCountry Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceGeohash Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum Value of the Checkusm header field in the TCP packet
tcpDataOffset Value of the Data Offset header field in the TCP packet
tcpFlags Value of the Flags header field in the TCP packet
tcpFlagsString Human-readable string representation of the Flags header field in the TCP packet
tcpMss Value of the MSS option header field in the TCP packet
tcpOptions List of Options numbers included in the TCP packet header
tcpSackBlocks Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale Value of the Window Scale option header field in the TCP packet
tcpWindowSize Value of the Window Size header field in the TCP packet
udpChecksum Value of the Checkusm header field in the UDP packet
udpPayloadLength Value of the Payload Length header field in the UDP packet
verdict The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop)

AccountDosdNetworkAnalyticsAdaptiveGroupsSum

FieldDescription
bits Sum of bits received
packets Sum of packets received

AccountDurableObjectsInvocationsAdaptiveGroups

Durable Objects invocations with adaptive sampling

FieldDescription
avg The average value used for sample interval
dimensions List of dimensions to group by
max The max value for a metric
min The min value for a metric
quantiles Quantiles of a metric per dimension
sum The sum of values for a metric per dimension

AccountDurableObjectsInvocationsAdaptiveGroupsAvg

FieldDescription
sampleInterval

AccountDurableObjectsInvocationsAdaptiveGroupsDimensions

FieldDescription
date Request datetime, truncated to start of a day
datetime Request datetime
datetimeHour Request datetime, truncated to start of an hour
datetimeMinute Request datetime, truncated to start of a minute
environmentName The name of the script environment
namespaceId Durable Object namespace ID
objectId Durable Object ID as a hex string
scriptName The name of the script
status Status of the worker invocation

AccountDurableObjectsInvocationsAdaptiveGroupsMax

FieldDescription
responseBodySize Maximum response body size for one request - bytes
wallTime Maximum wall time for one request - microseconds

AccountDurableObjectsInvocationsAdaptiveGroupsMin

FieldDescription
responseBodySize Minimum response body size for one request - bytes
wallTime Minimum wall time for one request - microseconds

AccountDurableObjectsInvocationsAdaptiveGroupsQuantiles

FieldDescription
responseBodySizeP25 Response body size 25th percentile - bytes
responseBodySizeP50 Response body size 50th percentile - bytes
responseBodySizeP75 Response body size 75th percentile - bytes
responseBodySizeP90 Response body size 90th percentile - bytes
responseBodySizeP99 Response body size 99th percentile - bytes
responseBodySizeP999 Response body size 99.9th percentile - bytes
wallTimeP25 Wall time 25th percentile - microseconds
wallTimeP50 Wall time 50th percentile - microseconds
wallTimeP75 Wall time 75th percentile - microseconds
wallTimeP90 Wall time 90th percentile - microseconds
wallTimeP99 Wall time 99th percentile - microseconds
wallTimeP999 Wall time 99.9th percentile - microseconds

AccountDurableObjectsInvocationsAdaptiveGroupsSum

FieldDescription
errors Sum of errors
requests Sum of requests
responseBodySize Sum of response body sizes
wallTime Sum of wall time

AccountDurableObjectsPeriodicGroups

Durable Objects periodic metrics

FieldDescription
dimensions List of dimensions to group by
max The max value for a metric
sum The sum of values for a metric per dimension

AccountDurableObjectsPeriodicGroupsDimensions

FieldDescription
date Datetime the metrics period started, truncated to start of a day
datetimeHour Datetime the metrics period started, truncated to start of an hour
datetimeMinute Datetime the metrics period started, truncated to start of a minute
namespaceId Durable Object namespace ID
objectId Durable Object ID as a hex string

AccountDurableObjectsPeriodicGroupsMax

FieldDescription
activeWebsocketConnections Maximum active websocket connections in the time window

AccountDurableObjectsPeriodicGroupsSum

FieldDescription
activeTime Sum of active time - microseconds
cpuTime Sum of CPU time - microseconds
duration Sum of Duration - GB*s
exceededCpuErrors Sum of CPU exceeded errors
exceededMemoryErrors Sum of memory exceeded errors
fatalInternalErrors Sum of fatal internal server errors
inboundWebsocketMsgCount Sum of incoming websocket messages
outboundWebsocketMsgCount Sum of outbound websocket messages
rowsRead Sum of rows read (by sqlite backed DOs)
rowsWritten Sum of rows written (by sqlite backed DOs)
storageDeletes Sum of storage deletes (by non-sqlite backed DOs)
storageReadUnits Sum of storage reads - in 4KB units (by non-sqlite backed DOs)
storageWriteUnits Sum of storage writes - in 4KB units (by non-sqlite backed DOs)
subrequests Sum of subrequests

AccountDurableObjectsStorageGroups

Durable Objects storage metrics

FieldDescription
dimensions List of dimensions to group by
max The sum of values for a metric per dimension

AccountDurableObjectsStorageGroupsDimensions

FieldDescription
date Datetime that the storage usage was recorded, truncated to start of a day
datetimeHour Datetime that the storage usage was recorded, truncated to start of an hour

AccountDurableObjectsStorageGroupsMax

FieldDescription
storedBytes Max of stored bytes

AccountDurableObjectsSubrequestsAdaptiveGroups

Durable Objects subrequests with adaptive sampling

FieldDescription
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountDurableObjectsSubrequestsAdaptiveGroupsDimensions

FieldDescription
date Request datetime, truncated to start of a day
datetime Request datetime
datetimeHour Request datetime, truncated to start of an hour
datetimeMinute Request datetime, truncated to start of a minute
environmentName The name of the script environment
namespaceId Durable Object namespace ID
objectId Durable Object ID as a hex string
scriptName The name of the script

AccountDurableObjectsSubrequestsAdaptiveGroupsSum

FieldDescription
requestBodySizeUncached Outgoing Durable Objects fetch request body size in bytes where the request was not cached

AccountFbmAttackAnalyticsGroups

FBM analytics metadata for attacks detected by dosd

FieldDescription
attackId Unique identifier of the mitigation that matched the packet, if any
attackType DEPRECATED (Use attackVector for a richer description of the attack): Type of attack traffic
attackVector Description of attack vector
bits Sum of bits received during the attack
commonTcpFlags Common TCP flags used by attack traffic, if any
commonTcpFlagsNames Names of common TCP flags used by attack traffic, if any
destinationIp Fixed destination IP used by attack traffic, if any
destinationPort Fixed destination port used by attack traffic, if any
droppedBits Sum of bits dropped during the attack
droppedPackets Sum of packets dropped during the attack
endDatetime Date and time that the attack ended; not available for ongoing attacks
ipProtocol Fixed protocol used by attack traffic, if any
ipProtocolName Fixed protocol used by attack traffic, if any
mitigationReason Type of mitigation applied to attack traffic
mitigationScope Whether mitigation was applied in only some locations or globally
mitigationType Type of mitigation applied to attack traffic
packets Sum of packets received during the attack
ruleId Unique identifier of the rule that matched the packet, if any
ruleName Human-readable name of the rule that matched the packet, if any
rulesetId Unique identifier of the ruleset containing the rule that matched the packet, if any
rulesetOverrideId Unique identifier of the ruleset override containing the rule that matched the packet, if any
sourceIp Fixed source IP used by attack traffic, if any
sourcePort Fixed source port used by attack traffic, if any
startDatetime Date and time that the attack started
tcpFlags Fixed TCP flags used by attack traffic, if any
tcpFlagsNames Names of fixed TCP flags used by attack traffic, if any

AccountFilter_InputObject

FieldDescription

AccountFirewallEventsAdaptive

Raw Firewall events with adaptive sampling

FieldDescription
action The code of the first-class action the Cloudflare Firewall took on this request
apiGatewayMatchedEndpoint API Gateway endpoint matched at the edge
apiGatewayMatchedHost API Gateway host matched at the edge
botDetectionIds Array of detections ids that matched this request
botDetectionTags Array of detections tags that matched this request
botScore The final score originated from bot management detections.
botScoreSrcName Name of the source detection which generated the bot management score.
clientASNDescription The ASN of the visitor as string
clientAsn The ASN number of the visitor
clientCountryName Country from which request originated
clientIP The visitor's IP address (IPv4 or IPv6)
clientIPClass The classification of the visitor's IP address, possible values are: unknown | clean | badHost | searchEngine | allowlist | greylist | monitoringService | securityScanner | noRecord | scan | backupService | mobilePlatform | tor
clientRefererHost The referer host
clientRefererPath The referer path requested by visitor
clientRefererQuery The referer query-string was requested by the visitor
clientRefererScheme The referer url scheme requested by the visitor
clientRequestHTTPHost The HTTP hostname requested by the visitor
clientRequestHTTPMethodName The HTTP method used by the visitor
clientRequestHTTPProtocol The version of HTTP protocol requested by the visitor
clientRequestPath The path requested by visitor
clientRequestQuery The query-string was requested by the visitor
clientRequestScheme The url scheme requested by the visitor
contentScanHasFailed 1 if not all contents for this request where successfully scanned, else 0
contentScanNumMaliciousObj Number of scannable content objects that are malicious
contentScanNumObj Number of scannable content objects
contentScanObjResults Array of scan results in order of detection
contentScanObjSizes Array of scan sizes in order of detection
contentScanObjTypes Array of content types in order of detection
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute
description The description of the rule triggered by this request
edgeColoName The airport code of the Cloudflare datacenter that served this request
edgeResponseStatus HTTP response status code returned to browser
httpApplicationVersion DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application
ja3Hash MD5 hash of the JA3 TLS fingerprint
ja4 JA4 TLS fingerprint
ja4Signals Inter-request statistics computed for this JA4 across Cloudflare's entire global edge network
kind The kind of event, currently only possible values are: firewall
leakedCredentialCheckResult The distinct result of checking for leaked credentials
matchIndex Rules match index in the chain
metadata Additional product-specific information. Metadata is organized in key:value pairs
originResponseStatus HTTP origin response status code returned to browser
originatorRayName The RayId of the request that issued the challenge/jschallenge
rayName The RayId of the request
ref The ref-field is a user-defined rule identifier that can be set via the API for some firewall products and allows users to label their rules individually alongside cloudflare provided identifiers (only available to entitled customers)
ruleId The Cloudflare security product-specific RuleId triggered by this request
rulesetId The Cloudflare security product-specific RulesetId triggered by this request
sampleInterval ABR sample interval
source The Cloudflare security product triggered by this request
userAgent visitor's user-agent string
wafAttackScore Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass Beta. Overall request score class generated by the WAF detection module
wafMlAttackScore DEPRECATED (Field is replaced with wafAttackScore): Beta. Overall request score generated by the WAF detection module
wafMlSqliAttackScore DEPRECATED (Field is replaced with wafSqliAttackScore): Beta. WAF ML score for an SQLi attack
wafMlXssAttackScore DEPRECATED (Field is replaced with wafXssAttackScore): Beta. WAF ML score for an XSS attack
wafRceAttackScore Beta. WAF score for a RCE attack
wafSqliAttackScore Beta. WAF score for a SQLi attack
wafXssAttackScore Beta. WAF score for a XSS attack
zoneTag Associated zone
zoneVersion The version of a zone

AccountFirewallEventsAdaptiveGroups

Aggregated Firewall events with adaptive sampling

FieldDescription
avg The average value used for sample interval
count The sum of sample interval values
dimensions List of dimensions to group by
sum

AccountFirewallEventsAdaptiveGroupsAvg

FieldDescription
sampleInterval

AccountFirewallEventsAdaptiveGroupsDimensions

FieldDescription
action The code of the first-class action the Cloudflare Firewall took on this request
apiGatewayMatchedEndpoint API Gateway endpoint matched at the edge
apiGatewayMatchedHost API Gateway host matched at the edge
botDetectionIds Array of detections ids that matched this request
botDetectionTags Array of detections tags that matched this request
botScore The final score originated from bot management detections.
botScoreSrcName Name of the source detection which generated the bot management score.
clientASNDescription The ASN of the visitor as string
clientAsn The ASN number of the visitor
clientCountryName Country from which request originated
clientIP The visitor's IP address (IPv4 or IPv6)
clientIPClass The classification of the visitor's IP address, possible values are: unknown | clean | badHost | searchEngine | allowlist | greylist | monitoringService | securityScanner | noRecord | scan | backupService | mobilePlatform | tor
clientRefererHost The referer host
clientRefererPath The referer path requested by visitor
clientRefererQuery The referer query-string was requested by the visitor
clientRefererScheme The referer url scheme requested by the visitor
clientRequestHTTPHost The HTTP hostname requested by the visitor
clientRequestHTTPMethodName The HTTP method used by the visitor
clientRequestHTTPProtocol The version of HTTP protocol requested by the visitor
clientRequestPath The path requested by visitor
clientRequestQuery The query-string was requested by the visitor
clientRequestScheme The url scheme requested by the visitor
contentScanHasFailed 1 if not all contents for this request where successfully scanned, else 0
contentScanNumMaliciousObj Number of scannable content objects that are malicious
contentScanNumObj Number of scannable content objects
contentScanObjResults Array of scan results in order of detection
contentScanObjSizes Array of scan sizes in order of detection
contentScanObjTypes Array of content types in order of detection
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute
description The description of the rule triggered by this request
edgeColoName The airport code of the Cloudflare datacenter that served this request
edgeResponseStatus HTTP response status code returned to browser
httpApplicationVersion DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application
ja3Hash MD5 hash of the JA3 TLS fingerprint
ja4 JA4 TLS fingerprint
kind The kind of event, currently only possible values are: firewall
matchIndex Rules match index in the chain
originResponseStatus HTTP origin response status code returned to browser
originatorRayName The RayId of the request that issued the challenge/jschallenge
rayName The RayId of the request
ref The ref-field is a user-defined rule identifier that can be set via the API for some firewall products and allows users to label their rules individually alongside cloudflare provided identifiers (only available to entitled customers)
ruleId The Cloudflare security product-specific RuleId triggered by this request
rulesetId The Cloudflare security product-specific RulesetId triggered by this request
sampleInterval ABR sample interval
source The Cloudflare security product triggered by this request
userAgent visitor's user-agent string
wafAttackScore Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass Beta. Overall request score class generated by the WAF detection module
wafMlAttackScore DEPRECATED (Field is replaced with wafAttackScore): Beta. Overall request score generated by the WAF ML detection module
wafMlSqliAttackScore DEPRECATED (Field is replaced with wafSqliAttackScore): Beta. WAF ML score for an SQLi attack
wafMlXssAttackScore DEPRECATED (Field is replaced with wafXssAttackScore): Beta. WAF ML score for an XSS attack
wafRceAttackScore Beta. WAF score for a RCE attack
wafSqliAttackScore Beta. WAF score for a SQLi attack
wafXssAttackScore Beta. WAF score for a XSS attack
zoneTag Associated zone
zoneVersion The version of a zone

AccountFirewallEventsAdaptiveGroupsSum

FieldDescription
botDetectionIdArray Array of bot management detection ids
botDetectionIdCountArray Count array of bot management detection ids. Elements in this array correspond to elements in botDetectionIdArray by index.
botDetectionTagArray Array of bot management detection tags
botDetectionTagCountArray Count array of bot management detection tags. Elements in this array correspond to elements in botDetectionTagArray by index.

AccountFirewallEventsAdaptiveJa4SignalsElem

FieldDescription
signalName Signal name
signalValue Signal value

AccountFirewallEventsAdaptiveMetadataElem

FieldDescription
key The key of the metadata. Key format can vary by Cloudflare security product and can change over time.
value The value of the metadata. Value format can vary by Cloudflare security product and can change over time.

AccountFlowtrackdNetworkAnalyticsAdaptiveGroups

Network analytics data for flowtrackd

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsAvg

FieldDescription
bitRate Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsDimensions

FieldDescription
applicationTag Application tag associated with the packet
coloCity City where the Cloudflare datacenter that received the packet is located
coloCode Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName Cloudflare datacenter that received the packet (unique site identifier)
date Date that the packet was received
datetime Date and time that the packet was received
datetimeFifteenMinutes Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName Name of ASN associated with the destination IP of the packet, if available
destinationCountry Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationGeohash Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort Value of the Destination Port header field in the TCP or UDP packet
direction Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
ethertype Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum Value of the Checkusm header field in the GRE packet
greEthertype Value of the Ethertype header field in the GRE packet
greHeaderLength Length of the GRE packet header, in bytes
greKey Value of the Key header field in the GRE packet
greSequenceNumber Value of the Sequence Number header field in the GRE packet
greVersion Value of the Version header field in the GRE packet
icmpChecksum Value of the Checkusm header field in the ICMP packet
icmpCode Value of the Code header field in the ICMP packet
icmpType Value of the Type header field in the ICMP packet
ipDestinationAddress Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum Value of the Checksum header field in the IPv4 packet
ipv4DontFragment Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification Value of the Identification header field in the IPv4 packet
ipv4Options List of Options numbers included in the IPv4 packet header
ipv6Dscp Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel Value of the Flow Label header field in the IPv6 packet
ipv6Identification Value of the Identification extension header field in the IPv6 packet
leaseTag IP lease tag associated with the packet
mitigationReason Reason for applying a mitigation to the packet, if any
mitigationScope Whether the packet matched a local or global mitigation, if any (possible values: local, global)
outcome The action that was taken on the packet (possible values: pass, drop)
prefixTag IP prefix tag associated with the packet
protocolState State of the packet in the context of the protocol, if available
sampleInterval ABR sample interval
sourceAsn ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName Name of ASN associated with the source IP of the packet, if available
sourceCountry Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceGeohash Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum Value of the Checkusm header field in the TCP packet
tcpDataOffset Value of the Data Offset header field in the TCP packet
tcpFlags Value of the Flags header field in the TCP packet
tcpFlagsString Human-readable string representation of the Flags header field in the TCP packet
tcpMss Value of the MSS option header field in the TCP packet
tcpOptions List of Options numbers included in the TCP packet header
tcpSackBlocks Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale Value of the Window Scale option header field in the TCP packet
tcpWindowSize Value of the Window Size header field in the TCP packet
udpChecksum Value of the Checkusm header field in the UDP packet
udpPayloadLength Value of the Payload Length header field in the UDP packet
verdict The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop)

AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsSum

FieldDescription
bits Sum of bits received
packets Sum of packets received

AccountGatewayL4DownstreamSessionsAdaptiveGroups

Aggregated metrics about downstream (client to edge) L4 Gateway Sessions. Metrics are reported on TCP or UDP session close

FieldDescription
count The number of downstream sessions
dimensions List of dimensions to group by
quantiles
sum

AccountGatewayL4DownstreamSessionsAdaptiveGroupsDimensions

FieldDescription
coloCode IATA Airport code that represents the city in which a Cloudflare data center (colo) is located
coloCountry ISO 3166-1 alpha-2 code that represents the country in which a Cloudflare data center (colo) is located
date Start timestamp of this session, truncated to date
datetimeFifteenMinutes Start timestamp of this session, truncated to multiple of 15 minutes
datetimeFiveMinutes Start timestamp of this session, truncated to multiple of 5 minutes
datetimeHour Start timestamp of this session, truncated to the hour
datetimeMinute Start timestamp of this session, truncated to the minute
quicErrorCode QUIC specific error code. Possible values are https://www.iana.org/assignments/quic/quic.xhtml#quic-transport-error-codes
rttUs Last Round Trip Time estimation for this session in microseconds
sessionId Identifier for this session
sourceIP IP address of the client making this session
tokenAuthStatus Client token authentication status. Possible values are success | failed with invalid token and upto date token key ID | failed with invalid token due to outdated/missing token key ID | failed due to reused token
tokenSigningRegion Broad location assigned to client in this session
transport Transport protocol used for this session. Possible values are tcp | quic | udp
transportHandshakeDurationUs Time taken for TCP/TLS or QUIC handshake in microsecond
transportStatus Transport Status. Possible values are unknown | success | failure

AccountGatewayL4DownstreamSessionsAdaptiveGroupsQuantiles

FieldDescription
tokenAuthDurationUsP50 Time taken for Client Token Authentication in microseconds
transportHandshakeDurationUsP50 Time taken for TCP/TLS or QUIC handshake in microseconds

AccountGatewayL4DownstreamSessionsAdaptiveGroupsSum

FieldDescription
bytesRecvd Total bytes received in this session
bytesSent Total bytes sent in this session
clientBytesRetransmitted Total bytes retransmitted by client in this session
packetsRecvd Total number of packets received in this session
packetsSent Total number of packets sent in this session
tokenAuthDurationUs Time taken for client token authentication in microseconds

AccountGatewayL4SessionsAdaptiveGroups

BETA - Aggregate counts of Gateway L4 sessions with adaptive sampling

FieldDescription
count The number of Gateway L4 sessions
dimensions List of dimensions to group by

AccountGatewayL4SessionsAdaptiveGroupsDimensions

FieldDescription
action action taken by gateway
applicationIds IDs of the applications that matched the session parameters
applicationNames Names of the applications that matched the session parameters
coloCode Colo Code of edge server
datetime Datetime that the session was started
datetimeHour Datetime that the session was started truncated to hours
datetimeMinute Datetime that the session was started truncated to minutes
destinationIp The destination IP address for the session
destinationPort The destination port for the session
detectedProtocol The detected protocol of network traffic
deviceId The device ID of the gateway user who initiated the session
dstIpContinent Continent code of the session destination IP address
dstIpCountry Country code of the session destination IP address
email The email address of the gateway user who initiated the session
proxyEndpoint The proxy endpoint used on this session
sessionId The network session unique identifier
sni The SNI pulled from the session tls handshake, if present
sourceInternalIp Local LAN IP of the device. Only available when connected via a GRE/IPsec tunnel on-ramp
sourceIp The source IP address for the session
sourcePort The source port for the session
srcIpContinent Continent code of the session source IP address
srcIpCountry Country code of the session source IP address
transport DEPRECATED (Field is replaced with transportProtocol): The transport protocol used in the session, one of (0, tcp) (1, quic) (2, udp). Deprecated, please use transportProtocol
transportProtocol The transport protocol used in the session, one of (0, tcp) (1, quic) (2, udp)
userId The ID of the gateway user who initiated the session
virtualNetworkId The ID of the virtual nework the device was connected to
virtualNetworkName The name of the virtual nework the device was connected to

AccountGatewayL4UpstreamSessionsAdaptiveGroups

Aggregated metrics about upstream (edge to client) L4 Gateway Sessions. Metrics are reported on TCP, QUIC or UDP session close

FieldDescription
count The number of upstream sessions
dimensions List of dimensions to group by
quantiles
sum

AccountGatewayL4UpstreamSessionsAdaptiveGroupsDimensions

FieldDescription
coloCode IATA Airport code that represents the city in which a Cloudflare data center (colo) is located
coloCountry ISO 3166-1 alpha-2 code that represents the country in which a Cloudflare data center (colo) is located
date Start timestamp of this session, truncated to date
datetimeFifteenMinutes Start timestamp of this session, truncated to multiple of 15 minutes
datetimeFiveMinutes Start timestamp of this session, truncated to multiple of 5 minutes
datetimeHour Start timestamp of this session, truncated to the hour
datetimeMinute Start timestamp of this session, truncated to the minute
destinationIP IP address of the origin server
domainName SNI domain name for this session
downstreamSessionId Downstream session identifier of this session
httpConnectReqStatus Client HTTP CONNECT request status. Possible values are unknown | success | failure
quicErrorCode QUIC error code. Possible values are https://www.iana.org/assignments/quic/quic.xhtml#quic-transport-error-codes
rttUs Last Round Trip Time estimation for this session in microseconds
tokenSigningRegion Broad location assigned to client in this session
totalTunnelSetupDurationUs Total time taken for tunnel setup in microseconds
transport Transport protocol used for this session. Possible values are tcp | quic | udp
transportStatus Transport status. Possible values are unknown | success | failure

AccountGatewayL4UpstreamSessionsAdaptiveGroupsQuantiles

FieldDescription
connectReqHandlingDurationUsP50 Time taken for CONNECT request handling in microseconds
totalTunnelSetupDurationUsP50 Total time taken for tunnel setup in microseconds
tunnelSetupDurationUsP50 Time taken to setup the tunnel in microseconds

AccountGatewayL4UpstreamSessionsAdaptiveGroupsSum

FieldDescription
bytesRecvd Total bytes received in this session
bytesSent Total bytes sent in this session
connectReqHandlingDurationUs Time taken for CONNECT request handling in microseconds
originBytesRetransmitted Total bytes retransmitted by origin in this session
packetsRecvd Total number of packets received in this session
packetsSent Total number of packets sent in this session
totalTunnelSetupDurationUs Total time taken for tunnel setup in microseconds
tunnelSetupDurationUs Time taken for tunnel setup in microseconds

AccountGatewayL7RequestsAdaptiveGroups

BETA - Aggregate counts of Gateway L7 requests with adaptive sampling

FieldDescription
count The number of Gateway L7 requests
dimensions List of dimensions to group by

AccountGatewayL7RequestsAdaptiveGroupsDimensions

FieldDescription
action action taken by gateway
applicationIds IDs of the applications that matched the request parameters
applicationNames Names of the applications that matched the request parameters
categoryIds IDs of the categories that matched the request parameters
categoryNames Names of the categories that matched the request parameters
coloCode Colo Code of edge server
datetime Datetime that the request happened
datetimeHour Datetime that the request happened truncated to hours
datetimeMinute Datetime that the request happened truncated to minutes
deviceId The device ID of the gateway user who made the request
dstIpContinent Continent code of the request destination IP address
dstIpCountry Country code of the request destination IP address
email The email address of the gateway user who made the request
httpHost The destination host for the request
httpStatusCode HTTP status code gateway returned to the user. 0 if nothing was returned(e.g client disconnected)
isIsolated Indicates whether this request was made through an isolated link
privateAppAUD Access private app AUD
proxyEndpoint The proxy endpoint used on this request
quarantined Indicates if the request content was quarantined
requestId The request unique identifier
sourceInternalIp Local LAN IP of the device. Only available when connected via a GRE/IPsec tunnel on-ramp
srcIpContinent Continent code of the request source IP address
srcIpCountry Country code of the request source IP address
untrustedCertificateAction Action taken when an untrusted origin certificate error occurs
url The request URL
userId The ID of the gateway user who made the request
virtualNetworkId The ID of the virtual nework the device was connected to
virtualNetworkName The name of the virtual nework the device was connected to

AccountGatewayResolverByCategoryAdaptiveGroups

BETA - Aggregate counts of Gateway Resolver queries by category with adaptive sampling

FieldDescription
count The number of Gateway Resolver queries
dimensions List of dimensions to group by

AccountGatewayResolverByCategoryAdaptiveGroupsDimensions

FieldDescription
authoritativeNameserverIps List of IPs of the authoritative nameservers that provided the answers, if any
categoryId ID of the category that was assigned to the domain
cnames List of resolved intermediate cname domains
datetime The date and time the DNS query was resolved
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to minutes
dohSubdomain The destination DoH subdomain the DNS query was made to
dotSubdomain The destination DoT subdomain the DNS query was made to
edeErrors List of returned Extended DNS Error Codes
locationId The uuid identifying the customer Location used when resolving
matchedApplicationId ID of the application the domain belongs to
matchedApplicationName Name of the application the domain belongs to
policyId ID of the policy/rule that was applied, if any
policyName Name of the policy that was applied, if any
resolvedIpContinents Continent code of each resolved IP, if any
resolvedIpCountries Country code of each resolved IP, if any
resolvedIps List of resolved IPs in the response, if any
resolverDecision Enum identifier for the decision made by gateway-resolver, one of: (0, unknown) (1, allowedByQueryName) (2, blockedByQueryName) (3, blockedByCategory) (4, allowedOnNoLocation) (5, allowedOnNoPolicyMatch) (6, blockedAlwaysCategory) (7, overrideForSafeSearch) (8, overrideApplied) (9, blockedRule) (10, allowedRule)
resourceRecordClasses Resource records' classes
resourceRecordNames Resource records' names
resourceRecordRDatas Resource records' rdata values
resourceRecordTTLs Resource records' TTL values
resourceRecordTypes Resource records' types
srcIpContinent Continent code of the source IP address making the DNS query
srcIpCountry Country code of the source IP address making the DNS query

AccountGatewayResolverByCustomResolverGroups

Stats on dns custom resolvers

FieldDescription
avg The average value for a metric
count The number of Gateway Resolver queries
dimensions List of dimensions to group by
max Maximum response time

AccountGatewayResolverByCustomResolverGroupsAvg

FieldDescription
customResolverTimeInMs Average latency
sampleInterval Average sample interval

AccountGatewayResolverByCustomResolverGroupsDimensions

FieldDescription
cacheStatus whether the response was cached or not
customResolverAddress address at which custom resolver query was resolved at
customResolverResponseCode Response code recieved from the custom resolver 0 => unknown 27 => dnsFirewallSuccess 29 => dnsFirewallCustomerRatelimit 31 => dnsFirewallUpstreamFailure 32 => dnsFirewallUpstreamServfail
customResolverTimeInMs time took for custom resolver to respond
datetime The date and time the DNS query was resolved
locationId The uuid identifying the customer Location used when resolving
queryName Name of the query, e.g. one.dash.cloudflare.com
resolverDecision Enum identifier for the decision made by gateway-resolver, one of: (0, unknown) (1, allowedByQueryName) (2, blockedByQueryName) (3, blockedByCategory) (4, allowedOnNoLocation) (5, allowedOnNoPolicyMatch) (6, blockedAlwaysCategory) (7, overrideForSafeSearch) (8, overrideApplied) (9, blockedRule) (10, allowedRule)

AccountGatewayResolverByCustomResolverGroupsMax

FieldDescription
customResolverTimeInMs Maximum response time

AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroups

Total time spent on executing firewall rules at the edge

FieldDescription
avg The average value for a metric per dimension
count The number of Gateway Resolver queries
dimensions List of dimensions to group by
max Maximum execution time
quantiles Quantiles of a rule execution performance

AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsAvg

FieldDescription
sampleInterval Average sample interval

AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsDimensions

FieldDescription
datetime Request timestamp
datetimeMonth Request timestamp month

AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsMax

FieldDescription
executionTime Maximum execution time

AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsQuantiles

FieldDescription
executionTimeMsP25 Execution time performance of 25th percentile in milliseconds
executionTimeMsP50 Execution time performance of 50th percentile in milliseconds
executionTimeMsP75 Execution time performance of 75th percentile in milliseconds
executionTimeMsP90 Execution time performance of 90th percentile in milliseconds
executionTimeMsP95 Execution time performance of 95th percentile in milliseconds
executionTimeMsP98 Execution time performance of 98th percentile in milliseconds
executionTimeMsP99 Execution time performance of 99th percentile in milliseconds

AccountGatewayResolverQueriesAdaptiveGroups

BETA - Aggregate counts of Gateway Resolver queries with adaptive sampling

FieldDescription
count The number of Gateway Resolver queries
dimensions List of dimensions to group by

AccountGatewayResolverQueriesAdaptiveGroupsDimensions

FieldDescription
authoritativeNameserverIps List of IPs of the authoritative nameservers that provided the answers, if any
categoryIds Json array of categories for this query
categoryNames List of matching categories names for this query
cnames List of resolved intermediate cname domains
datetime The date and time the DNS query was resolved
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to minutes
dohSubdomain The destination DoH subdomain the DNS query was made to
dotSubdomain The destination DoT subdomain the DNS query was made to
edeErrors List of returned Extended DNS Error Codes
locationId The uuid identifying the customer Location used when resolving
locationName The name identifying the customer Location used when resolving
matchedApplicationId ID of the application the domain belongs to
matchedApplicationName Name of the application the domain belongs to
matchedIndicatorFeedIds Json array of indicator feed IDs for this query that matched rule
matchedIndicatorFeedNames List of indicator feed names for this query
policyId ID of the policy/rule that was applied, if any
policyName Name of the policy that was applied, if any
queryName Name of the query, e.g. one.dash.cloudflare.com
queryNameReversed Name of the query in reverse order, e.g. com.cloudflare.dash.one
resolvedIpContinents Continent code of each resolved IP, if any
resolvedIpCountries Country code of each resolved IP, if any
resolvedIps List of resolved IPs in the response, if any
resolverDecision Enum identifier for the decision made by gateway-resolver, one of: (0, unknown) (1, allowedByQueryName) (2, blockedByQueryName) (3, blockedByCategory) (4, allowedOnNoLocation) (5, allowedOnNoPolicyMatch) (6, blockedAlwaysCategory) (7, overrideForSafeSearch) (8, overrideApplied) (9, blockedRule) (10, allowedRule)
resourceRecordClasses Resource records' classes
resourceRecordNames Resource records' names
resourceRecordRDatas Resource records' rdata values
resourceRecordTTLs Resource records' TTL values
resourceRecordTypes Resource records' types
scheduleInfo Json object of schedule releated information
srcIpContinent Continent code of the source IP address making the DNS query
srcIpCountry Country code of the source IP address making the DNS query

AccountHttpRequests1dGroups

Daily rollups of request data

FieldDescription
avg The average value for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension
uniq The number of unique values for a metric per dimension

AccountHttpRequests1dGroupsAvg

FieldDescription
bytes
sampleInterval Average sample interval

AccountHttpRequests1dGroupsBrowserMapElem

FieldDescription
pageViews Successful requests for HTML content
uaBrowserFamily Browser type

AccountHttpRequests1dGroupsClientHTTPVersionMapElem

FieldDescription
clientHTTPProtocol HTTP version
requests

AccountHttpRequests1dGroupsClientSSLMapElem

FieldDescription
clientSSLProtocol Protocol version
requests

AccountHttpRequests1dGroupsContentTypeMapElem

FieldDescription
bytes Bytes returned to client
edgeResponseContentTypeName Content type returned to client
requests

AccountHttpRequests1dGroupsCountryMapElem

FieldDescription
bytes Bytes returned to client
clientCountryName Country from which request originated
requests
threats Requests classified as threats

AccountHttpRequests1dGroupsDimensions

FieldDescription
date Request date

AccountHttpRequests1dGroupsIpClassMapElem

FieldDescription
ipType IP class
requests

AccountHttpRequests1dGroupsResponseStatusMapElem

FieldDescription
edgeResponseStatus HTTP response status code returned to client
requests

AccountHttpRequests1dGroupsSum

FieldDescription
browserMap
bytes Bytes returned to client
cachedBytes Bytes returned to client from cache
cachedRequests Requests served from cache
clientHTTPVersionMap
clientSSLMap
contentTypeMap
countryMap
encryptedBytes Bytes returned to client using SSL/TLS protocol
encryptedRequests Requests served using SSL/TLS protocol
ipClassMap
pageViews Successful requests for HTML content
requests
responseStatusMap
threatPathingMap
threats Requests classified as threats

AccountHttpRequests1dGroupsThreatPathingMapElem

FieldDescription
requests
threatPathingName Threat type

AccountHttpRequests1dGroupsUniq

FieldDescription
uniques A number of unique IPs

AccountHttpRequests1hGroups

Hourly rollups of request data

FieldDescription
avg The average value for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension
uniq The number of unique values for a metric per dimension

AccountHttpRequests1hGroupsAvg

FieldDescription
bytes
sampleInterval Average sample interval

AccountHttpRequests1hGroupsBrowserMapElem

FieldDescription
pageViews Successful requests for HTML content
uaBrowserFamily Browser type

AccountHttpRequests1hGroupsClientHTTPVersionMapElem

FieldDescription
clientHTTPProtocol HTTP version
requests

AccountHttpRequests1hGroupsClientSSLMapElem

FieldDescription
clientSSLProtocol Protocol version
requests

AccountHttpRequests1hGroupsContentTypeMapElem

FieldDescription
bytes Bytes returned to client
edgeResponseContentTypeName Content type returned to client
requests

AccountHttpRequests1hGroupsCountryMapElem

FieldDescription
bytes Bytes returned to client
clientCountryName Country from which request originated
requests
threats Requests classified as threats

AccountHttpRequests1hGroupsDimensions

FieldDescription
date Request date
datetime Request datetime truncated to the hour

AccountHttpRequests1hGroupsIpClassMapElem

FieldDescription
ipType IP class
requests

AccountHttpRequests1hGroupsResponseStatusMapElem

FieldDescription
edgeResponseStatus HTTP response status code returned to client
requests

AccountHttpRequests1hGroupsSum

FieldDescription
browserMap
bytes Bytes returned to client
cachedBytes Bytes returned to client from cache
cachedRequests Requests served from cache
clientHTTPVersionMap
clientSSLMap
contentTypeMap
countryMap
encryptedBytes Bytes returned to client using SSL/TLS protocol
encryptedRequests Requests served using SSL/TLS protocol
ipClassMap
pageViews Successful requests for HTML content
requests
responseStatusMap
threatPathingMap
threats Requests classified as threats

AccountHttpRequests1hGroupsThreatPathingMapElem

FieldDescription
requests
threatPathingName Threat type

AccountHttpRequests1hGroupsUniq

FieldDescription
uniques A number of unique IPs

AccountHttpRequests1mGroups

Minutely rollups of request data

FieldDescription
avg The average value for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension
uniq The number of unique values for a metric per dimension

AccountHttpRequests1mGroupsAvg

FieldDescription
bytes
sampleInterval Average sample interval

AccountHttpRequests1mGroupsBrowserMapElem

FieldDescription
pageViews Successful requests for HTML content
uaBrowserFamily Browser type

AccountHttpRequests1mGroupsClientHTTPVersionMapElem

FieldDescription
clientHTTPProtocol HTTP version
requests

AccountHttpRequests1mGroupsClientSSLMapElem

FieldDescription
clientSSLProtocol Protocol version
requests

AccountHttpRequests1mGroupsContentTypeMapElem

FieldDescription
bytes Bytes returned to client
edgeResponseContentTypeName Content type returned to client
requests

AccountHttpRequests1mGroupsCountryMapElem

FieldDescription
bytes Bytes returned to client
clientCountryName Country from which request originated
requests
threats Requests classified as threats

AccountHttpRequests1mGroupsDimensions

FieldDescription
date Request date
datetime Request datetime, truncated to the minute
datetimeDay Request datetime truncated to the day
datetimeFifteenMinutes Request datetime truncated to multiple of 15 minutes
datetimeFiveMinutes Request datetime truncated to multiple of 5 minutes
datetimeHalfOfHour Request datetime truncated to multiple of 30 minutes
datetimeHour Request datetime truncated to the hour
datetimeMinute DEPRECATED (Field is replaced with datetime): Request datetime truncated to the minute

AccountHttpRequests1mGroupsIpClassMapElem

FieldDescription
ipType IP class
requests

AccountHttpRequests1mGroupsResponseStatusMapElem

FieldDescription
edgeResponseStatus HTTP response status code returned to client
requests

AccountHttpRequests1mGroupsSum

FieldDescription
browserMap
bytes Bytes returned to client
cachedBytes Bytes returned to client from cache
cachedRequests Requests served from cache
clientHTTPVersionMap
clientSSLMap
contentTypeMap
countryMap
encryptedBytes Bytes returned to client using SSL/TLS protocol
encryptedRequests Requests served using SSL/TLS protocol
ipClassMap
pageViews Successful requests for HTML content
requests
responseStatusMap
threatPathingMap
threats Requests classified as threats

AccountHttpRequests1mGroupsThreatPathingMapElem

FieldDescription
requests
threatPathingName Threat type

AccountHttpRequests1mGroupsUniq

FieldDescription
uniques A number of unique IPs

AccountHttpRequestsAdaptive

Raw HTTP requests with adaptive sampling

FieldDescription
apiGatewayMatchedEndpoint API Gateway endpoint matched at the edge
apiGatewayMatchedHost API Gateway host matched at the edge
botDetectionIds Array of detections ids that matched this request
botDetectionTags Array of detections tags that matched this request
botManagementDecision Judgement of the bot management system
botScore The final score originated from bot management detections.
botScoreBucketBy10 Range of the bot management score
botScoreSrcName Name of the source detection which generated the bot management score.
cacheReserveUsed Used Cache Reserve to serve the response
cacheStatus Cache status
clientASNDescription The ASN of the visitor as string
clientAsn The ASN number of the visitor
clientCountryName Country from which request originated
clientDeviceType
clientIP The visitor's IP address (IPv4 or IPv6)
clientRefererHost The referrer host
clientRequestHTTPHost The HTTP hostname requested by the visitor
clientRequestHTTPMethodName HTTP method of client request
clientRequestHTTPProtocol The version of HTTP protocol requested by the visitor
clientRequestPath The path requested by visitor
clientRequestQuery Query parameters of client request
clientRequestReferer HTTP request referrer
clientRequestScheme The url scheme requested by the visitor
clientSSLProtocol SSL protocol version
coloCode
contentScanHasFailed 1 if not all contents for this request where successfully scanned, else 0
contentScanNumMaliciousObj Number of scannable content objects that are malicious
contentScanNumObj Number of scannable content objects
contentScanObjResults Array of scan results in order of detection
contentScanObjSizes Array of scan sizes in order of detection
contentScanObjTypes Array of content types in order of detection
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute
edgeDnsResponseTimeMs The time elapsed resolving a CNAME if it was required to reach your origin
edgeResponseContentTypeName
edgeResponseStatus HTTP response status code returned to browser
edgeTimeToFirstByteMs The time elapsed between processing the first byte of the request until when we started sending a response
httpApplicationVersion DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application
isCrossZoneSubrequest '1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise.
ja3Hash MD5 hash of the JA3 TLS fingerprint
ja4 JA4 TLS fingerprint
ja4Signals Inter-request statistics computed for this JA4 across Cloudflare's entire global edge network
leakedCredentialCheckResult The distinct result of checking for leaked credentials
originASN
originASNDescription ASN associated with origin
originIP
originResponseDurationMs
originResponseStatus HTTP origin response status code returned to browser
rayName The RayId of the request
requestSource
securityAction The code of the first-class action the Cloudflare Firewall took on this request
securitySource The Cloudflare security product triggered by this request
upperTierColoName
userAgent visitor's user-agent string
userAgentBrowser Browser parsed from the user agent
userAgentOS OS parsed from the user agent
wafAttackScore Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass Beta. Overall request score class generated by the WAF detection module
wafRceAttackScore Beta. WAF score for a RCE attack
wafSqliAttackScore Beta. WAF score for a SQLi attack
wafXssAttackScore Beta. WAF score for a XSS attack
xRequestedWith The X-Requested-With header of the client request
zoneTag Associated zone
zoneVersion The version of a zone

AccountHttpRequestsAdaptiveGroups

Aggregated HTTP requests data with adaptive sampling

FieldDescription
avg The average value used for sample interval
confidence ALPHA - DO NOT USE
count The number of values for a metric per dimension
dimensions List of dimensions to group by
quantiles Quantiles of a metric per dimension
ratio The ratio of a range of status codes, between 0 and 1
sum The sum of values for a metric per dimension

AccountHttpRequestsAdaptiveGroupsAvg

FieldDescription
crossZoneSubrequests The proportion of requests that were inititiated by a Cloudflare Worker on another zone
edgeDnsResponseTimeMs
edgeTimeToFirstByteMs
originResponseDurationMs The average originResponseDuration, in milliseconds, excluding 0 values (i.e. cached ones)
sampleInterval

AccountHttpRequestsAdaptiveGroupsConfidence

FieldDescription
count The number of values for a metric per dimension, with confidence intervals
level Confidence level that was requested
sum The sum of values for a metric per dimension, with confidence intervals

AccountHttpRequestsAdaptiveGroupsDimensions

FieldDescription
apiGatewayMatchedEndpoint API Gateway endpoint matched at the edge
apiGatewayMatchedHost API Gateway host matched at the edge
botDetectionIds Array of detections ids that matched this request
botDetectionTags Array of detections tags that matched this request
botManagementDecision Judgement of the bot management system
botScore The final score originated from bot management detections.
botScoreBucketBy10 Range of the bot management score
botScoreSrcName Name of the source detection which generated the bot management score.
cacheReserveUsed Used Cache Reserve to serve the response
cacheStatus
clientASNDescription The ASN of the visitor as string
clientAsn
clientCountryName Country from which request originated
clientDeviceType
clientIP
clientRefererHost The referrer host
clientRequestHTTPHost Host requested by the client
clientRequestHTTPMethodName HTTP method of client request
clientRequestHTTPProtocol HTTP protocol version
clientRequestPath Path of client request
clientRequestQuery Query parameters of client request
clientRequestReferer HTTP request referrer
clientRequestScheme HTTP request URI scheme (http/https)
clientSSLProtocol SSL protocol version
coloCode
contentScanHasFailed 1 if not all contents for this request where successfully scanned, else 0
contentScanNumMaliciousObj Number of scannable content objects that are malicious
contentScanNumObj Number of scannable content objects
contentScanObjResults Array of scan results in order of detection
contentScanObjSizes Array of scan sizes in order of detection
contentScanObjTypes Array of content types in order of detection
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute
edgeDnsResponseTimeMs The time elapsed resolving a CNAME if it was required to reach your origin
edgeResponseContentTypeName
edgeResponseStatus
edgeTimeToFirstByteMs The time elapsed between processing the first byte of the request until when we started sending a response
httpApplicationVersion DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application
isCrossZoneSubrequest '1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise.
ja3Hash MD5 hash of the JA3 TLS fingerprint
ja4 JA4 TLS fingerprint
leakedCredentialCheckResult The distinct result of checking for leaked credentials
originASN
originASNDescription ASN associated with origin
originIP
originResponseDurationMs
originResponseStatus HTTP response status code returned by the origin
requestSource
sampleInterval ABR sample interval
securityAction The code of the first-class action the Cloudflare Firewall took on this request
securitySource The Cloudflare security product triggered by this request
upperTierColoName
userAgent
userAgentBrowser Browser parsed from the user agent
userAgentOS OS parsed from the user agent
wafAttackScore Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass Beta. Overall request score class generated by the WAF detection module
wafRceAttackScore Beta. WAF score for a RCE attack
wafSqliAttackScore Beta. WAF score for a SQLi attack
wafXssAttackScore Beta. WAF score for a XSS attack
xRequestedWith The X-Requested-With header of the client request
zoneTag Associated zone
zoneVersion The version of a zone

AccountHttpRequestsAdaptiveGroupsQuantiles

FieldDescription
edgeDnsResponseTimeMsP50 50th percentile DNS Response Time (milliseconds)
edgeDnsResponseTimeMsP95 95th percentile DNS Response Time (milliseconds)
edgeDnsResponseTimeMsP99 99th percentile DNS Response Time (milliseconds)
edgeTimeToFirstByteMsP50 50th percentile Time To First Byte (milliseconds)
edgeTimeToFirstByteMsP95 95th percentile Time To First Byte (milliseconds)
edgeTimeToFirstByteMsP99 99th percentile Time To First Byte (milliseconds)
originResponseDurationMsP50 50th percentile Origin Response Duration (milliseconds)
originResponseDurationMsP95 95th percentile Origin Response Duration (milliseconds)
originResponseDurationMsP99 99th percentile Origin Response Duration (milliseconds)

AccountHttpRequestsAdaptiveGroupsRatio

FieldDescription
status4xx
status5xx

AccountHttpRequestsAdaptiveGroupsSum

FieldDescription
botDetectionIdArray Array of bot management detection ids
botDetectionIdCountArray Count array of bot management detection ids. Elements in this array correspond to elements in botDetectionIdArray by index.
botDetectionTagArray Array of bot management detection tags
botDetectionTagCountArray Count array of bot management detection tags. Elements in this array correspond to elements in botDetectionTagArray by index.
crossZoneSubrequests The number of requests that were inititiated by a Cloudflare Worker on another zone
edgeDnsResponseTimeMs
edgeResponseBytes
edgeTimeToFirstByteMs
originResponseDurationMs
visits The number of requests by end-users that were initiated from a different website (i.e. where the request HTTP Referer header does not match the host in the HTTP Host header)

AccountHttpRequestsAdaptiveGroupsSumConfidence

FieldDescription
edgeResponseBytes Confidence interval for the corresponding point estimate

AccountHttpRequestsAdaptiveJa4SignalsElem

FieldDescription
signalName Signal name
signalValue Signal value

AccountHttpRequestsOverviewAdaptiveGroups

A high-level summary of HTTP requests made by end users.

FieldDescription
avg The average value for a metric per dimension
dimensions List of dimensions to group by
ratio The ratio of a metric in comparison to the rest of the traffic, between 0 and 1
sum The sum of values for a metric per dimension

AccountHttpRequestsOverviewAdaptiveGroupsAvg

FieldDescription
originResponseDurationMs The average originResponseDuration, in milliseconds, excluding 0 values (i.e. cached ones)
sampleInterval Average sample interval

AccountHttpRequestsOverviewAdaptiveGroupsDimensions

FieldDescription
clientCountryName Country from which request originated
clientRequestHTTPProtocol HTTP protocol version
clientSSLProtocol SSL protocol version
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute
edgeResponseContentTypeName Content type returned to client
edgeResponseStatus HTTP response status code returned to client
httpApplicationVersion DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application
userAgentBrowser Browser parsed from the user agent
zoneVersion The version of a zone

AccountHttpRequestsOverviewAdaptiveGroupsRatio

FieldDescription
cachedBytes
cachedRequests
encryptedBytes
encryptedRequests
status4xx
status5xx

AccountHttpRequestsOverviewAdaptiveGroupsSum

FieldDescription
bytes
cachedBytes Bytes returned to client from cache
cachedRequests Requests served from cache
pageViews Successful requests for HTML content
requests
visits The number of requests by end-users that were initiated from a different website (i.e. where the request HTTP Referer header does not match the host in the HTTP Host header)

AccountHyperdriveQueriesAdaptiveGroups

Hyperdrive query events with adaptive sampling.

FieldDescription
avg The average value for a metric per dimension
count Total number of Hyperdrive queries
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountHyperdriveQueriesAdaptiveGroupsAvg

FieldDescription
connectionLatency Average latency (in milliseconds) of retrieving a connection to the origin database
queryBytes Average size (in bytes) of queries handled by Hyperdrive
queryLatency Average latency (in milliseconds) of serving a query using Hyperdrive
resultBytes Average size (in bytes) of query results served by Hyperdrive
sampleInterval The average value used for sample interval

AccountHyperdriveQueriesAdaptiveGroupsDimensions

FieldDescription
cacheStatus The cache status of the Hyperdrive query event
configId The ID of the Hyperdrive Config
date Hyperdrive query event timestamp, truncated to start of a day
datetime Hyperdrive query event timestamp
datetimeHour Hyperdrive query event timestamp, truncated to start of hour
datetimeMinute Hyperdrive query event timestamp, truncated to start of minute
eventStatus The result of the Hyperdrive event: 'error' or 'complete'. Error events may not have complete data.

AccountHyperdriveQueriesAdaptiveGroupsSum

FieldDescription
clientWriteLatency Total latency (in milliseconds) of sending query results back to client
connectionLatency Total latency (in milliseconds) of retrieving a connection to the origin database
originReadLatency Total latency (in milliseconds) of receiving responses from origin to Hyperdrive
originWriteLatency Total latency (in milliseconds) of sending queries to origin from Hyperdrive
queryBytes Total size (in bytes) of queries handled by Hyperdrive
queryLatency Total latency (in milliseconds) of serving a query using Hyperdrive
resultBytes Total size (in bytes) of query results served by Hyperdrive

AccountImagesRequestsAdaptiveGroups

A high-level summary of Cloudflare Images served to end users.

FieldDescription
avg The average value for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountImagesRequestsAdaptiveGroupsAvg

FieldDescription
sampleInterval

AccountImagesRequestsAdaptiveGroupsDimensions

FieldDescription
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute

AccountImagesRequestsAdaptiveGroupsSum

FieldDescription
requests

AccountImagesUniqueTransformations

Image unique transfromations per day

FieldDescription
date The date uniques are calculated for
transformations Number of unique image transformations per day in sliding window

AccountKvOperationsAdaptiveGroups

KV operations data with adaptive sampling

FieldDescription
avg The average value for a metric per dimension
count Number of requests
dimensions List of dimensions to group by
max The max of values for a metric per dimension
min The min of values for a metric per dimension
quantiles Quantiles of a metric per dimension
sum The sum of values for a metric per dimension

AccountKvOperationsAdaptiveGroupsAvg

FieldDescription
sampleInterval The average value used for sample interval

AccountKvOperationsAdaptiveGroupsDimensions

FieldDescription
actionType The type of the action (read, write, delete, list)
date Message operation timestamp, truncated to start of a day
datetime Message operation timestamp
datetimeHour Message operation timestamp, truncated to start of an hour
datetimeMinute Message operation timestamp, truncated to start of an minute
namespaceId The hexa-encoded namespace id
responseStatusCode The http status code of the response.
result The result of the action (hot_read, cold_read, deleted, uploaded, error, not_found)

AccountKvOperationsAdaptiveGroupsMax

FieldDescription
latencyMs Max latency
objectBytes Max object bytes

AccountKvOperationsAdaptiveGroupsMin

FieldDescription
latencyMs Min latency
objectBytes Min object bytes

AccountKvOperationsAdaptiveGroupsQuantiles

FieldDescription
latencyMsP25 25th percentile latency (milliseconds)
latencyMsP50 50th percentile latency (milliseconds)
latencyMsP75 75th percentile latency (milliseconds)
latencyMsP90 90th percentile latency (milliseconds)
latencyMsP99 99th percentile latency (milliseconds)
latencyMsP999 99.9th percentile latency (milliseconds)

AccountKvOperationsAdaptiveGroupsSum

FieldDescription
objectBytes Total bytes of all objects
requests Total number of requests

AccountKvStorageAdaptiveGroups

KV stored data with adaptive sampling

FieldDescription
dimensions List of dimensions to group by
max The max of values for a metric per dimension

AccountKvStorageAdaptiveGroupsDimensions

FieldDescription
date Message operation timestamp, truncated to start of a day
datetime Message operation timestamp
datetimeHour Message operation timestamp, truncated to start of an hour
datetimeMinute Message operation timestamp, truncated to start of an minute
namespaceId The hexa-encoded namespace id

AccountKvStorageAdaptiveGroupsMax

FieldDescription
byteCount Max number of bytes
keyCount Max number of keys

AccountLogpushHealthAdaptiveGroups

Beta. Logpush job health metrics

FieldDescription
avg
count The number of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountLogpushHealthAdaptiveGroupsAvg

FieldDescription
sampleInterval Average sample interval

AccountLogpushHealthAdaptiveGroupsDimensions

FieldDescription
date Date that we completed pushing the log batch
datetime Datetime that we completed pushing the log batch
datetimeFifteenMinutes Datetime that we completed pushing the log batch, truncated to multiple of 15 minutes
datetimeFiveMinutes Datetime that we completed pushing the log batch, truncated to multiple of 5 minutes
datetimeHour Datetime that we completed pushing the log batch, truncated to the hour
datetimeMinute Datetime that we completed pushing the log batch, truncated to the minute
destinationType Destination type, e.g. 'S3' or 'GCS'
final Cloudflare may attempt to push a batch of logs multiple times if we encounter a failure. This field will be set to 'true' if this was the last push attempt for this batch of logs. If this field is set to false, it means the push failed but another retry was attempted. If this field is set to true and status >= 300, then the batch of logs failed to push and log data was lost. If you want to count the total number of logs that succeeded or failed, you should always set final = true.
jobId The Logpush Job ID
status HTTP response status code of the log destination

AccountLogpushHealthAdaptiveGroupsSum

FieldDescription
bytes Bytes of uncompressed log data pushed
bytesCompressed Bytes of compressed log data pushed
records A count of the total number of records pushed.

AccountMagicFirewallNetworkAnalyticsAdaptiveGroups

Network analytics data for Magic Firewall

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountMagicFirewallNetworkAnalyticsAdaptiveGroupsAvg

FieldDescription
bitRate Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountMagicFirewallNetworkAnalyticsAdaptiveGroupsDimensions

FieldDescription
applicationTag Application tag associated with the packet
coloCity City where the Cloudflare datacenter that received the packet is located
coloCode Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName Cloudflare datacenter that received the packet (unique site identifier)
date Date that the packet was received
datetime Date and time that the packet was received
datetimeFifteenMinutes Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName Name of ASN associated with the destination IP of the packet, if available
destinationCountry Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationDeviceTag Device tag associated with the destination IP of the packet
destinationGeohash Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort Value of the Destination Port header field in the TCP or UDP packet
direction Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
ethertype Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum Value of the Checkusm header field in the GRE packet
greEthertype Value of the Ethertype header field in the GRE packet
greHeaderLength Length of the GRE packet header, in bytes
greKey Value of the Key header field in the GRE packet
greSequenceNumber Value of the Sequence Number header field in the GRE packet
greVersion Value of the Version header field in the GRE packet
icmpChecksum Value of the Checkusm header field in the ICMP packet
icmpCode Value of the Code header field in the ICMP packet
icmpType Value of the Type header field in the ICMP packet
ipDestinationAddress Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum Value of the Checksum header field in the IPv4 packet
ipv4DontFragment Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification Value of the Identification header field in the IPv4 packet
ipv4Options List of Options numbers included in the IPv4 packet header
ipv6Dscp Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel Value of the Flow Label header field in the IPv6 packet
ipv6Identification Value of the Identification extension header field in the IPv6 packet
leaseTag IP lease tag associated with the packet
outcome The action that was taken on the packet (possible values: pass, drop)
prefixTag IP prefix tag associated with the packet
ruleId Unique identifier of the rule that matched the packet, if any
rulesetId Unique identifier of the ruleset containing the rule that matched the packet, if any
sampleInterval ABR sample interval
sourceAsn ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName Name of ASN associated with the source IP of the packet, if available
sourceCountry Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceDeviceTag Device tag associated with the source IP of the packet
sourceGeohash Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum Value of the Checkusm header field in the TCP packet
tcpDataOffset Value of the Data Offset header field in the TCP packet
tcpFlags Value of the Flags header field in the TCP packet
tcpFlagsString Human-readable string representation of the Flags header field in the TCP packet
tcpMss Value of the MSS option header field in the TCP packet
tcpOptions List of Options numbers included in the TCP packet header
tcpSackBlocks Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale Value of the Window Scale option header field in the TCP packet
tcpWindowSize Value of the Window Size header field in the TCP packet
udpChecksum Value of the Checkusm header field in the UDP packet
udpPayloadLength Value of the Payload Length header field in the UDP packet
verdict The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop)

AccountMagicFirewallNetworkAnalyticsAdaptiveGroupsSum

FieldDescription
bits Sum of bits received
packets Sum of packets received

AccountMagicFirewallRateLimitNetworkAnalyticsAdaptiveGroups

Network analytics data for Magic Firewall Ratelimiting

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountMagicFirewallRateLimitNetworkAnalyticsAdaptiveGroupsAvg

FieldDescription
bitRate Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountMagicFirewallRateLimitNetworkAnalyticsAdaptiveGroupsDimensions

FieldDescription
applicationTag Application tag associated with the packet
coloCity City where the Cloudflare datacenter that received the packet is located
coloCode Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName Cloudflare datacenter that received the packet (unique site identifier)
date Date that the packet was received
datetime Date and time that the packet was received
datetimeFifteenMinutes Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName Name of ASN associated with the destination IP of the packet, if available
destinationCountry Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationDeviceTag Device tag associated with the destination IP of the packet
destinationGeohash Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort Value of the Destination Port header field in the TCP or UDP packet
direction Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
ethertype Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum Value of the Checkusm header field in the GRE packet
greEthertype Value of the Ethertype header field in the GRE packet
greHeaderLength Length of the GRE packet header, in bytes
greKey Value of the Key header field in the GRE packet
greSequenceNumber Value of the Sequence Number header field in the GRE packet
greVersion Value of the Version header field in the GRE packet
icmpChecksum Value of the Checkusm header field in the ICMP packet
icmpCode Value of the Code header field in the ICMP packet
icmpType Value of the Type header field in the ICMP packet
ipDestinationAddress Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum Value of the Checksum header field in the IPv4 packet
ipv4DontFragment Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification Value of the Identification header field in the IPv4 packet
ipv4Options List of Options numbers included in the IPv4 packet header
ipv6Dscp Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel Value of the Flow Label header field in the IPv6 packet
ipv6Identification Value of the Identification extension header field in the IPv6 packet
leaseTag IP lease tag associated with the packet
outcome The action that was taken on the packet (possible values: pass, drop)
prefixTag IP prefix tag associated with the packet
ruleId Unique identifier of the rule that matched the packet, if any
rulesetId Unique identifier of the ruleset containing the rule that matched the packet, if any
sampleInterval ABR sample interval
sourceAsn ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName Name of ASN associated with the source IP of the packet, if available
sourceCountry Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceDeviceTag Device tag associated with the source IP of the packet
sourceGeohash Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum Value of the Checkusm header field in the TCP packet
tcpDataOffset Value of the Data Offset header field in the TCP packet
tcpFlags Value of the Flags header field in the TCP packet
tcpFlagsString Human-readable string representation of the Flags header field in the TCP packet
tcpMss Value of the MSS option header field in the TCP packet
tcpOptions List of Options numbers included in the TCP packet header
tcpSackBlocks Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale Value of the Window Scale option header field in the TCP packet
tcpWindowSize Value of the Window Size header field in the TCP packet
udpChecksum Value of the Checkusm header field in the UDP packet
udpPayloadLength Value of the Payload Length header field in the UDP packet
verdict The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop)

AccountMagicFirewallRateLimitNetworkAnalyticsAdaptiveGroupsSum

FieldDescription
bits Sum of bits received
packets Sum of packets received

AccountMagicFirewallSamplesAdaptiveGroups

Data to visualize traffic allowed and blocked by Magic Firewall rules

FieldDescription
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountMagicFirewallSamplesAdaptiveGroupsDimensions

FieldDescription
datetime Date and time that the packet was received
datetimeFiveMinute Date and time that the packet was received, rounded to the start of the nearest five minutes
ruleId Unique identifier of the rule that matched the packet, if any

AccountMagicFirewallSamplesAdaptiveGroupsSum

FieldDescription
bits Sum of bits received
packets Sum of packets received

AccountMagicIDPSNetworkAnalyticsAdaptiveGroups

Network analytics data for Magic IDS

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountMagicIDPSNetworkAnalyticsAdaptiveGroupsAvg

FieldDescription
bitRate Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountMagicIDPSNetworkAnalyticsAdaptiveGroupsDimensions

FieldDescription
coloCity City where the Cloudflare datacenter that received the packet is located
coloCode Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName Cloudflare datacenter that received the packet (unique site identifier)
date Date that the packet was received
datetime Date and time that the packet was received
datetimeFifteenMinutes Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName Name of ASN associated with the destination IP of the packet, if available
destinationCountry Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationDeviceTag Device tag associated with the destination IP of the packet
destinationGeohash Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort Value of the Destination Port header field in the TCP or UDP packet
direction Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
ethertype Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum Value of the Checkusm header field in the GRE packet
greEthertype Value of the Ethertype header field in the GRE packet
greHeaderLength Length of the GRE packet header, in bytes
greKey Value of the Key header field in the GRE packet
greSequenceNumber Value of the Sequence Number header field in the GRE packet
greVersion Value of the Version header field in the GRE packet
icmpChecksum Value of the Checkusm header field in the ICMP packet
icmpCode Value of the Code header field in the ICMP packet
icmpType Value of the Type header field in the ICMP packet
ipDestinationAddress Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum Value of the Checksum header field in the IPv4 packet
ipv4DontFragment Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification Value of the Identification header field in the IPv4 packet
ipv4Options List of Options numbers included in the IPv4 packet header
ipv6Dscp Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel Value of the Flow Label header field in the IPv6 packet
ipv6Identification Value of the Identification extension header field in the IPv6 packet
outcome The action that was taken on the packet (possible values: pass, drop)
sampleInterval ABR sample interval
sourceAsn ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName Name of ASN associated with the source IP of the packet, if available
sourceCountry Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceDeviceTag Device tag associated with the source IP of the packet
sourceGeohash Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum Value of the Checkusm header field in the TCP packet
tcpDataOffset Value of the Data Offset header field in the TCP packet
tcpFlags Value of the Flags header field in the TCP packet
tcpFlagsString Human-readable string representation of the Flags header field in the TCP packet
tcpMss Value of the MSS option header field in the TCP packet
tcpOptions List of Options numbers included in the TCP packet header
tcpSackBlocks Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale Value of the Window Scale option header field in the TCP packet
tcpWindowSize Value of the Window Size header field in the TCP packet
udpChecksum Value of the Checkusm header field in the UDP packet
udpPayloadLength Value of the Payload Length header field in the UDP packet
verdict The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop)

AccountMagicIDPSNetworkAnalyticsAdaptiveGroupsSum

FieldDescription
bits Sum of bits received
packets Sum of packets received

AccountMagicTransitNetworkAnalyticsAdaptiveGroups

Network analytics data for Magic Transit traffic

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountMagicTransitNetworkAnalyticsAdaptiveGroupsAvg

FieldDescription
bitRate Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountMagicTransitNetworkAnalyticsAdaptiveGroupsDimensions

FieldDescription
applicationTag Application tag associated with the packet
coloCity City where the Cloudflare datacenter that received the packet is located
coloCode Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName Cloudflare datacenter that received the packet (unique site identifier)
date Date that the packet was received
datetime Date and time that the packet was received
datetimeFifteenMinutes Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName Name of ASN associated with the destination IP of the packet, if available
destinationCountry Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationGeohash Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort Value of the Destination Port header field in the TCP or UDP packet
direction Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
egressTunnelID GRE or IPSec Egress Tunnel ID for Magic WAN and Magic Transit traffic
egressTunnelName GRE or IPSec Egress Tunnel name for Magic WAN and Magic Transit traffic
ethertype Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum Value of the Checkusm header field in the GRE packet
greEthertype Value of the Ethertype header field in the GRE packet
greHeaderLength Length of the GRE packet header, in bytes
greKey Value of the Key header field in the GRE packet
greSequenceNumber Value of the Sequence Number header field in the GRE packet
greVersion Value of the Version header field in the GRE packet
icmpChecksum Value of the Checkusm header field in the ICMP packet
icmpCode Value of the Code header field in the ICMP packet
icmpType Value of the Type header field in the ICMP packet
ingressTunnelID GRE or IPSec Ingress Tunnel ID for Magic WAN and Magic Transit traffic
ingressTunnelName GRE or IPSec Ingress Tunnel name for Magic WAN and Magic Transit traffic
ipDestinationAddress Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum Value of the Checksum header field in the IPv4 packet
ipv4DontFragment Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification Value of the Identification header field in the IPv4 packet
ipv4Options List of Options numbers included in the IPv4 packet header
ipv6Dscp Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel Value of the Flow Label header field in the IPv6 packet
ipv6Identification Value of the Identification extension header field in the IPv6 packet
leaseTag IP lease tag associated with the packet
mitigationSystem Which system dropped the packet (possible values: dosd, flowtrackd, magic-firewall)
offRamp Offramp method for Magic WAN and Magic Transit traffic - GRE, IPSec, CNI, Warp, Cloudflared
onRamp Onramp method for Magic WAN and Magic Transit traffic - GRE, IPSec, CNI, Warp, Cloudflared
outcome The action that was taken on the packet (possible values: pass, drop)
prefixTag IP prefix tag associated with the packet
sampleInterval ABR sample interval
sourceAsn ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName Name of ASN associated with the source IP of the packet, if available
sourceCountry Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceGeohash Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum Value of the Checkusm header field in the TCP packet
tcpDataOffset Value of the Data Offset header field in the TCP packet
tcpFlags Value of the Flags header field in the TCP packet
tcpFlagsString Human-readable string representation of the Flags header field in the TCP packet
tcpMss Value of the MSS option header field in the TCP packet
tcpOptions List of Options numbers included in the TCP packet header
tcpSackBlocks Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale Value of the Window Scale option header field in the TCP packet
tcpWindowSize Value of the Window Size header field in the TCP packet
trafficType Custom protocol or traffic type for Magic Wan and Magic Transit traffic - Unidirectional and Bidirectional Tunnel Health Check
udpChecksum Value of the Checkusm header field in the UDP packet
udpPayloadLength Value of the Payload Length header field in the UDP packet

AccountMagicTransitNetworkAnalyticsAdaptiveGroupsSum

FieldDescription
bits Sum of bits received
packets Sum of packets received

AccountMagicTransitTunnelHealthChecksAdaptiveGroups

Beta. Magic Transit Health check results for customer GRE Tunnels with adaptive sampling (ABR).

FieldDescription
avg
count Total number of healthcheck results
dimensions List of dimensions to group by

AccountMagicTransitTunnelHealthChecksAdaptiveGroupsAvg

FieldDescription
sampleInterval Average sample interval per dimension
tunnelState Combined Tunnel State aggregated from multiple results. 0 is down, 0.5 is degraded and 1 is healthy

AccountMagicTransitTunnelHealthChecksAdaptiveGroupsDimensions

FieldDescription
active Returns 1 if the colo had traffic for this tunnel in the last 6 hours, otherwise 0
datetime The time the healthcheck request was sent
datetimeFifteenMinutes The time the healthcheck request was sent, truncated to multiple of 15 minutes
datetimeFiveMinutes The time the healthcheck request was sent, truncated to multiple of 5 minutes
datetimeHalfOfHour The time the healthcheck request was sent, truncated to multiple of 30 minutes
datetimeHour The time the healthcheck request was sent, truncated to the hour
datetimeMinute The time the healthcheck request was sent, truncated to the last minute
edgeColoCity City of the Cloudflare datacenter from where the healthcheck was run
edgeColoCode IATA airport code of the Cloudflare datacenter from where the healthcheck was run
edgeColoCountry Country of the Cloudflare datacenter from where the healthcheck was run
edgeColoName The name of the Cloudflare datacenter from where the healthcheck was run
edgeColoRegion Region of the Cloudflare datacenter from where the healthcheck was run
edgePopName The name of the Cloudflare POP from where the healthcheck was run
remoteTunnelIPv4 IP address of the remote end of the tunnel
resultStatus The status of the request
siteName Human friendly site name associated with the tunnel
tunnelName Human friendly tunnel name

AccountMagicTransitTunnelTrafficAdaptiveGroups

Bandwidth usage metric of a Magic Transit tunnel.

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountMagicTransitTunnelTrafficAdaptiveGroupsAvg

FieldDescription
bitRate Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountMagicTransitTunnelTrafficAdaptiveGroupsDimensions

FieldDescription
date Date that the packet was received
datetime Date and time that the packet was received
datetimeFifteenMinutes Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute Date and time that the packet was received, rounded to the start of the nearest minute
direction Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
edgeColoCity City where the Cloudflare datacenter that received the packet is located
edgeColoCode Cloudflare datacenter that received the packet (nearest IATA airport code)
edgeColoCountry Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
edgeColoGeohash Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
edgeColoName Cloudflare datacenter that received the packet (unique site identifier)
edgePopName Cloudflare PoP that received the packet (unique site identifier)
egressTunnelID GRE, IPSec or CNI Egress Tunnel ID for Magic WAN and Magic Transit traffic
egressTunnelName GRE, IPSec or CNIec Egress Tunnel name for Magic WAN and Magic Transit traffic
ingressTunnelID GRE, IPSec or CNI Ingress Tunnel ID for Magic WAN and Magic Transit traffic
ingressTunnelName GRE, IPSec or CNI Ingress Tunnel name for Magic WAN and Magic Transit traffic
offRamp Offramp method for Magic WAN and Magic Transit traffic - GRE, IPSec, CNI, Warp, Cloudflared
onRamp Onramp method for Magic WAN and Magic Transit traffic - GRE, IPSec, CNI, Warp, Cloudflared
tunnelName Tunnel device name

AccountMagicTransitTunnelTrafficAdaptiveGroupsSum

FieldDescription
bits Sum of bits received
packets Sum of packets received

AccountMagicWANConnectorMetricsAdaptiveGroups

Beta. Magic WAN Connector Metrics

FieldDescription
avg
dimensions List of dimensions to group by
max

AccountMagicWANConnectorMetricsAdaptiveGroupsAvg

FieldDescription
cpuLoadPercentage Average CPU load percentage
cpuTemperature Average CPU temperature
diskUsagePercentage Average Disk usage percentage
memoryUsagePercentage Average Memory usage percentage
rxBitrateFiveMinute Rx Bitrate over 5 minutes
rxBitrateMinute Rx Bitrate over 1 minute
rxPacketrateFiveMinute Rx Packet rate over 5 minutes
rxPacketrateMinute Rx Packet rate over 1 minute
txBitrateFiveMinute Tx Bitrate over 5 minutes
txBitrateMinute Tx Bitrate over 1 minute
txPacketrateFiveMinute Tx Packet rate over 5 minutes
txPacketrateMinute Tx Packet rate over 1 minute

AccountMagicWANConnectorMetricsAdaptiveGroupsDimensions

FieldDescription
datetime The date and time the event was recorded
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeMinute The date and time the event occurred at the edge truncated to the minute
mconnInterfaceName Name of connector interface
mconnInterfaceType Interface type LAN, WAN or IPSEC
mconnSiteID Customer site identifier

AccountMagicWANConnectorMetricsAdaptiveGroupsMax

FieldDescription
haState current connector ha state
interfaceCount Number of interfaces of a given Type

AccountMnmFlowDataAdaptiveGroups

Flow data collected through Magic Network Monitoring

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountMnmFlowDataAdaptiveGroupsAvg

FieldDescription
bitRate Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
egressBitRate Sum of egress bits received, divided by 1 second, providing a per-second egress bit rate when grouped by datetime
egressBitRateDay Sum of egress bits received, divided by 86400 seconds, providing a per-second egress bit rate when grouped by date
egressBitRateFifteenMinutes Sum of egress bits received, divided by 900 seconds, providing a per-second egress bit rate when grouped by datetimeFifteenMinutes
egressBitRateFiveMinutes Sum of egress bits received, divided by 300 seconds, providing a per-second egress bit rate when grouped by datetimeFiveMinutes
egressBitRateHour Sum of egress bits received, divided by 3600 seconds, providing a per-second egress bit rate when grouped by datetimeHour
egressBitRateMinute Sum of egress bits received, divided by 60 seconds, providing a per-second egress bit rate when grouped by datetimeMinute
egressBitRateTenSeconds Sum of egress bits received, divided by 10 seconds, providing a per-second egress bit rate when grouped by datetimeTenSeconds
egressPacketRate Sum of egress packets received, divided by 1 second, providing a per-second egress packet rate when grouped by datetime
egressPacketRateDay Sum of egress packets received, divided by 86400 seconds, providing a per-second egress packet rate when grouped by date
egressPacketRateFifteenMinutes Sum of egress packets received, divided by 900 seconds, providing a per-second egress packet rate when grouped by datetimeFifteenMinutes
egressPacketRateFiveMinutes Sum of egress packets received, divided by 300 seconds, providing a per-second egress packet rate when grouped by datetimeFiveMinutes
egressPacketRateHour Sum of egress packets received, divided by 3600 seconds, providing a per-second egress packet rate when grouped by datetimeHour
egressPacketRateMinute Sum of egress packets received, divided by 60 seconds, providing a per-second egress packet rate when grouped by datetimeMinute
egressPacketRateTenSeconds Sum of egress packets received, divided by 10 seconds, providing a per-second egress packet rate when grouped by datetimeTenSeconds
packetRate Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds
sampleInterval Average sample interval applied to the data

AccountMnmFlowDataAdaptiveGroupsDimensions

FieldDescription
date Date that the packet was received
datetime Date and time that the packet was received
datetimeFifteenMinutes Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAS Autonomous System to which the data is directed. Corresponds to DstAS field in the packet
destinationAddress IP to which the data was sent
destinationPort Value of the Destination Port header field in the packet
deviceID Device ID of the warp client exporting MNM flows
ethertype Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
protocol Layer 4 protocol
protocolString Human-readable string representation of the protocol
routerAddress IP of the router that sampled the flows
ruleIDs List of flow matching rules
sourceAS Autonomous System from which the data was sent. Corresponds to SrcAS field in the packet
sourceAddress IP from which the data was sent
sourcePort Value of the Source Port header field in the packet
tcpFlags Value of the Flags header field in the TCP packet
tcpFlagsString Human-readable string representation of the Flags header field in the TCP packet
version Version of the record schema

AccountMnmFlowDataAdaptiveGroupsSum

FieldDescription
bits Sum of bits
egressBits Sum of egress bits
egressPackets Sum of egress packets
packets Sum of packets

AccountNelReportsAdaptiveGroups

Data to visualize network error logs

FieldDescription
avg
count The number of NEL Reports
dimensions List of dimensions to group by

AccountNelReportsAdaptiveGroupsAvg

FieldDescription
sampleInterval Average sample interval

AccountNelReportsAdaptiveGroupsDimensions

FieldDescription
clientIPASN Client ASN
clientIPASNDescription Client ASN Description
clientIPCountry Client Country
clientIPCountryCode 2 letter client country code using ISO 3166-1 alpha-2 syntax
clientIPVersion IP Version the client used to connect
date Request date from browser
datetime Request datetime from browser
datetimeFifteenMinutes Request datetime from browser, truncated to multiple of 15 minutes
datetimeFiveMinutes Request datetime from browser, truncated to multiple of 5 minutes
datetimeHalfOfHour Request datetime from browser, truncated to multiple of 30 minutes
datetimeHour Request datetime from browser, truncated to the hour
datetimeMinute Request datetime from browser, truncated to the minute
lastKnownGoodColoCode IATA airport code of colo the client connected to
phase The phase of connection the error occurred in
protocol HTTP Protocol used when the error occured
type The type of error in the phase

AccountOhttpMetricsAdaptive

oHTTP request metrics with adaptive sampling

FieldDescription
bytesToClient Bytes returned to client
bytesToGateway Total bytes received from the client
colo The airport code of the Cloudflare datacenter that served this request
datetime The date and time the event was recorded
gatewayStatusCode The status code returned by the gateway
relayStatusCode The status code returned by the relay

AccountOhttpMetricsAdaptiveGroups

Aggregated oHTTP request metrics with adaptive sampling

FieldDescription
count
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountOhttpMetricsAdaptiveGroupsDimensions

FieldDescription
colo The airport code of the Cloudflare datacenter that served this request
date Ohttp requests metrics date
datetimeFifteenMinutes Ohttp requests metrics timestamp, truncated to fifteen minutes
datetimeFiveMinutes Ohttp requests metrics timestamp, truncated to five minutes
datetimeHour Ohttp requests metrics timestamp, truncated to the hour
datetimeMinute Ohttp requests metrics timestamp, truncated to the minute
endpoint The appId that generated traffic
gatewayStatusCode Status code returned by the gateway
relayStatusCode Status code returned by the relay

AccountOhttpMetricsAdaptiveGroupsSum

FieldDescription
bytesToClient The total bytes sent from gateway to client, observed over the queried time period
bytesToGateway The total bytes from client to gateway, observed over the queried time period
clientRequestErrors The total number of client request errors, observed over the queried time period
gatewayResponseErrors The total number of gateway response errors, observed over the queried time period

AccountPagesFunctionsInvocationsAdaptiveGroups

Pages Functions invocations with adaptive sampling

FieldDescription
avg
dimensions List of dimensions to group by
quantiles Quantiles of a metric per dimension
sum The sum of values for a metric per dimension

AccountPagesFunctionsInvocationsAdaptiveGroupsAvg

FieldDescription
sampleInterval Average sample interval

AccountPagesFunctionsInvocationsAdaptiveGroupsDimensions

FieldDescription
date Request datetime, truncated to start of a day
datetime Request datetime
datetimeHour Request datetime, truncated to start of an hour
datetimeMinute Request datetime, truncated to start of an minute
scriptName The name of the script
status Status of the worker invocation
usageModel Usage model of the worker invocation

AccountPagesFunctionsInvocationsAdaptiveGroupsQuantiles

FieldDescription
cpuTimeP50 CPU time 50th percentile - microseconds
cpuTimeP75 CPU time 75th percentile - microseconds
cpuTimeP99 CPU time 99th percentile - microseconds
cpuTimeP999 CPU time 99.9th percentile - microseconds
durationP50 Duration 50th percentile - GB*s
durationP75 Duration 75th percentile - GB*s
durationP99 Duration 99th percentile - GB*s
durationP999 Duration 99.9th percentile - GB*s

AccountPagesFunctionsInvocationsAdaptiveGroupsSum

FieldDescription
clientDisconnects Sum of client disconnects
duration Sum of Duration - GB*s
errors Sum of Errors
requests Sum of Requests
responseBodySize Sum of Response Body Sizes
subrequests Sum of Subrequests
wallTime Sum of Wall Time

AccountQueueBacklogAdaptiveGroups

Beta. Queue backlog data with adaptive sampling. Queues that are not being written to, or read from, will not return data, even if they have a backlog.

FieldDescription
avg The average value for a metric per dimension
dimensions List of dimensions to group by

AccountQueueBacklogAdaptiveGroupsAvg

FieldDescription
bytes The average size of the backlog in bytes for sample interval
messages The average number of messages in the backlog for sample interval
sampleInterval The average value used for sample interval

AccountQueueBacklogAdaptiveGroupsDimensions

FieldDescription
date Message operation timestamp, truncated to start of a day
datetime Message operation timestamp
datetimeHour Message operation timestamp, truncated to start of an hour
datetimeMinute Message operation timestamp, truncated to start of an minute
queueId The ID of the Queue

AccountQueueConsumerMetricsAdaptiveGroups

Beta. Queue consumer metrics with adaptive sampling. Inactive queues will not return data.

FieldDescription
avg The average value for a metric per dimension
dimensions List of dimensions to group by

AccountQueueConsumerMetricsAdaptiveGroupsAvg

FieldDescription
concurrency The average concurrency of the queue
sampleInterval The average value used for sample interval

AccountQueueConsumerMetricsAdaptiveGroupsDimensions

FieldDescription
date Consumer metric timestamp, truncated to start of a day
datetime Consumer metric timestamp
datetimeHour Consumer metric timestamp, truncated to start of an hour
datetimeMinute Consumer metric timestamp, truncated to start of an minute
queueId The ID of the Queue

AccountQueueDelayedBacklogAdaptiveGroups

Beta. Queue delayed backlog data with adaptive sampling. Queues that are not being written to, or read from, will not return data, even if they have a backlog.

FieldDescription
avg The average value for a metric per dimension
dimensions List of dimensions to group by

AccountQueueDelayedBacklogAdaptiveGroupsAvg

FieldDescription
messages The average number of messages in the delayed backlog for sample interval
sampleInterval The average value used for sample interval

AccountQueueDelayedBacklogAdaptiveGroupsDimensions

FieldDescription
date Message operation timestamp, truncated to start of a day
datetime Message operation timestamp
datetimeHour Message operation timestamp, truncated to start of an hour
datetimeMinute Message operation timestamp, truncated to start of an minute
queueId The ID of the Queue

AccountQueueMessageOperationsAdaptiveGroups

Beta. Queue message operation data with adaptive sampling

FieldDescription
avg The average value for a metric per dimension
count Number of Message Operations
dimensions List of dimensions to group by
max The max of values for a metric per dimension
sum The sum of values for a metric per dimension

AccountQueueMessageOperationsAdaptiveGroupsAvg

FieldDescription
lagTime The average time in milliseconds between when the message was written to the queue and the current operation over the sample interval. Will always be 0 for WriteMessage operations.
retryCount The average number of retries per message operation. A retry occurs after an unsucessful delivery, if the queue is configured to retry failed attempts. Only applicable to ReadMessage and DeleteMessage operations. Will always be 0 for WriteMessage operations.
sampleInterval The average value used for sample interval

AccountQueueMessageOperationsAdaptiveGroupsDimensions

FieldDescription
actionType The type of the Queue message operation
consumerType The queue consumer type for the operation. Only applicable for ReadMessage and DeleteMessge action types.
date Message operation timestamp, truncated to start of a day
datetime Message operation timestamp
datetimeHour Message operation timestamp, truncated to start of an hour
datetimeMinute Message operation timestamp, truncated to start of an minute
outcome The outcome of the operation. Only applicable to DeleteMessage action types. Can be 'success', 'dlq', or 'fail'. Always 'none' for other operations.
queueId The ID of the Queue

AccountQueueMessageOperationsAdaptiveGroupsMax

FieldDescription
messageSize Max Message Size

AccountQueueMessageOperationsAdaptiveGroupsSum

FieldDescription
billableOperations Number of Billable Operations (some message operations count as multiple billable operations)
bytes Total size (in bytes) of message operations

AccountR2OperationsAdaptiveGroups

Beta. R2 operations with adaptive sampling

FieldDescription
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountR2OperationsAdaptiveGroupsDimensions

FieldDescription
actionStatus Status of the R2 operation
actionType The name of the R2 operation
bucketName The name of the R2 bucket, if applicable to this request
date Request timestamp, truncated to start of a day
datetime Request timestamp
datetimeHour Request timestamp, truncated to start of an hour
datetimeMinute Request timestamp, truncated to start of an minute
objectName The name of the R2 object, if applicable to this request
responseStatusCode HTTP status code returned by R2
storageClass The storage class that applies to this request

AccountR2OperationsAdaptiveGroupsSum

FieldDescription
requests Sum of Requests
responseBytes Sum of retrieved bytes
responseObjectSize Sum of Response Object Sizes

AccountR2StorageAdaptiveGroups

Beta. R2 storage with adaptive sampling

FieldDescription
dimensions List of dimensions to group by
max The max of values for a metric per dimension

AccountR2StorageAdaptiveGroupsDimensions

FieldDescription
bucketName The name of the R2 bucket, if applicable to this request
date Storage sample timestamp, truncated to start of a day
datetime Storage sample timestamp
datetimeHour Storage sample timestamp, truncated to start of an hour
datetimeMinute Storage sample timestamp, truncated to start of an minute
storageClass The storage class that applies to this request

AccountR2StorageAdaptiveGroupsMax

FieldDescription
metadataSize Max of metadata size
objectCount Max of object count
payloadSize Max of payload size
uploadCount Max of upload count

AccountRumPageloadEventsAdaptiveGroups

Beta. Aggregated RUM pageload event metrics with adaptive sampling

FieldDescription
avg
count The number of pages viewed by end-users
dimensions List of dimensions to group by
sum

AccountRumPageloadEventsAdaptiveGroupsAvg

FieldDescription
sampleInterval Average sample interval

AccountRumPageloadEventsAdaptiveGroupsDimensions

FieldDescription
bot Indicates if the request is likely from a bot (non-human traffic). Returns 1 if from a bot, 0 otherwise.
countryName Client country ISO 3166 alpha2 code
customTagInternalSxg Signed Exchange enabled status
date Request date from browser
datetimeFifteenMinutes Request datetime from browser, truncated to multiple of 15 minutes
datetimeFiveMinutes Request datetime from browser, truncated to multiple of 5 minutes
datetimeHalfOfHour Request datetime from browser, truncated to multiple of 30 minutes
datetimeHour Request datetime from browser, truncated to the hour
datetimeMinute Request datetime from browser, truncated to the minute
deviceType Device type used for view the page
refererHost Host of the HTTP request referer
refererPath Path of the HTTP request referer
refererScheme Scheme of the HTTP request referer (http or https)
requestHost HTTP Host of the web page URL
requestPath Path of the web page URL
requestScheme Scheme of the web page URL (http or https)
siteTag The key value to identify a site
userAgentBrowser Browser parsed from the user agent
userAgentOS OS parsed from the user agent

AccountRumPageloadEventsAdaptiveGroupsSum

FieldDescription
visits The number of pages viewed by end-users that were initiated from a different website (i.e. where the Document.referrer does not match the hostname)

AccountRumPerformanceEventsAdaptiveGroups

Beta. Aggregated RUM performance event metrics with adaptive sampling

FieldDescription
avg
count The number of pages viewed by end-users
dimensions List of dimensions to group by
quantiles
sum

AccountRumPerformanceEventsAdaptiveGroupsAvg

FieldDescription
connectionTime Connection time
dnsTime Domain lookup time
firstContentfulPaint The time when the first content piece from the DOM is painted (i.e. some text or an image)
firstPaint The time when the first pixel is painted onto the screen (i.e. background of the page)
loadEventTime The time taken for the load event
pageLoadTime The time to download and display the entire content of a web page in the browser window
pageRenderTime The time to download and display the entire content of a web page in the browser window
requestTime The time between initiating the request and receiving the first byte of the response
responseTime The time between receiving the first byte and the last byte of the response
sampleInterval Average sample interval

AccountRumPerformanceEventsAdaptiveGroupsDimensions

FieldDescription
bot Indicates if the request is likely from a bot (non-human traffic). Returns 1 if from a bot, 0 otherwise.
countryName Client country ISO 3166 alpha2 code
customTagInternalSxg Signed Exchange enabled status
date Request date from browser
datetimeFifteenMinutes Request datetime from browser, truncated to multiple of 15 minutes
datetimeFiveMinutes Request datetime from browser, truncated to multiple of 5 minutes
datetimeHalfOfHour Request datetime from browser, truncated to multiple of 30 minutes
datetimeHour Request datetime from browser, truncated to the hour
datetimeMinute Request datetime from browser, truncated to the minute
deviceType Device type used for view the page
refererHost Host of the HTTP request referer
refererPath Path of the HTTP request referer
refererScheme Scheme of the HTTP request referer (http or https)
requestHost HTTP Host of the web page URL
requestPath Path of the web page URL
requestScheme Scheme of the web page URL (http or https)
siteTag The key value to identify a site
userAgentBrowser Browser parsed from the user agent
userAgentOS OS parsed from the user agent

AccountRumPerformanceEventsAdaptiveGroupsQuantiles

FieldDescription
connectionTimeP50 Connection time
connectionTimeP75 Connection time
connectionTimeP90 Connection time
connectionTimeP99 Connection time
dnsTimeP50 Domain lookup time
dnsTimeP75 Domain lookup time
dnsTimeP90 Domain lookup time
dnsTimeP99 Domain lookup time
firstContentfulPaintP50 The time when the first content piece from the DOM is painted (i.e. some text or an image)
firstContentfulPaintP75 The time when the first content piece from the DOM is painted (i.e. some text or an image)
firstContentfulPaintP90 The time when the first content piece from the DOM is painted (i.e. some text or an image)
firstContentfulPaintP99 The time when the first content piece from the DOM is painted (i.e. some text or an image)
firstPaintP50 The time when the first pixel is painted onto the screen (i.e. background of the page)
firstPaintP75 The time when the first pixel is painted onto the screen (i.e. background of the page)
firstPaintP90 The time when the first pixel is painted onto the screen (i.e. background of the page)
firstPaintP99 The time when the first pixel is painted onto the screen (i.e. background of the page)
loadEventTimeP50 The time taken for the load event
loadEventTimeP75 The time taken for the load event
loadEventTimeP90 The time taken for the load event
loadEventTimeP99 The time taken for the load event
pageLoadTimeP50 The time to download and display the entire content of a web page in the browser window
pageLoadTimeP75 The time to download and display the entire content of a web page in the browser window
pageLoadTimeP90 The time to download and display the entire content of a web page in the browser window
pageLoadTimeP99 The time to download and display the entire content of a web page in the browser window
pageRenderTimeP50 The time to download and display the entire content of a web page in the browser window
pageRenderTimeP75 The time to download and display the entire content of a web page in the browser window
pageRenderTimeP90 The time to download and display the entire content of a web page in the browser window
pageRenderTimeP99 The time to download and display the entire content of a web page in the browser window
requestTimeP50 The time between initiating the request and receiving the first byte of the response
requestTimeP75 The time between initiating the request and receiving the first byte of the response
requestTimeP90 The time between initiating the request and receiving the first byte of the response
requestTimeP99 The time between initiating the request and receiving the first byte of the response
responseTimeP50 The time between receiving the first byte and the last byte of the response
responseTimeP75 The time between receiving the first byte and the last byte of the response
responseTimeP90 The time between receiving the first byte and the last byte of the response
responseTimeP99 The time between receiving the first byte and the last byte of the response

AccountRumPerformanceEventsAdaptiveGroupsSum

FieldDescription
visits The number of pages viewed by end-users that were initiated from a different website (i.e. where the Document.referrer does not match the hostname)

AccountRumWebVitalsEventsAdaptive

Beta. RUM Web Vitals event metrics with adaptive sampling

FieldDescription
bot Indicates if the request is likely from a bot (non-human traffic). Returns 1 if from a bot, 0 otherwise.
countryName Client country ISO 3166 alpha2 code
cumulativeLayoutShift Cumulative Layout Shift (Core Web Vitals) (-1 indicates N/A)
cumulativeLayoutShiftCurrentRect Layout values of the rectangular area after the changes
cumulativeLayoutShiftElement DOM selector name of the largest layout shift
cumulativeLayoutShiftPath Observed path of the Cumulative Layout Shift (Core Web Vitals)
cumulativeLayoutShiftPreviousRect Layout values of the rectangular area before the changes
customTagInternalSxg Signed Exchange enabled status
date Request date from browser
datetime Request datetime from browser
datetimeFifteenMinutes Request datetime from browser, truncated to multiple of 15 minutes
datetimeFiveMinutes Request datetime from browser, truncated to multiple of 5 minutes
datetimeHalfOfHour Request datetime from browser, truncated to multiple of 30 minutes
datetimeHour Request datetime from browser, truncated to the hour
datetimeMinute Request datetime from browser, truncated to the minute
deviceType Device type used for view the page
refererHost Host of the HTTP request referer
refererPath Path of the HTTP request referer
refererScheme Scheme of the HTTP request referer (http or https)
requestHost HTTP Host of the web page URL
requestPath Path of the web page URL
requestScheme Scheme of the web page URL (http or https)
sampleInterval ABR sample interval
siteTag The key value to identify a site
userAgentBrowser Browser parsed from the user agent
userAgentOS OS parsed from the user agent

AccountRumWebVitalsEventsAdaptiveGroups

Beta. Aggregated RUM Web Vitals event metrics with adaptive sampling

FieldDescription
avg
count The number of pages viewed by end-users
dimensions List of dimensions to group by
quantiles
sum

AccountRumWebVitalsEventsAdaptiveGroupsAvg

FieldDescription
cumulativeLayoutShift Cumulative Layout Shift (Core Web Vitals) (negative value indicates N/A)
firstContentfulPaint First Contentful Paint in microseconds (negative value indicates N/A)
firstInputDelay First Input Delay (Core Web Vitals) in microseconds (negative value indicates N/A)
interactionToNextPaint Interaction to Next Paint in microseconds (negative value indicates N/A)
largestContentfulPaint Largest Contentful Paint (Core Web Vitals) in microseconds (negative value indicates N/A)
lcpElementRenderDelay Largest Contentful Paint Attributions Element Render Delay in microseconds (negative value indicates N/A)
lcpResourceLoadDelay Largest Contentful Paint Attributions Resource Load Delay in microseconds (negative value indicates N/A)
lcpResourceLoadTime Largest Contentful Paint Attributions Resource Load Time in microseconds (negative value indicates N/A)
sampleInterval Average sample interval
timeToFirstByte Time to First Byte in microseconds (negative value indicates N/A)

AccountRumWebVitalsEventsAdaptiveGroupsDimensions

FieldDescription
bot Indicates if the request is likely from a bot (non-human traffic). Returns 1 if from a bot, 0 otherwise.
countryName Client country ISO 3166 alpha2 code
cumulativeLayoutShiftElement DOM selector name of the largest layout shift
cumulativeLayoutShiftPath Observed path of the Cumulative Layout Shift (Core Web Vitals)
customTagInternalSxg Signed Exchange enabled status
date Request date from browser
datetimeFifteenMinutes Request datetime from browser, truncated to multiple of 15 minutes
datetimeFiveMinutes Request datetime from browser, truncated to multiple of 5 minutes
datetimeHalfOfHour Request datetime from browser, truncated to multiple of 30 minutes
datetimeHour Request datetime from browser, truncated to the hour
datetimeMinute Request datetime from browser, truncated to the minute
deviceType Device type used for view the page
firstInputDelayElement DOM selector name of the input delay
firstInputDelayName Action name of the input delay
firstInputDelayPath Observed path of the First Input Delay (Core Web Vitals)
largestContentfulPaintElement DOM selector name of the largest object
largestContentfulPaintObjectHost Host of the largest object
largestContentfulPaintObjectPath Path of the largest object
largestContentfulPaintObjectScheme Scheme of the largest object (http or https)
largestContentfulPaintPath Observed path of the Largest Contentful Paint (Core Web Vitals)
lcpFetchPriority Fetch priority of the LCP element.
lcpInitiatorType Initiator type of the LCP element.
refererHost Host of the HTTP request referer
refererPath Path of the HTTP request referer
refererScheme Scheme of the HTTP request referer (http or https)
requestHost HTTP Host of the web page URL
requestPath Path of the web page URL
requestScheme Scheme of the web page URL (http or https)
siteTag The key value to identify a site
userAgentBrowser Browser parsed from the user agent
userAgentOS OS parsed from the user agent

AccountRumWebVitalsEventsAdaptiveGroupsQuantiles

FieldDescription
cumulativeLayoutShiftP50 Cumulative Layout Shift (Core Web Vitals) (negative value indicates N/A)
cumulativeLayoutShiftP75 Cumulative Layout Shift (Core Web Vitals) (negative value indicates N/A)
cumulativeLayoutShiftP90 Cumulative Layout Shift (Core Web Vitals) (negative value indicates N/A)
cumulativeLayoutShiftP99 Cumulative Layout Shift (Core Web Vitals) (negative value indicates N/A)
firstContentfulPaintP50 First Contentful Paint in microseconds (negative value indicates N/A)
firstContentfulPaintP75 First Contentful Paint in microseconds (negative value indicates N/A)
firstContentfulPaintP90 First Contentful Paint in microseconds (negative value indicates N/A)
firstContentfulPaintP99 First Contentful Paint in microseconds (negative value indicates N/A)
firstInputDelayP50 First Input Delay (Core Web Vitals) in microseconds (negative value indicates N/A)
firstInputDelayP75 First Input Delay (Core Web Vitals) in microseconds (negative value indicates N/A)
firstInputDelayP90 First Input Delay (Core Web Vitals) in microseconds (negative value indicates N/A)
firstInputDelayP99 First Input Delay (Core Web Vitals) in microseconds (negative value indicates N/A)
interactionToNextPaintP50 Interaction to Next Paint in microseconds (negative value indicates N/A)
interactionToNextPaintP75 Interaction to Next Paint in microseconds (negative value indicates N/A)
interactionToNextPaintP90 Interaction to Next Paint in microseconds (negative value indicates N/A)
interactionToNextPaintP99 Interaction to Next Paint in microseconds (negative value indicates N/A)
largestContentfulPaintP50 Largest Contentful Paint (Core Web Vitals) in microseconds (negative value indicates N/A)
largestContentfulPaintP75 Largest Contentful Paint (Core Web Vitals) in microseconds (negative value indicates N/A)
largestContentfulPaintP90 Largest Contentful Paint (Core Web Vitals) in microseconds (negative value indicates N/A)
largestContentfulPaintP99 Largest Contentful Paint (Core Web Vitals) in microseconds (negative value indicates N/A)
lcpElementRenderDelayP50 Largest Contentful Paint Attributions Element Render Delay in microseconds (negative value indicates N/A)
lcpElementRenderDelayP75 Largest Contentful Paint Attributions Element Render Delay in microseconds (negative value indicates N/A)
lcpElementRenderDelayP90 Largest Contentful Paint Attributions Element Render Delay in microseconds (negative value indicates N/A)
lcpElementRenderDelayP99 Largest Contentful Paint Attributions Element Render Delay in microseconds (negative value indicates N/A)
lcpResourceLoadDelayP50 Largest Contentful Paint Attributions Resource Load Delay in microseconds (negative value indicates N/A)
lcpResourceLoadDelayP75 Largest Contentful Paint Attributions Resource Load Delay in microseconds (negative value indicates N/A)
lcpResourceLoadDelayP90 Largest Contentful Paint Attributions Resource Load Delay in microseconds (negative value indicates N/A)
lcpResourceLoadDelayP99 Largest Contentful Paint Attributions Resource Load Delay in microseconds (negative value indicates N/A)
lcpResourceLoadTimeP50 Largest Contentful Paint Attributions Resource Load Time in microseconds (negative value indicates N/A)
lcpResourceLoadTimeP75 Largest Contentful Paint Attributions Resource Load Time in microseconds (negative value indicates N/A)
lcpResourceLoadTimeP90 Largest Contentful Paint Attributions Resource Load Time in microseconds (negative value indicates N/A)
lcpResourceLoadTimeP99 Largest Contentful Paint Attributions Resource Load Time in microseconds (negative value indicates N/A)
timeToFirstByteP50 Time to First Byte in microseconds (negative value indicates N/A)
timeToFirstByteP75 Time to First Byte in microseconds (negative value indicates N/A)
timeToFirstByteP90 Time to First Byte in microseconds (negative value indicates N/A)
timeToFirstByteP99 Time to First Byte in microseconds (negative value indicates N/A)

AccountRumWebVitalsEventsAdaptiveGroupsSum

FieldDescription
clsGood Cumulative Layout Shift (Core Web Vitals), count of Good occurrences (under 0.1)
clsNeedsImprovement Cumulative Layout Shift (Core Web Vitals), count of Needs Improvement occurrences (between 0.1 and 0.25)
clsPoor Cumulative Layout Shift (Core Web Vitals), count of Poor occurrences (over 0.25)
clsTotal Cumulative Layout Shift (Core Web Vitals), total count
fcpGood First Contentful Paint, count of Good occurrences (under 1.8 s)
fcpNeedsImprovement First Contentful Paint, count of Needs Improvement occurrences (between 1.8 s and 3 s)
fcpPoor First Contentful Paint, count of Poor occurrences (over 3 s)
fcpTotal First Contentful Paint, total count
fidGood First Input Delay (Core Web Vitals), count of Good occurrences (under 100 ms)
fidNeedsImprovement First Input Delay (Core Web Vitals), count of Needs Improvement occurrences (between 100 ms and 300ms)
fidPoor First Input Delay (Core Web Vitals), count of Poor occurrences (over 300 ms)
fidTotal First Input Delay (Core Web Vitals), total count
inpGood Interaction to Next Paint, count of Good occurrences (under 200 ms)
inpNeedsImprovement Interaction to Next Paint, count of Needs Improvement occurrences (between 200 ms and 500ms)
inpPoor Interaction to Next Paint, count of Poor occurrences (over 500 ms)
inpTotal Interaction to Next Paint, total count
lcpGood Largest Contentful Paint (Core Web Vitals), count of Good occurrences (under 2.5 sec)
lcpNeedsImprovement Largest Contentful Paint (Core Web Vitals), count of Needs Improvement occurrences (between 2.5 sec and 4.0 sec)
lcpPoor Largest Contentful Paint (Core Web Vitals), count of Poor occurrences (over 4.0 sec)
lcpTotal Largest Contentful Paint (Core Web Vitals), total count
ttfbGood Time to First Byte, count of Good occurrences (under 800 ms)
ttfbNeedsImprovement Time to First Byte, count of Needs Improvement occurrences (between 800 ms and 1800ms)
ttfbPoor Time to First Byte, count of Poor occurrences (over 500 ms)
ttfbTotal Time to First Byte, total count
visits The number of pages viewed by end-users that were initiated from a different website (i.e. where the Document.referrer does not match the hostname)

AccountSettings

Access and limitations for an account

FieldDescription
MagicWANConnectorMetricsAdaptiveGroups
accessLoginRequestsAdaptiveGroups
advancedDnsProtectionNetworkAnalyticsAdaptiveGroups
advancedTcpProtectionNetworkAnalyticsAdaptiveGroups
aiGatewayCacheAdaptiveGroups
aiGatewayErrorsAdaptiveGroups
aiGatewayRequestsAdaptiveGroups
aiInferenceAdaptive
aiInferenceAdaptiveGroups
browserRenderingEventsAdaptive
browserRenderingEventsAdaptiveGroups
callsStatusAdaptive
callsTurnUsageAdaptiveGroups
callsUsageAdaptiveGroups
cdnNetworkAnalyticsAdaptiveGroups
d1AnalyticsAdaptiveGroups
d1QueriesAdaptiveGroups
d1StorageAdaptiveGroups
dosdAttackAnalyticsGroups
dosdNetworkAnalyticsAdaptiveGroups
durableObjectsInvocationsAdaptiveGroups
durableObjectsPeriodicGroups
durableObjectsStorageGroups
durableObjectsSubrequestsAdaptiveGroups
fbmAttackAnalyticsGroups
firewallEventsAdaptive
firewallEventsAdaptiveGroups
flowtrackdNetworkAnalyticsAdaptiveGroups
gatewayL4DownstreamSessionsAdaptiveGroups
gatewayL4SessionsAdaptiveGroups
gatewayL4UpstreamSessionsAdaptiveGroups
gatewayL7RequestsAdaptiveGroups
gatewayResolverByCategoryAdaptiveGroups
gatewayResolverByCustomResolverGroups
gatewayResolverByRuleExecutionPerformanceAdaptiveGroups
gatewayResolverQueriesAdaptiveGroups
httpRequests1dGroups
httpRequests1hGroups
httpRequests1mGroups
httpRequestsAdaptive
httpRequestsAdaptiveGroups
httpRequestsOverviewAdaptiveGroups
hyperdriveQueriesAdaptiveGroups
imagesRequestsAdaptiveGroups
imagesUniqueTransformations
kvOperationsAdaptiveGroups
kvStorageAdaptiveGroups
logpushHealthAdaptiveGroups
magicFirewallNetworkAnalyticsAdaptiveGroups
magicFirewallRateLimitNetworkAnalyticsAdaptiveGroups
magicFirewallSamplesAdaptiveGroups
magicIDPSNetworkAnalyticsAdaptiveGroups
magicTransitNetworkAnalyticsAdaptiveGroups
magicTransitTunnelHealthChecksAdaptiveGroups
magicTransitTunnelTrafficAdaptiveGroups
mnmFlowDataAdaptiveGroups
nelReportsAdaptiveGroups
ohttpMetricsAdaptive
ohttpMetricsAdaptiveGroups
pagesFunctionsInvocationsAdaptiveGroups
queueBacklogAdaptiveGroups
queueConsumerMetricsAdaptiveGroups
queueDelayedBacklogAdaptiveGroups
queueMessageOperationsAdaptiveGroups
r2OperationsAdaptiveGroups
r2StorageAdaptiveGroups
rumPageloadEventsAdaptiveGroups
rumPerformanceEventsAdaptiveGroups
rumWebVitalsEventsAdaptive
rumWebVitalsEventsAdaptiveGroups
sinkholeRequestLogsAdaptive
sinkholeRequestLogsAdaptiveGroups
sippyOperationsAdaptiveGroups
spectrumNetworkAnalyticsAdaptiveGroups
storageTraces
streamMinutesViewedAdaptiveGroups
turnstileAdaptiveGroups
vectorizeQueriesAdaptiveGroups
vectorizeStorageAdaptiveGroups
vectorizeV2OperationsAdaptiveGroups
vectorizeV2QueriesAdaptiveGroups
vectorizeV2StorageAdaptiveGroups
vectorizeV2WritesAdaptiveGroups
videoBufferEventsAdaptiveGroups
videoPlaybackEventsAdaptiveGroups
videoQualityEventsAdaptiveGroups
warpDeviceAdaptiveGroups
workerPlacementAdaptiveGroups
workersAnalyticsEngineAdaptiveGroups
workersInvocationsAdaptive
workersInvocationsScheduled
workersOverviewDataAdaptiveGroups
workersOverviewRequestsAdaptiveGroups
workersSubrequestsAdaptiveGroups
workflowsAdaptive
workflowsAdaptiveGroups
zarazTrackAdaptiveGroups
zarazTriggersAdaptiveGroups
zeroTrustPrivateNetworkDiscoveryGroups

AccountSinkholeRequestLogsAdaptive

Sinkhole Request Logs

FieldDescription
body The request body
datetime The date and time the event was recorded
destinationAddress The destination IP address of the request
headers The request headers. If a header has multiple values, the values are comma separated. Each header is newline separated.
host The host the request was sent to
method The request method
r2Path The path to the object within the R2 bucket linked to this sinkhole that stores overflow body and header data. Blank if neither headers nor body was larger than 256 bytes.
referrer The referrer of the request
sampleInterval ABR sample interval
sinkholeId The ID of the sinkhole that logged the request
sourceAddress The sender's IP address
uri The request uri
url The request url
userAgent The request user agent

AccountSinkholeRequestLogsAdaptiveGroups

Sinkhole Request Logs

FieldDescription
count Number of requests logged
dimensions List of dimensions to group by

AccountSinkholeRequestLogsAdaptiveGroupsDimensions

FieldDescription
body The request body
datetime The date and time the event was recorded
destinationAddress The destination IP address of the request
headers The request headers. If a header has multiple values, the values are comma separated. Each header is newline separated.
host The host the request was sent to
method The request method
r2Path The path to the object within the R2 bucket linked to this sinkhole that stores overflow body and header data. Blank if neither headers nor body was larger than 256 bytes.
referrer The referrer of the request
sinkholeId The ID of the sinkhole that logged the request
sourceAddress The sender's IP address
uri The request uri
url The request url
userAgent The request user agent

AccountSippyOperationsAdaptiveGroups

Sippy operations with adaptive sampling

FieldDescription
count Total number of Sippy operations
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountSippyOperationsAdaptiveGroupsDimensions

FieldDescription
action Operation's name
bucket Name of the R2 bucket
date Operation timestamp, truncated to start of a day
datetime Operation timestamp
datetimeHour Operation timestamp, truncated to start of an hour
datetimeMinute Operation timestamp, truncated to start of an minute
initiator Operation's initiator (eyeball / Sippy)
object Object key the operation was made for
size Number of bytes transferred as part of the operation
status Operation's response HTTP code
target Operation's target (upstream / R2)

AccountSippyOperationsAdaptiveGroupsSum

FieldDescription
size Total bytes transferred

AccountSpectrumNetworkAnalyticsAdaptiveGroups

Network analytics data for Spectrum traffic

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountSpectrumNetworkAnalyticsAdaptiveGroupsAvg

FieldDescription
bitRate Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountSpectrumNetworkAnalyticsAdaptiveGroupsDimensions

FieldDescription
applicationTag Application tag associated with the packet
coloCity City where the Cloudflare datacenter that received the packet is located
coloCode Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName Cloudflare datacenter that received the packet (unique site identifier)
date Date that the packet was received
datetime Date and time that the packet was received
datetimeFifteenMinutes Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName Name of ASN associated with the destination IP of the packet, if available
destinationCountry Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationGeohash Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort Value of the Destination Port header field in the TCP or UDP packet
direction Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
ethertype Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum Value of the Checkusm header field in the GRE packet
greEthertype Value of the Ethertype header field in the GRE packet
greHeaderLength Length of the GRE packet header, in bytes
greKey Value of the Key header field in the GRE packet
greSequenceNumber Value of the Sequence Number header field in the GRE packet
greVersion Value of the Version header field in the GRE packet
icmpChecksum Value of the Checkusm header field in the ICMP packet
icmpCode Value of the Code header field in the ICMP packet
icmpType Value of the Type header field in the ICMP packet
ipDestinationAddress Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum Value of the Checksum header field in the IPv4 packet
ipv4DontFragment Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification Value of the Identification header field in the IPv4 packet
ipv4Options List of Options numbers included in the IPv4 packet header
ipv6Dscp Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel Value of the Flow Label header field in the IPv6 packet
ipv6Identification Value of the Identification extension header field in the IPv6 packet
leaseTag IP lease tag associated with the packet
mitigationSystem Which system dropped the packet (possible values: dosd, flowtrackd, magic-firewall)
outcome The action that was taken on the packet (possible values: pass, drop)
prefixTag IP prefix tag associated with the packet
sampleInterval ABR sample interval
sourceAsn ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName Name of ASN associated with the source IP of the packet, if available
sourceCountry Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceGeohash Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum Value of the Checkusm header field in the TCP packet
tcpDataOffset Value of the Data Offset header field in the TCP packet
tcpFlags Value of the Flags header field in the TCP packet
tcpFlagsString Human-readable string representation of the Flags header field in the TCP packet
tcpMss Value of the MSS option header field in the TCP packet
tcpOptions List of Options numbers included in the TCP packet header
tcpSackBlocks Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale Value of the Window Scale option header field in the TCP packet
tcpWindowSize Value of the Window Size header field in the TCP packet
udpChecksum Value of the Checkusm header field in the UDP packet
udpPayloadLength Value of the Payload Length header field in the UDP packet

AccountSpectrumNetworkAnalyticsAdaptiveGroupsSum

FieldDescription
bits Sum of bits received
packets Sum of packets received

AccountStorageTraces

Storage Tracing Information

FieldDescription
containerId The container that this resource is stored under.
datetime Storage trace timestamp
resourceId The identifier to access this resource in the container.
serviceId The identifier of the storage service that houses the resourse.
traceId The ID that this trace entry is under.
userAccountId The AccountID of the user who owns the resource.

AccountStorageTracesOrderBy

FieldDescription

AccountStreamMinutesViewedAdaptiveGroups

A high-level summary of Cloudflare Stream minutes viewed.

FieldDescription
count The number of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountStreamMinutesViewedAdaptiveGroupsDimensions

FieldDescription
clientCountryName ISO 3166 alpha2 country code from the client
creator Customer-provided creator ID of a video
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute
mediaType The source of the minutes viewed
uid Unique ID of a video

AccountStreamMinutesViewedAdaptiveGroupsSum

FieldDescription
minutesViewed

AccountTurnstileAdaptiveGroups

Beta. Cloudflare Turnstile aggregated events with adaptive sampling

FieldDescription
avg
count Number of Cloudflare Turnstile events processed
dimensions List of dimensions to group by

AccountTurnstileAdaptiveGroupsAvg

FieldDescription
sampleInterval Average sample interval

AccountTurnstileAdaptiveGroupsDimensions

FieldDescription
action The action tag tied to that challenge event
asn ASN tied to that Turnstile event
browserMajor Major version of the browser tied to that Turnstile event
browserName Browser name tied to that Turnstile event
countryCode 2 character country code tied to that Turnstile event
date The date the challenge event was emitted
datetime The date and time the challenge event was emitted
datetimeDay The date and time the challenge event was emitted truncated to the day
datetimeFifteenMinutes The date and time the challenge event was emitted truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the challenge event was emitted truncated to a multiple of 5 minutes
datetimeHalfOfHour The date and time the challenge event was emitted truncated to a multiple of 30 minutes
datetimeHour The date and time the challenge event was emitted truncated to the hour
datetimeMinute The date and time the challenge event was emitted truncated to the minute
eventType The type of the Cloudflare Turnstile event
hostname Hostname tied to that Turnstile event
ipv4 IPv4 tied to that Turnstile event
ipv6 IPv6 tied to that Turnstile event
osMajor Major version of the OS tied to that Turnstile event
osName OS name tied to that Turnstile event
siteKey The sitekey of the widget associated with the event
userAgent User agent tied to that Turnstile event

AccountVectorizeQueriesAdaptiveGroups

Beta. Vectorize usage with adaptive sampling

FieldDescription
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountVectorizeQueriesAdaptiveGroupsDimensions

FieldDescription
date Vectorize storage sample timestamp
datetimeHour Vectorize storage sample timestamp, truncated to the hour
vectorizeIndexId Identifier for a Vectorize index

AccountVectorizeQueriesAdaptiveGroupsSum

FieldDescription
queriedVectorDimensions The number of queried vector dimensions in Vectorize over the queried time period.

AccountVectorizeStorageAdaptiveGroups

Beta. Vectorize storage with adaptive sampling

FieldDescription
dimensions List of dimensions to group by
max The max of values for a metric per dimension

AccountVectorizeStorageAdaptiveGroupsDimensions

FieldDescription
date Vectorize storage sample timestamp
datetimeHour Vectorize storage sample timestamp, truncated to the hour
vectorizeIndexId Identifier for a Vectorize index

AccountVectorizeStorageAdaptiveGroupsMax

FieldDescription
storedVectorDimensions The maximum number of stored vector dimensions in Vectorize over the queried time period.

AccountVectorizeV2OperationsAdaptiveGroups

Vectorize operations with adaptive sampling

FieldDescription
count Total number of Vectorize operations
dimensions List of dimensions to group by

AccountVectorizeV2OperationsAdaptiveGroupsDimensions

FieldDescription
date Vectorize operation event timestamp, truncated to start of a day
datetime Vectorize operation event timestamp
datetimeHour Vectorize operation event timestamp, truncated to start of hour
datetimeMinute Vectorize operation event timestamp, truncated to start of minute
indexName Name of a Vectorize index
operation The type of Vectorize operation
requestStatus Request status. One of [2xx, 4xx, 5xx, unknown]

AccountVectorizeV2QueriesAdaptiveGroups

Vectorize queries with adaptive sampling

FieldDescription
avg The average value for a metric per dimension
count Total number of Vectorize queries
dimensions List of dimensions to group by
quantiles Quantiles of a metric per dimension
sum The sum of values for a metric per dimension

AccountVectorizeV2QueriesAdaptiveGroupsAvg

FieldDescription
requestDurationMs Average latency (in milliseconds) of serving a Vectorize query

AccountVectorizeV2QueriesAdaptiveGroupsDimensions

FieldDescription
date Vectorize queries event timestamp, truncated to start of a day
datetime Vectorize queries event timestamp
datetimeHour Vectorize queries event timestamp, truncated to start of hour
datetimeMinute Vectorize queries event timestamp, truncated to start of minute
indexName Name of a Vectorize index
operation The type of Vectorize operation
requestStatus Request status. One of [2xx, 4xx, 5xx, unknown]

AccountVectorizeV2QueriesAdaptiveGroupsQuantiles

FieldDescription
requestDurationMsP25 25th percentile latency (milliseconds)
requestDurationMsP50 50th percentile latency (milliseconds)
requestDurationMsP75 75th percentile latency (milliseconds)
requestDurationMsP95 95th percentile latency (milliseconds)
requestDurationMsP99 99th percentile latency (milliseconds)

AccountVectorizeV2QueriesAdaptiveGroupsSum

FieldDescription
queriedVectorDimensions The number of queried vector dimensions in Vectorize over the queried time period. This metric must always be fetched along with the 'indexName' and 'datetime' dimensions, as well as a 'requestStatus:2xx' filter to estimate billable usage.
requestDurationMs Total latency (in milliseconds) of serving Vectorize queries over the queried time period
servedVectorCount The number of vectors served in Vectorize queries over the queried time period.

AccountVectorizeV2StorageAdaptiveGroups

Vectorize storage with adaptive sampling

FieldDescription
dimensions List of dimensions to group by
max The max of values for a metric per dimension

AccountVectorizeV2StorageAdaptiveGroupsDimensions

FieldDescription
date Vectorize storage event timestamp, truncated to start of a day
datetime Vectorize storage event timestamp
datetimeHour Vectorize storage event timestamp, truncated to start of hour
datetimeMinute Vectorize storage event timestamp, truncated to start of minute
indexName Name of a Vectorize index

AccountVectorizeV2StorageAdaptiveGroupsMax

FieldDescription
storedVectorDimensions The maximum number of stored vector dimensions in Vectorize over the queried time period.
vectorCount The maximum number of stored vectors in Vectorize over the queried time period.

AccountVectorizeV2WritesAdaptiveGroups

Vectorize writes with adaptive sampling

FieldDescription
avg The average value for a metric per dimension
count Total number of Vectorize writes
dimensions List of dimensions to group by
quantiles Quantiles of a metric per dimension
sum The sum of values for a metric per dimension

AccountVectorizeV2WritesAdaptiveGroupsAvg

FieldDescription
requestDurationMs Average latency (in milliseconds) of serving a Vectorize write

AccountVectorizeV2WritesAdaptiveGroupsDimensions

FieldDescription
date Vectorize write event timestamp, truncated to start of a day
datetime Vectorize write event timestamp
datetimeHour Vectorize write event timestamp, truncated to start of hour
datetimeMinute Vectorize write event timestamp, truncated to start of minute
indexName Name of a Vectorize index
operation The type of Vectorize operation
requestStatus Request status. One of [2xx, 4xx, 5xx, unknown]

AccountVectorizeV2WritesAdaptiveGroupsQuantiles

FieldDescription
requestDurationMsP25 25th percentile latency (milliseconds)
requestDurationMsP50 50th percentile latency (milliseconds)
requestDurationMsP75 75th percentile latency (milliseconds)
requestDurationMsP95 95th percentile latency (milliseconds)
requestDurationMsP99 99th percentile latency (milliseconds)

AccountVectorizeV2WritesAdaptiveGroupsSum

FieldDescription
addedVectorCount The number of vectors added in Vectorize writes over the queried time period.
deletedVectorCount The number of vectors deleted in Vectorize writes over the queried time period.
requestDurationMs Total latency (in milliseconds) of serving Vectorize writes over the queried time period

AccountVideoBufferEventsAdaptiveGroups

Beta. Aggregated video streaming buffer event metrics with adaptive sampling

FieldDescription
avg
count Total number of buffer events
dimensions List of dimensions to group by

AccountVideoBufferEventsAdaptiveGroupsAvg

FieldDescription
sampleInterval Average sample interval

AccountVideoBufferEventsAdaptiveGroupsDimensions

FieldDescription
clientCountryName ISO 3166 alpha2 country code from the client
date Request date of the event
datetime Request datetime of the event
datetimeFifteenMinutes Request datetime of the event, truncated to multiple of 15 minutes
datetimeFiveMinutes Request datetime of the event, truncated to multiple of 5 minutes
datetimeHalfOfHour Request datetime of the event, truncated to multiple of 30 minutes
datetimeHour Request datetime of the event, truncated to the hour
datetimeMinute Request datetime of the event, truncated to the minute
deviceBrowser Browser of the device used in playback
deviceOs OS of the device used in playback
deviceType Device type used in playback
uid unique id for a video

AccountVideoPlaybackEventsAdaptiveGroups

Beta. Aggregated video streaming playback event metrics with adaptive sampling

FieldDescription
avg
count Total number of playback starts
dimensions List of dimensions to group by
sum

AccountVideoPlaybackEventsAdaptiveGroupsAvg

FieldDescription
sampleInterval Average sample interval

AccountVideoPlaybackEventsAdaptiveGroupsDimensions

FieldDescription
clientCountryName ISO 3166 alpha2 country code from the client
date Request date of the event
datetime Request datetime of the event
datetimeFifteenMinutes Request datetime of the event, truncated to multiple of 15 minutes
datetimeFiveMinutes Request datetime of the event, truncated to multiple of 5 minutes
datetimeHalfOfHour Request datetime of the event, truncated to multiple of 30 minutes
datetimeHour Request datetime of the event, truncated to the hour
datetimeMinute Request datetime of the event, truncated to the minute
deviceBrowser Browser of the device used in playback
deviceOs OS of the device used in playback
deviceType Device type used in playback
uid unique id for a video

AccountVideoPlaybackEventsAdaptiveGroupsSum

FieldDescription
timeViewedMinutes Total time viewed in minutes

AccountVideoQualityEventsAdaptiveGroups

Beta. Aggregated video streaming quality change event metrics with adaptive sampling

FieldDescription
avg
count Total number of quality change events
dimensions List of dimensions to group by

AccountVideoQualityEventsAdaptiveGroupsAvg

FieldDescription
sampleInterval Average sample interval

AccountVideoQualityEventsAdaptiveGroupsDimensions

FieldDescription
clientCountryName ISO 3166 alpha2 country code from the client
date Request date of the event
datetime Request datetime of the event
datetimeFifteenMinutes Request datetime of the event, truncated to multiple of 15 minutes
datetimeFiveMinutes Request datetime of the event, truncated to multiple of 5 minutes
datetimeHalfOfHour Request datetime of the event, truncated to multiple of 30 minutes
datetimeHour Request datetime of the event, truncated to the hour
datetimeMinute Request datetime of the event, truncated to the minute
deviceBrowser Browser of the device used in playback
deviceOs OS of the device used in playback
deviceType Device type used in playback
qualityResolution Video playback vertical resolution
uid unique id for a video

AccountWarpDeviceAdaptiveGroups

Beta. Warp device health events with adaptive sampling

FieldDescription
count Number of device health events, which usually occur at 2m intervals per device
dimensions List of dimensions to group by
uniq

AccountWarpDeviceAdaptiveGroupsDimensions

FieldDescription
clientPlatform Device's OS
clientVersion Device's Warp version
colo Device's connected colo
date The date of the device log
datetime The date and time of the device log
datetimeFiveMinute The date and time of the device log truncated to every five minutes
datetimeHour The date and time of the device log truncated to the hour
datetimeTenMinute The date and time of the device log truncated to every ten minutes
deviceId Device ID
mode Device's Warp mode
status Device connection status

AccountWarpDeviceAdaptiveGroupsUniq

FieldDescription
deviceIds Approximate count of unique deviceIds

AccountWorkerPlacementAdaptiveGroups

Worker placement metrics

FieldDescription
dimensions List of dimensions to group by
quantiles Quantiles of a metric per dimension
sum The sum of values for a metric per dimension

AccountWorkerPlacementAdaptiveGroupsDimensions

FieldDescription
date Request timestamp, truncated to start of a day
datetime Request timestamp
datetimeFifteenMinutes Request timestamp, truncated to fifteen minutes
datetimeFiveMinutes Request timestamp, truncated to five minutes
datetimeHour Request timestamp, truncated to start of an hour
datetimeMinute Request timestamp, truncated to start of an minute
httpStatus Response status of worker
isSample 1 if the request was sampled to bypass Smart Placement, 0 if it was processed using Smart Placement
placementUsed 1 if the request was processed using Smart Placement, 0 if it was processed in default mode
requestDurationBucketMin Bucket of request duration rounded down to nearest 10*2^n
requestDurationBucketMin100ms Bucket of request duration rounded down to nearest 100ms
scriptName The script name
scriptTag The unique tag of the script
scriptVersion The script version

AccountWorkerPlacementAdaptiveGroupsQuantiles

FieldDescription
requestDurationP25 Request duration 25th percentile - milliseconds
requestDurationP50 Request duration 50th percentile - milliseconds
requestDurationP75 Request duration 75th percentile - milliseconds
requestDurationP90 Request duration 90th percentile - milliseconds
requestDurationP95 Request duration 95th percentile - milliseconds
requestDurationP99 Request duration 99th percentile - milliseconds
requestDurationP999 Request duration 99.9th percentile - milliseconds

AccountWorkerPlacementAdaptiveGroupsSum

FieldDescription
requestDuration Sum of duration ms of requests measured at the data centers that receive the requests
requests Total number of requests

AccountWorkersAnalyticsEngineAdaptiveGroups

Beta. Custom Events with adaptive sampling

FieldDescription
count The number of values for a metric per dimension
dimensions List of dimensions to group by

AccountWorkersAnalyticsEngineAdaptiveGroupsDimensions

FieldDescription
dataset The dataset name
date The date the event occurred
datetime The date and time the event occurred
datetimeFifteenMinutes The date and time the event occurred truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred truncated to the start of an hour
datetimeMinute The date and time the event occurred truncated to the start of a minute

AccountWorkersInvocationsAdaptive

Beta. Workers invocations with adaptive sampling

FieldDescription
avg The average value used for sample interval
dimensions List of dimensions to group by
max The max value for a metric
min The min value for a metric
quantiles Quantiles of a metric per dimension
sum The sum of values for a metric per dimension

AccountWorkersInvocationsAdaptiveAvg

FieldDescription
sampleInterval

AccountWorkersInvocationsAdaptiveDimensions

FieldDescription
date Request datetime, truncated to start of a day
datetime Request datetime
datetimeFifteenMinutes The date and time of the event truncated to fifteen minutes
datetimeFiveMinutes The date and time of the event truncated to five minutes
datetimeHour Request datetime, truncated to start of an hour
datetimeMinute Request datetime, truncated to start of an minute
dispatchNamespaceName The name of the script's dispatch namespace
environmentName The name of the script environment
isDispatcher Whether the request is from a Dispatch Worker. Non-zero if true
scriptName The name of the script
scriptTag The unique tag of the script
scriptVersion The version of the Worker
status Status of the worker invocation
usageModel Usage model of the worker invocation

AccountWorkersInvocationsAdaptiveMax

FieldDescription
cpuTime Maximum CPU time for one request - microseconds
duration Maximum duration of one request - GB*s
responseBodySize Maximum response body size for one request - bytes
wallTime Maximum wall time for one request - microseconds

AccountWorkersInvocationsAdaptiveMin

FieldDescription
cpuTime Minimum CPU time for one request - microseconds
duration Minimum duration of one request - GB*s
responseBodySize Minimum response body size for one request - bytes
wallTime Minimum wall time for one request - microseconds

AccountWorkersInvocationsAdaptiveQuantiles

FieldDescription
cpuTimeP25 CPU time 25th percentile - microseconds
cpuTimeP50 CPU time 50th percentile - microseconds
cpuTimeP75 CPU time 75th percentile - microseconds
cpuTimeP90 CPU time 90th percentile - microseconds
cpuTimeP95 CPU time 95th percentile - microseconds
cpuTimeP99 CPU time 99th percentile - microseconds
cpuTimeP999 CPU time 99.9th percentile - microseconds
durationP25 Duration 25th percentile - GB*s
durationP50 Duration 50th percentile - GB*s
durationP75 Duration 75th percentile - GB*s
durationP90 Duration 90th percentile - GB*s
durationP95 Duration 95th percentile - GB*s
durationP99 Duration 99th percentile - GB*s
durationP999 Duration 99.9th percentile - GB*s
responseBodySizeP25 Response body size 25th percentile - bytes
responseBodySizeP50 Response body size 50th percentile - bytes
responseBodySizeP75 Response body size 75th percentile - bytes
responseBodySizeP90 Response body size 90th percentile - bytes
responseBodySizeP95 Response body size 95th percentile - bytes
responseBodySizeP99 Response body size 99th percentile - bytes
responseBodySizeP999 Response body size 99.9th percentile - bytes
wallTimeP25 Wall time 25th percentile - microseconds
wallTimeP50 Wall time 50th percentile - microseconds
wallTimeP75 Wall time 75th percentile - microseconds
wallTimeP90 Wall time 90th percentile - microseconds
wallTimeP95 Wall time 95th percentile - microseconds
wallTimeP99 Wall time 99th percentile - microseconds
wallTimeP999 Wall time 99.9th percentile - microseconds

AccountWorkersInvocationsAdaptiveSum

FieldDescription
clientDisconnects Sum of client disconnects
cpuTimeUs Sum of cpu time in us
duration Sum of Duration - GB*s
errors Sum of Errors
requests Sum of Requests
responseBodySize Sum of Response Body Sizes
subrequests Sum of Subrequests
wallTime Sum of Wall Time

AccountWorkersInvocationsScheduled

Workers scheduled invocations

FieldDescription
cpuTimeUs CPU time - microseconds
cron The cron string of the schedule
datetime Request datetime
environmentName The name of the script environment
scheduledDatetime Scheduled datetime
scriptName The name of the script
status Status of the worker invocation

AccountWorkersOverviewDataAdaptiveGroups

Beta. Workers account overview invocation data with adaptive sampling

FieldDescription
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountWorkersOverviewDataAdaptiveGroupsDimensions

FieldDescription
datetime Request datetime
usageModel Usage model of the worker invocation

AccountWorkersOverviewDataAdaptiveGroupsSum

FieldDescription
standardCpuTimeUs Standard usage model cpu time in us
unboundDurationUs Unbound usage model duration in us

AccountWorkersOverviewRequestsAdaptiveGroups

Beta. Workers account overview invocation count with adaptive sampling

FieldDescription
count The number of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountWorkersOverviewRequestsAdaptiveGroupsDimensions

FieldDescription
datetime Request datetime
status Status of the worker invocation
usageModel Usage model of the worker invocation

AccountWorkersOverviewRequestsAdaptiveGroupsSum

FieldDescription
cpuTimeUs Cpu time in us

AccountWorkersSubrequestsAdaptiveGroups

Beta. Workers subrequests with adaptive sampling

FieldDescription
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountWorkersSubrequestsAdaptiveGroupsDimensions

FieldDescription
cacheStatus Cache status
date Request datetime, truncated to start of a day
datetime Request datetime
datetimeFifteenMinutes The date and time of the event truncated to fifteen minutes
datetimeFiveMinutes The date and time of the event truncated to five minutes
datetimeHour Request datetime, truncated to start of an hour
datetimeMinute Request datetime, truncated to start of an minute
environmentName The name of the script environment
scriptName The name of the script
scriptVersion The version of the Worker
usageModel Usage model of the worker invocation

AccountWorkersSubrequestsAdaptiveGroupsSum

FieldDescription
requestBodySizeUncached Workers fetch request body size in bytes where the request was not cached
subrequests Number of subrequests

AccountWorkflowsAdaptive

Workflows analytics

FieldDescription
datetime The date when trigger was triggered
endTimestamp Instance end timestamp(seconds)
eventType Event type
instanceId Instance Id
sampleInterval ABR sample interval
startTimestamp Instance start timestamp(seconds)
stepCount Step number
stepName Step name
wallTime Wall time in seconds
workflowName Workflow name

AccountWorkflowsAdaptiveGroups

Workflows analytics

FieldDescription
count Number of events(workflow invocations) per dimension
dimensions List of dimensions to group by
sum

AccountWorkflowsAdaptiveGroupsDimensions

FieldDescription
date The date when trigger was triggered
datetimeFifteenMinutes The date and time truncated to fifteen minutes
datetimeFiveMinutes The date and time truncated to five minutes
datetimeHour The date and time truncated to the hour
datetimeMinute The date and time truncated to the minute
eventType Event type
instanceId Instance Id
stepCount Step number
stepName Step name
workflowName Workflow name

AccountWorkflowsAdaptiveGroupsSum

FieldDescription
wallTime Total wall time per dimension

AccountZarazTrackAdaptiveGroups

Zaraz Track Analytics - counts zaraz.track calls

FieldDescription
count Number of processed Zaraz Track requests
dimensions List of dimensions to group by

AccountZarazTrackAdaptiveGroupsDimensions

FieldDescription
date Date when track was called
datetimeFifteenMinutes The date and time truncated to fifteen minutes
datetimeFiveMinutes The date and time truncated to five minutes
datetimeHour The date and time truncated to the hour
datetimeMinute The date and time truncated to the minute
trackName Track Name
urlPath The URL from where Track was called

AccountZarazTriggersAdaptiveGroups

Zaraz Triggers Analytics (a trigger is a set of rules that can trigger a zaraz action)

FieldDescription
count Number of processed Zaraz Triggers
dimensions List of dimensions to group by

AccountZarazTriggersAdaptiveGroupsDimensions

FieldDescription
date The date when trigger was triggerd
datetimeFifteenMinutes The date and time truncated to fifteen minutes
datetimeFiveMinutes The date and time truncated to five minutes
datetimeHour The date and time truncated to the hour
datetimeMinute The date and time truncated to the minute
triggerName Trigger Name

AccountZeroTrustPrivateNetworkDiscoveryGroups

Beta - Unique origins, applications, and users discovered for Zero Trust private networks

FieldDescription
count Sum of network access during the select range
dimensions List of dimensions to group by
max
uniq

AccountZeroTrustPrivateNetworkDiscoveryGroupsDimensions

FieldDescription
date Request date
datetimeHour Request datetime and start of the hour
destinationIP Destination IPv4 or IPv6
destinationPort Destination port
email The email address of the user who accessed the resource
hostname SNI hostname of the origin if TLS intercept is enabled
originId UUID of the origin if it has been identified before
status status of the origin, one of unreviewed, in_review, approved, unapproved
transport The transport protocol used in the session, one of (0, tcp) (1, quic) (2, udp)
userId The ID of the user who accessed the resource

AccountZeroTrustPrivateNetworkDiscoveryGroupsMax

FieldDescription
dateTime Latest access time of a user

AccountZeroTrustPrivateNetworkDiscoveryGroupsUniq

FieldDescription
emails Approximate count of unique emails
origins Approximate count of unique origins. An origin is a (transport, destinationIP, destinationPort)
userIds Approximate count of unique users

Confidence

FieldDescription
estimate Estimated value of this metric
isValid True if the confidence interval is valid, i.e. there is enough samples at low enough sample interval
lower Lower bound of confidence interval
sampleSize Number of samples that contributed to the estimate
upper Upper bound of confidence interval

Date

Scalar type types.Date

FieldDescription

Mutation

Mutations are not supported

FieldDescription
do

OrganizationHttpRequestsAdaptiveGroups

Aggregated HTTP requests data with adaptive sampling

FieldDescription
avg The average value used for sample interval
confidence ALPHA - DO NOT USE
count The number of values for a metric per dimension
dimensions List of dimensions to group by
quantiles Quantiles of a metric per dimension
ratio The ratio of a range of status codes, between 0 and 1
sum The sum of values for a metric per dimension

OrganizationHttpRequestsAdaptiveGroupsAvg

FieldDescription
crossZoneSubrequests The proportion of requests that were inititiated by a Cloudflare Worker on another zone
edgeDnsResponseTimeMs
edgeTimeToFirstByteMs
originResponseDurationMs The average originResponseDuration, in milliseconds, excluding 0 values (i.e. cached ones)
sampleInterval

OrganizationHttpRequestsAdaptiveGroupsConfidence

FieldDescription
count The number of values for a metric per dimension, with confidence intervals
level Confidence level that was requested
sum The sum of values for a metric per dimension, with confidence intervals

OrganizationHttpRequestsAdaptiveGroupsDimensions

FieldDescription
accountTag Associated account
apiGatewayMatchedEndpoint API Gateway endpoint matched at the edge
apiGatewayMatchedHost API Gateway host matched at the edge
botManagementDecision Judgement of the bot management system
botScore The final score originated from bot management detections.
botScoreBucketBy10 Range of the bot management score
botScoreSrcName Name of the source detection which generated the bot management score.
cacheReserveUsed Used Cache Reserve to serve the response
cacheStatus
clientASNDescription The ASN of the visitor as string
clientAsn
clientCountryName Country from which request originated
clientDeviceType
clientIP
clientRefererHost The referrer host
clientRequestHTTPHost Host requested by the client
clientRequestHTTPMethodName HTTP method of client request
clientRequestHTTPProtocol HTTP protocol version
clientRequestPath Path of client request
clientRequestQuery Query parameters of client request
clientRequestReferer HTTP request referrer
clientRequestScheme HTTP request URI scheme (http/https)
clientSSLProtocol SSL protocol version
coloCode
contentScanHasFailed 1 if not all contents for this request where successfully scanned, else 0
contentScanNumMaliciousObj Number of scannable content objects that are malicious
contentScanNumObj Number of scannable content objects
contentScanObjResults Array of scan results in order of detection
contentScanObjSizes Array of scan sizes in order of detection
contentScanObjTypes Array of content types in order of detection
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute
edgeDnsResponseTimeMs The time elapsed resolving a CNAME if it was required to reach your origin
edgeResponseContentTypeName
edgeResponseStatus
edgeTimeToFirstByteMs The time elapsed between processing the first byte of the request until when we started sending a response
httpApplicationVersion DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application
isCrossZoneSubrequest '1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise.
ja3Hash MD5 hash of the JA3 TLS fingerprint
ja4 JA4 TLS fingerprint
leakedCredentialCheckResult The distinct result of checking for leaked credentials
originASN
originASNDescription ASN associated with origin
originIP
originResponseDurationMs
originResponseStatus HTTP response status code returned by the origin
requestSource
sampleInterval ABR sample interval
securityAction The code of the first-class action the Cloudflare Firewall took on this request
securitySource The Cloudflare security product triggered by this request
upperTierColoName
userAgent
userAgentBrowser Browser parsed from the user agent
userAgentOS OS parsed from the user agent
wafAttackScore Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass Beta. Overall request score class generated by the WAF detection module
wafRceAttackScore Beta. WAF score for a RCE attack
wafSqliAttackScore Beta. WAF score for a SQLi attack
wafXssAttackScore Beta. WAF score for a XSS attack
xRequestedWith The X-Requested-With header of the client request
zoneTag Associated zone
zoneVersion The version of a zone

OrganizationHttpRequestsAdaptiveGroupsQuantiles

FieldDescription
edgeDnsResponseTimeMsP50 50th percentile DNS Response Time (milliseconds)
edgeDnsResponseTimeMsP95 95th percentile DNS Response Time (milliseconds)
edgeDnsResponseTimeMsP99 99th percentile DNS Response Time (milliseconds)
edgeTimeToFirstByteMsP50 50th percentile Time To First Byte (milliseconds)
edgeTimeToFirstByteMsP95 95th percentile Time To First Byte (milliseconds)
edgeTimeToFirstByteMsP99 99th percentile Time To First Byte (milliseconds)
originResponseDurationMsP50 50th percentile Origin Response Duration (milliseconds)
originResponseDurationMsP95 95th percentile Origin Response Duration (milliseconds)
originResponseDurationMsP99 99th percentile Origin Response Duration (milliseconds)

OrganizationHttpRequestsAdaptiveGroupsRatio

FieldDescription
status4xx
status5xx

OrganizationHttpRequestsAdaptiveGroupsSum

FieldDescription
crossZoneSubrequests The number of requests that were inititiated by a Cloudflare Worker on another zone
edgeDnsResponseTimeMs
edgeResponseBytes
edgeTimeToFirstByteMs
originResponseDurationMs
visits The number of requests by end-users that were initiated from a different website (i.e. where the request HTTP Referer header does not match the host in the HTTP Host header)

OrganizationHttpRequestsAdaptiveGroupsSumConfidence

FieldDescription
edgeResponseBytes Confidence interval for the corresponding point estimate

OrganizationSettings

Access and limitations for an organization

FieldDescription
httpRequestsAdaptiveGroups

Query

FieldDescription
cost
viewer

Settings

Access and limitations

FieldDescription
availableFields The list of available fields to query
enabled
maxDuration Requested time range should not be wider than this (seconds)
maxNumberOfFields Maximum number of fields to request at once
maxPageSize Maximum allowed value for 'limit'
notOlderThan Cannot reach for data beyond this distance in the past (seconds)

Time

Scalar type time.Time

FieldDescription

ZoneApiGatewayGraphqlQueryAnalyticsGroups

GraphQL query attributes and trends

FieldDescription
avg
count Number of events with GraphQL query attributes computed
dimensions List of dimensions to group by

ZoneApiGatewayGraphqlQueryAnalyticsGroupsAvg

FieldDescription
sampleInterval Average sample interval

ZoneApiGatewayGraphqlQueryAnalyticsGroupsDimensions

FieldDescription
apiGatewayGraphqlQueryDepth Maximum depth level of a terminal (leaf) field in the query
apiGatewayGraphqlQuerySize Number of terminal (leaf) fields in the query
date
datetime
datetimeDay
datetimeFifteenMinutes
datetimeFiveMinutes
datetimeHalfOfHour
datetimeHour
datetimeMinute

ZoneApiGatewayMatchedSessionIDsAdaptiveGroups

Beta. Aggregated count of Session Identifier matches

FieldDescription
avg
count Number of events with Session Identifiers
dimensions List of dimensions to group by

ZoneApiGatewayMatchedSessionIDsAdaptiveGroupsAvg

FieldDescription
sampleInterval Average sample interval

ZoneApiGatewayMatchedSessionIDsAdaptiveGroupsDimensions

FieldDescription
apiGatewayMatchedSessionIdentifierName Name of session identifier
apiGatewayMatchedSessionIdentifierType Type of session identifier. Possible values are header | cookie
date
datetime
datetimeDay
datetimeFifteenMinutes
datetimeFiveMinutes
datetimeHalfOfHour
datetimeHour
datetimeMinute

ZoneApiGatewayMatchedSessionIDsPerEndpointAdaptiveGroups

Beta. Aggregated count of Session Identifier matches per endpoint

FieldDescription
avg
count Number of events per dimension
dimensions List of dimensions to group by

ZoneApiGatewayMatchedSessionIDsPerEndpointAdaptiveGroupsAvg

FieldDescription
sampleInterval Average sample interval

ZoneApiGatewayMatchedSessionIDsPerEndpointAdaptiveGroupsDimensions

FieldDescription
apiGatewayMatchedEndpoint Id of the matched API endpoint
apiGatewayMatchedSessionIdentifier Array of observed tuples consisting of session identifier types and names. Possible types are header | cookie | jwt
date
datetime
datetimeDay
datetimeFifteenMinutes
datetimeFiveMinutes
datetimeHalfOfHour
datetimeHour
datetimeMinute
responseStatusCode HTTP status code returned by edge

ZoneApiRequestSequencesGroups

Sequences of API endpoint operations. Sequences are learned by grouping requests by AuthID. Correlation scores are estimated over a 24 hour window and are current to within 10 minutes

FieldDescription
aggArgMax
aggMax
dimensions List of dimensions to group by
uniq

ZoneApiRequestSequencesGroupsAggArgMax

FieldDescription
correlation Correlation score estimated over a 24 hour window. The correlation score is the probability that the last operation in the sequence is preceded by the remaining operations in the sequence, assuming that the last operation in the sequence occurred
numOccurrences Estimated number of occurrences of this sequence of endpoint operations
numOccurrencesLast Estimated number of occurrences of the last operation in this sequence of endpoint operations
numOccurrencesPrefix Estimated number of occurrences of this sequence of endpoint operations, disregarding the last operation
numOccurrencesSuffix DEPRECATED (Field is not guaranteed to be always populated for sequences of length greater than 2. Use numOccurrencesLast instead): Estimated number of occurrences of this sequence of endpoint operations, disregarding the first operation
operationsApiEndpoints API endpoints in the sequence of operations. Individual endpoints are delimited by # symbols
operationsClientRequestHTTPMethods HTTP request methods in the sequence of operations. Individual request method names are delimited by # symbols
samplingFraction Fraction of requests sampled

ZoneApiRequestSequencesGroupsAggMax

FieldDescription
timeLastSeen Time of the most recent occurrence of this sequence of endpoint operations (based on the timestamp of the first request in the sequence)
timeLastUpdated The time at which Cloudflare last refreshed this data

ZoneApiRequestSequencesGroupsDimensions

FieldDescription
apiHost The host associated with this sequence of endpoint operations
clientRequestHTTPHost DEPRECATED (Field is replaced with apiHost): The host associated with this sequence of endpoint operations
datetime Sequence generation timeslot, truncated to 10 minutes
operationsFirstApiEndpoint First API endpoint in the sequence of operations
operationsFirstClientRequestHTTPMethod First HTTP request method in the sequence of operations
operationsLastApiEndpoint Last API endpoint in the sequence of operations
operationsLastClientRequestHTTPMethod Last HTTP request method in the sequence of operations
operationsLength Length of the sequence of operations
operationsPrefixApiEndpoints API endpoints in the sequence of operations, disregarding the last operation. Individual endpoints are delimited by # symbols
operationsPrefixClientRequestHTTPMethods HTTP request methods in the sequence of operations, disregarding the last operation. Individual request method names are delimited by # symbols
rank DEPRECATED (Field is replaced with sequenceHash serving as unique sequence identifier): Sequence rank based on ordering sequences by correlation
sequenceHash Unique sequence identifier obtained by hashing operationsApiEndpoints and operationsClientRequestHTTPMethods

ZoneApiRequestSequencesGroupsUniq

FieldDescription
rankCount Number of unique rank values
sequenceHashCount Number of unique sequenceHash values

ZoneCacheReserveOperationsAdaptiveGroups

Beta. Cache Reserve operations with adaptive sampling

FieldDescription
avg The average value used for sample interval
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

ZoneCacheReserveOperationsAdaptiveGroupsAvg

FieldDescription
sampleInterval

ZoneCacheReserveOperationsAdaptiveGroupsDimensions

FieldDescription
actionStatus Status of the R2 operation
bucketName Name of bucket containing stored objects
date Request timestamp, truncated to start of a day
datetime Request timestamp
datetimeFifteenMinutes Request timestamp, truncated to multiple of 15 minutes
datetimeFiveMinutes Request timestamp, truncated to multiple of 5 minutes
datetimeHour Request timestamp, truncated to start of an hour
datetimeMinute Request timestamp, truncated to start of an minute
jurisdiction Jurisdiction of the R2 bucket, or 'default' if unrestricted
operationClass Billable class of storage operation

ZoneCacheReserveOperationsAdaptiveGroupsSum

FieldDescription
requests Sum of Requests

ZoneCacheReserveRequestsAdaptiveGroups

Cache Reserve HTTP requests data with adaptive sampling

FieldDescription
avg The average value used for sample interval
count
dimensions List of dimensions to group by
sum Sum of bytes returned to client

ZoneCacheReserveRequestsAdaptiveGroupsAvg

FieldDescription
sampleInterval

ZoneCacheReserveRequestsAdaptiveGroupsDimensions

FieldDescription
cacheStatus Cache status
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute
edgeResponseContentTypeName Content type returned to client
edgeResponseStatus HTTP response status code returned to browser

ZoneCacheReserveRequestsAdaptiveGroupsSum

FieldDescription
edgeResponseBytes

ZoneCacheReserveStorageAdaptiveGroups

Beta. Cache Reserve storage with adaptive sampling

FieldDescription
avg The average value used for sample interval
dimensions List of dimensions to group by
max The max of values for a metric per dimension

ZoneCacheReserveStorageAdaptiveGroupsAvg

FieldDescription
sampleInterval

ZoneCacheReserveStorageAdaptiveGroupsDimensions

FieldDescription
bucketHash Hash of bucket containing stored objects
bucketName Name of bucket containing stored objects
date Storage sample timestamp, truncated to start of a day
datetime Storage sample timestamp
datetimeFifteenMinutes Storage sample timestamp, truncated to multiple of 15 minutes
datetimeFiveMinutes Storage sample timestamp, truncated to multiple of 5 minutes
datetimeHour Storage sample timestamp, truncated to start of an hour
datetimeMinute Storage sample timestamp, truncated to start of an minute
jurisdiction Jurisdiction of the R2 bucket, or 'default' if unrestricted

ZoneCacheReserveStorageAdaptiveGroupsMax

FieldDescription
objectCount Max of object count
storedBytes Payload and metadata size of objects in bucket

ZoneDmarcReportsAdaptive

Dmarc report records with adaptive sampling

FieldDescription
datetime The date and time the source email was received
disposition DMARC policy disposition
dkim DKIM result
domain Domain to which this report refers to
envelopeFrom Envelope From of emails
envelopeTo Envelope To of emails
evaluatedReason Reason (if any) why the record was evaluated
headerFrom Header From of emails
matchingMessages Number of messages that matched
orgName Organization that generated report
policyDKIMAlignmentMode DKIM alignment mode specified in the policy
policyDomain DMARC policy of the domain
policyPercentage Percentage of emails that should be checked
policySPFAlignmentMode SPF alignment mode specified in the policy
policySubDomain DMARC policy of subdomains
recordId Unique identifier of this record
recordIndex Index of this record within the report
reportBegin Start of the reporting period
reportEnd End of the reporting period
reportError Error message (if any)
reportId Unique identifier of the report to which this record belongs
sampleInterval ABR sample interval
sourceIP Source IP address of the email
sourceLocationName Country name from source IP
sourceOrgName Source IP address organisation name
sourceOrgSlug Source IP address organisation slug
sourcePTR Source Domain from IP address
spf SPF result
spfMFromDomain Checked domain from scope mfrom

ZoneDmarcReportsSourcesAdaptiveGroups

Aggregated dmarc reports by sources logs with adaptive sampling

FieldDescription
avg Beta. The avg of values for a metric per dimension
dimensions List of dimensions to group by
sum
uniq

ZoneDmarcReportsSourcesAdaptiveGroupsAvg

FieldDescription
dkimPass Percentage of dkim messages pass
dmarc Percentage of dmarc messages pass
spfPass Percentage of spf messages pass

ZoneDmarcReportsSourcesAdaptiveGroupsDimensions

FieldDescription
date The date the source email was received
datetimeDay The date and time the source email was received truncated to the day
datetimeHour The date and time the source email was received truncated to the hour
datetimeLast31Days The date and time the source email was received truncated to the last 31 days
datetimeMonth The date and time the source email was received truncated to the month
datetimeWeek The date and time the source email was received truncated to the week
disposition DMARC policy disposition
dkim DKIM result
domain Domain to which this report refers to
envelopeFrom Envelope From of emails
envelopeTo Envelope To of emails
evaluatedReason Reason (if any) why the record was evaluated
headerFrom Header From of emails
orgName Organization that generated report
sampleInterval ABR sample interval
sourceIP Source IP address of the email
sourceLocationName Country name from source IP
sourceOrgName Source IP address organisation name
sourceOrgSlug Source IP address organisation slug
sourcePTR Source Domain from IP address
spf SPF result
spfMFromDomain Checked domain from scope mfrom

ZoneDmarcReportsSourcesAdaptiveGroupsSum

FieldDescription
dkimPass Total of dkim messages pass
dmarc Total of dmarc messages pass
spfPass Total of spf messages pass
totalMatchingMessages Total matching messages

ZoneDmarcReportsSourcesAdaptiveGroupsUniq

FieldDescription
ipCount Number of distinct IPs

ZoneDnsAnalyticsAdaptive

Analytics data for DNS queries

FieldDescription
coloName IATA airport code of the data center that processed the query
date Date on which the query was received
datetime Time at which the query was received
destinationIP Cloudflare edge IP address that the query was received at
ipVersion Internet Protocol version over which the query was received
protocol Transport protocol over which the query was received
queryName DNS query name without trailing dot
querySize Size of the DNS query in bytes
queryType DNS query type
responseCached Whether the DNS response was served from cache
responseCode DNS response code
responseSize Size of the DNS response in bytes
responseStale Whether a stale DNS response was served from cache
sampleInterval ABR sample interval
sourceIP IP address of the client that sent the query (usually this is the resolver's IP address)
upstreamIP Upstream server that the query was forwarded to

ZoneDnsAnalyticsAdaptiveGroups

Analytics data for DNS queries

FieldDescription
avg Average of a metric per dimension
count Number of queries per dimension
dimensions List of dimensions to group by
quantiles Quantiles of a metric per dimension

ZoneDnsAnalyticsAdaptiveGroupsAvg

FieldDescription
processingTimeUs Average processing time in microseconds
sampleInterval Average sample interval

ZoneDnsAnalyticsAdaptiveGroupsDimensions

FieldDescription
coloName IATA airport code of the data center that processed the query
date Date on which the query was received
datetime Time at which the query was received
datetimeFifteenMinutes Time at which the query was received, truncated to multiple of 15 minutes
datetimeFiveMinutes Time at which the query was received, truncated to multiple of 5 minutes
datetimeHalfOfHour Time at which the query was received, truncated to multiple of 30 minutes
datetimeHour Time at which the query was received, truncated to the hour
datetimeMinute Time at which the query was received, truncated to the minute
destinationIP Cloudflare edge IP address that the query was received at
ipVersion Internet Protocol version over which the query was received
protocol Transport protocol over which the query was received
queryName DNS query name without trailing dot
querySizeBucket Size of the DNS query in bytes (in multiples of 16)
queryType DNS query type
responseCached Whether the DNS response was served from cache
responseCode DNS response code
responseSizeBucket Size of the DNS response in bytes (in multiples of 16)
responseStale Whether a stale DNS response was served from cache
sourceIP IP address of the client that sent the query (usually this is the resolver's IP address)
upstreamIP Upstream server that the query was forwarded to

ZoneDnsAnalyticsAdaptiveGroupsQuantiles

FieldDescription
processingTimeUsP50 50th percentile processing time in microseconds (median)
processingTimeUsP90 90th percentile processing time in microseconds
processingTimeUsP99 99th percentile processing time in microseconds

ZoneEmailRoutingAdaptive

Beta. Raw email routing logs with adaptive sampling

FieldDescription
datetime The date and time the source email was received
dkim DKIM check status of the source email
dmarc DMARC check status of the source email
errorDetail Detailed error message (if any)
from The sender email address of the source email
isNDR Is this event related to a NDR (bounce) email?
messageId The Message-ID header of the source email (if present)
ruleMatched The UUID of the routing rule matched by the source email
sampleInterval ABR sample interval
sessionId Unique identifier for the email log entry (note: retries for the same email may result in multiple log entries)
spf SPF check status of the source email
status The resulting outcome (action) for the email
subject The subject of the source email
to The recipient email address of the source email

ZoneEmailRoutingAdaptiveGroups

Beta. Aggregated email routing logs with adaptive sampling

FieldDescription
count Number of emails processed
dimensions List of dimensions to group by

ZoneEmailRoutingAdaptiveGroupsDimensions

FieldDescription
date The date the source email was received
datetimeFifteenMinutes The date and time the source email was received truncated to fifteen minutes
datetimeFiveMinutes The date and time the source email was received truncated to five minutes
datetimeHour The date and time the source email was received truncated to the hour
datetimeMinute The date and time the source email was received truncated to the minute
dkim DKIM check status of the source email
dmarc DMARC check status of the source email
isNDR Is this event related to a NDR (bounce) email?
ruleMatched The UUID of the routing rule matched by the source email
sampleInterval ABR sample interval
spf SPF check status of the source email
status The resulting outcome (action) for the email

ZoneFilter_InputObject

FieldDescription

ZoneFirewallEventsAdaptive

Raw Firewall events with adaptive sampling

FieldDescription
action The code of the first-class action the Cloudflare Firewall took on this request
apiGatewayMatchedEndpoint API Gateway endpoint matched at the edge
apiGatewayMatchedHost API Gateway host matched at the edge
botDetectionIds Array of detections ids that matched this request
botDetectionTags Array of detections tags that matched this request
botScore The final score originated from bot management detections.
botScoreSrcName Name of the source detection which generated the bot management score.
clientASNDescription The ASN of the visitor as string
clientAsn The ASN number of the visitor
clientCountryName Country from which request originated
clientIP The visitor's IP address (IPv4 or IPv6)
clientIPClass The classification of the visitor's IP address, possible values are: unknown | clean | badHost | searchEngine | allowlist | greylist | monitoringService | securityScanner | noRecord | scan | backupService | mobilePlatform | tor
clientRefererHost The referer host
clientRefererPath The referer path requested by visitor
clientRefererQuery The referer query-string was requested by the visitor
clientRefererScheme The referer url scheme requested by the visitor
clientRequestHTTPHost The HTTP hostname requested by the visitor
clientRequestHTTPMethodName The HTTP method used by the visitor
clientRequestHTTPProtocol The version of HTTP protocol requested by the visitor
clientRequestPath The path requested by visitor
clientRequestQuery The query-string was requested by the visitor
clientRequestScheme The url scheme requested by the visitor
contentScanHasFailed 1 if not all contents for this request where successfully scanned, else 0
contentScanNumMaliciousObj Number of scannable content objects that are malicious
contentScanNumObj Number of scannable content objects
contentScanObjResults Array of scan results in order of detection
contentScanObjSizes Array of scan sizes in order of detection
contentScanObjTypes Array of content types in order of detection
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute
description The description of the rule triggered by this request
edgeColoName The airport code of the Cloudflare datacenter that served this request
edgeResponseStatus HTTP response status code returned to browser
httpApplicationVersion DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application
ja3Hash MD5 hash of the JA3 TLS fingerprint
ja4 JA4 TLS fingerprint
ja4Signals Inter-request statistics computed for this JA4 across Cloudflare's entire global edge network
kind The kind of event, currently only possible values are: firewall
leakedCredentialCheckResult The distinct result of checking for leaked credentials
matchIndex Rules match index in the chain
metadata Additional product-specific information. Metadata is organized in key:value pairs
originResponseStatus HTTP origin response status code returned to browser
originatorRayName The RayId of the request that issued the challenge/jschallenge
rayName The RayId of the request
ref The ref-field is a user-defined rule identifier that can be set via the API for some firewall products and allows users to label their rules individually alongside cloudflare provided identifiers (only available to entitled customers)
ruleId The Cloudflare security product-specific RuleId triggered by this request
rulesetId The Cloudflare security product-specific RulesetId triggered by this request
sampleInterval ABR sample interval
source The Cloudflare security product triggered by this request
userAgent visitor's user-agent string
wafAttackScore Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass Beta. Overall request score class generated by the WAF detection module
wafMlAttackScore DEPRECATED (Field is replaced with wafAttackScore): Beta. Overall request score generated by the WAF detection module
wafMlSqliAttackScore DEPRECATED (Field is replaced with wafSqliAttackScore): Beta. WAF ML score for an SQLi attack
wafMlXssAttackScore DEPRECATED (Field is replaced with wafXssAttackScore): Beta. WAF ML score for an XSS attack
wafRceAttackScore Beta. WAF score for a RCE attack
wafSqliAttackScore Beta. WAF score for a SQLi attack
wafXssAttackScore Beta. WAF score for a XSS attack
zoneVersion The version of a zone

ZoneFirewallEventsAdaptiveByTimeGroups

Aggregated Firewall events with adaptive sampling grouped by time

FieldDescription
avg The average value used for sample interval
count The sum of sample interval values
dimensions List of dimensions to group by
sum

ZoneFirewallEventsAdaptiveByTimeGroupsAvg

FieldDescription
sampleInterval

ZoneFirewallEventsAdaptiveByTimeGroupsDimensions

FieldDescription
apiGatewayMatchedEndpoint API Gateway endpoint matched at the edge
apiGatewayMatchedHost API Gateway host matched at the edge
botDetectionIds Array of detections ids that matched this request
botDetectionTags Array of detections tags that matched this request
botScore The final score originated from bot management detections.
botScoreSrcName Name of the source detection which generated the bot management score.
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute
description The description of the rule triggered by this request
httpApplicationVersion DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application
ja3Hash MD5 hash of the JA3 TLS fingerprint
ja4 JA4 TLS fingerprint
wafAttackScore Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass Beta. Overall request score class generated by the WAF detection module
wafMlAttackScore DEPRECATED (Field is replaced with wafAttackScore): Beta. Overall request score generated by the WAF ML detection module
wafMlSqliAttackScore DEPRECATED (Field is replaced with wafSqliAttackScore): Beta. WAF ML score for an SQLi attack
wafMlXssAttackScore DEPRECATED (Field is replaced with wafXssAttackScore): Beta. WAF ML score for an XSS attack
wafRceAttackScore Beta. WAF score for a RCE attack
wafSqliAttackScore Beta. WAF score for a SQLi attack
wafXssAttackScore Beta. WAF score for a XSS attack
zoneVersion The version of a zone

ZoneFirewallEventsAdaptiveByTimeGroupsSum

FieldDescription
botDetectionIdArray Array of bot management detection ids
botDetectionIdCountArray Count array of bot management detection ids. Elements in this array correspond to elements in botDetectionIdArray by index.
botDetectionTagArray Array of bot management detection tags
botDetectionTagCountArray Count array of bot management detection tags. Elements in this array correspond to elements in botDetectionTagArray by index.

ZoneFirewallEventsAdaptiveGroups

Aggregated Firewall events with adaptive sampling

FieldDescription
avg The average value used for sample interval
count The sum of sample interval values
dimensions List of dimensions to group by
sum

ZoneFirewallEventsAdaptiveGroupsAvg

FieldDescription
sampleInterval

ZoneFirewallEventsAdaptiveGroupsDimensions

FieldDescription
action The code of the first-class action the Cloudflare Firewall took on this request
apiGatewayMatchedEndpoint API Gateway endpoint matched at the edge
apiGatewayMatchedHost API Gateway host matched at the edge
botDetectionIds Array of detections ids that matched this request
botDetectionTags Array of detections tags that matched this request
botScore The final score originated from bot management detections.
botScoreSrcName Name of the source detection which generated the bot management score.
clientASNDescription The ASN of the visitor as string
clientAsn The ASN number of the visitor
clientCountryName Country from which request originated
clientIP The visitor's IP address (IPv4 or IPv6)
clientIPClass The classification of the visitor's IP address, possible values are: unknown | clean | badHost | searchEngine | allowlist | greylist | monitoringService | securityScanner | noRecord | scan | backupService | mobilePlatform | tor
clientRefererHost The referer host
clientRefererPath The referer path requested by visitor
clientRefererQuery The referer query-string was requested by the visitor
clientRefererScheme The referer url scheme requested by the visitor
clientRequestHTTPHost The HTTP hostname requested by the visitor
clientRequestHTTPMethodName The HTTP method used by the visitor
clientRequestHTTPProtocol The version of HTTP protocol requested by the visitor
clientRequestPath The path requested by visitor
clientRequestQuery The query-string was requested by the visitor
clientRequestScheme The url scheme requested by the visitor
contentScanHasFailed 1 if not all contents for this request where successfully scanned, else 0
contentScanNumMaliciousObj Number of scannable content objects that are malicious
contentScanNumObj Number of scannable content objects
contentScanObjResults Array of scan results in order of detection
contentScanObjSizes Array of scan sizes in order of detection
contentScanObjTypes Array of content types in order of detection
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute
description The description of the rule triggered by this request
edgeColoName The airport code of the Cloudflare datacenter that served this request
edgeResponseStatus HTTP response status code returned to browser
httpApplicationVersion DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application
ja3Hash MD5 hash of the JA3 TLS fingerprint
ja4 JA4 TLS fingerprint
kind The kind of event, currently only possible values are: firewall
matchIndex Rules match index in the chain
originResponseStatus HTTP origin response status code returned to browser
originatorRayName The RayId of the request that issued the challenge/jschallenge
rayName The RayId of the request
ref The ref-field is a user-defined rule identifier that can be set via the API for some firewall products and allows users to label their rules individually alongside cloudflare provided identifiers (only available to entitled customers)
ruleId The Cloudflare security product-specific RuleId triggered by this request
rulesetId The Cloudflare security product-specific RulesetId triggered by this request
sampleInterval ABR sample interval
source The Cloudflare security product triggered by this request
userAgent visitor's user-agent string
wafAttackScore Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass Beta. Overall request score class generated by the WAF detection module
wafMlAttackScore DEPRECATED (Field is replaced with wafAttackScore): Beta. Overall request score generated by the WAF ML detection module
wafMlSqliAttackScore DEPRECATED (Field is replaced with wafSqliAttackScore): Beta. WAF ML score for an SQLi attack
wafMlXssAttackScore DEPRECATED (Field is replaced with wafXssAttackScore): Beta. WAF ML score for an XSS attack
wafRceAttackScore Beta. WAF score for a RCE attack
wafSqliAttackScore Beta. WAF score for a SQLi attack
wafXssAttackScore Beta. WAF score for a XSS attack
zoneVersion The version of a zone

ZoneFirewallEventsAdaptiveGroupsSum

FieldDescription
botDetectionIdArray Array of bot management detection ids
botDetectionIdCountArray Count array of bot management detection ids. Elements in this array correspond to elements in botDetectionIdArray by index.
botDetectionTagArray Array of bot management detection tags
botDetectionTagCountArray Count array of bot management detection tags. Elements in this array correspond to elements in botDetectionTagArray by index.

ZoneFirewallEventsAdaptiveJa4SignalsElem

FieldDescription
signalName Signal name
signalValue Signal value

ZoneFirewallEventsAdaptiveMetadataElem

FieldDescription
key The key of the metadata. Key format can vary by Cloudflare security product and can change over time.
value The value of the metadata. Value format can vary by Cloudflare security product and can change over time.

ZoneHealthCheckEventsAdaptive

Raw Health Check events with adaptive sampling

FieldDescription
date The date the event was written to the database
datetime The date and time the event was written to the database
eventId The event id that created this healthcheck event
expectedResponseCodes The expected response codes for the health check
failureReason Reason why the health check failed
fqdn Fully qualified domain name of the origin (if available)
healthChanged 1 if the origin health status has changed since the last health check, 0 otherwise
healthCheckId A unique identifier for the health check
healthCheckName Human-identifiable health check name
healthStatus Origin health status
originIP IP address of the origin
originResponseStatus HTTP status code returned by the origin
region Region where the health check occurred
rttMs RTT (milliseconds) to reach the origin
sampleInterval ABR sample interval
scope Geographic aggregation level of the health status
tcpConnMs Time taken for the tcp connection to be established
timeToFirstByteMs Time taken for the first byte to be received once connection is available
tlsHandshakeMs Time taken for the tls handshake to be completed

ZoneHealthCheckEventsAdaptiveGroups

Aggregated Health Check events with adaptive sampling

FieldDescription
avg The average value for a metric
count The number of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

ZoneHealthCheckEventsAdaptiveGroupsAvg

FieldDescription
rttMs Average RTT (milliseconds)
sampleInterval Average sample interval
tcpConnMs Average TCP Connection time (milliseconds)
timeToFirstByteMs Average Time To First Byte (milliseconds)
tlsHandshakeMs Average TLS Handshake time (milliseconds)

ZoneHealthCheckEventsAdaptiveGroupsDimensions

FieldDescription
date The date the event was written to the database
datetime Datetime the event was written to the database
datetimeFifteenMinutes Datetime the event was written to the database truncated to a multiple of 15 minutes
datetimeFiveMinutes Datetime the event was written to the database truncated to a multiple of 5 minutes
datetimeHour Datetime the event was written to the database truncated to the hour
datetimeMinute Datetime the event was written to the database truncated to the minute
failureReason Reason why the health check failed
fqdn Fully qualified domain name of the origin (if available)
healthChanged 1 if the origin health status has changed since the last health check, 0 otherwise
healthCheckId A unique identifier for the health check
healthCheckName Human-identifiable health check name
healthStatus Origin health status
originIP IP address of the origin
originResponseStatus HTTP status code returned by the origin
region Region where the health check occurred
rttMs RTT (milliseconds) to reach the origin
sampleInterval ABR sample interval
scope Geographic aggregation level of the health status
tcpConnMs Time taken for the tcp connection to be established
timeToFirstByteMs Time taken for the first byte to be received once connection is available
tlsHandshakeMs Time taken for the tls handshake to be completed

ZoneHealthCheckEventsAdaptiveGroupsSum

FieldDescription
healthStatus

ZoneHttpRequests1dByColoGroups

Daily rollups of request data by colo

FieldDescription
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

ZoneHttpRequests1dByColoGroupsCountryMapElem

FieldDescription
clientCountryName Country from which request originated
requests
threats Requests classified as threats

ZoneHttpRequests1dByColoGroupsDimensions

FieldDescription
coloCode Code of edge server
date Request date

ZoneHttpRequests1dByColoGroupsResponseStatusMapElem

FieldDescription
edgeResponseStatus HTTP response status code returned to client
requests

ZoneHttpRequests1dByColoGroupsSum

FieldDescription
bytes Bytes returned to client
cachedBytes Bytes returned to client from cache
cachedRequests Requests served from cache
countryMap
requests
responseStatusMap
threatPathingMap

ZoneHttpRequests1dByColoGroupsThreatPathingMapElem

FieldDescription
requests
threatPathingName Threat type

ZoneHttpRequests1dGroups

Daily rollups of request data

FieldDescription
avg The average value for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension
uniq The number of unique values for a metric per dimension

ZoneHttpRequests1dGroupsAvg

FieldDescription
bytes
sampleInterval Average sample interval

ZoneHttpRequests1dGroupsBrowserMapElem

FieldDescription
pageViews Successful requests for HTML content
uaBrowserFamily Browser type

ZoneHttpRequests1dGroupsClientHTTPVersionMapElem

FieldDescription
clientHTTPProtocol HTTP version
requests

ZoneHttpRequests1dGroupsClientSSLMapElem

FieldDescription
clientSSLProtocol Protocol version
requests

ZoneHttpRequests1dGroupsContentTypeMapElem

FieldDescription
bytes Bytes returned to client
edgeResponseContentTypeName Content type returned to client
requests

ZoneHttpRequests1dGroupsCountryMapElem

FieldDescription
bytes Bytes returned to client
clientCountryName Country from which request originated
requests
threats Requests classified as threats

ZoneHttpRequests1dGroupsDimensions

FieldDescription
date Request date

ZoneHttpRequests1dGroupsIpClassMapElem

FieldDescription
ipType IP class
requests

ZoneHttpRequests1dGroupsResponseStatusMapElem

FieldDescription
edgeResponseStatus HTTP response status code returned to client
requests

ZoneHttpRequests1dGroupsSum

FieldDescription
browserMap
bytes Bytes returned to client
cachedBytes Bytes returned to client from cache
cachedRequests Requests served from cache
clientHTTPVersionMap
clientSSLMap
contentTypeMap
countryMap
encryptedBytes Bytes returned to client using SSL/TLS protocol
encryptedRequests Requests served using SSL/TLS protocol
ipClassMap
pageViews Successful requests for HTML content
requests
responseStatusMap
threatPathingMap
threats Requests classified as threats

ZoneHttpRequests1dGroupsThreatPathingMapElem

FieldDescription
requests
threatPathingName Threat type

ZoneHttpRequests1dGroupsUniq

FieldDescription
uniques A number of unique IPs

ZoneHttpRequests1hGroups

Hourly rollups of request data

FieldDescription
avg The average value for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension
uniq The number of unique values for a metric per dimension

ZoneHttpRequests1hGroupsAvg

FieldDescription
bytes
sampleInterval Average sample interval

ZoneHttpRequests1hGroupsBrowserMapElem

FieldDescription
pageViews Successful requests for HTML content
uaBrowserFamily Browser type

ZoneHttpRequests1hGroupsClientHTTPVersionMapElem

FieldDescription
clientHTTPProtocol HTTP version
requests

ZoneHttpRequests1hGroupsClientSSLMapElem

FieldDescription
clientSSLProtocol Protocol version
requests

ZoneHttpRequests1hGroupsContentTypeMapElem

FieldDescription
bytes Bytes returned to client
edgeResponseContentTypeName Content type returned to client
requests

ZoneHttpRequests1hGroupsCountryMapElem

FieldDescription
bytes Bytes returned to client
clientCountryName Country from which request originated
requests
threats Requests classified as threats

ZoneHttpRequests1hGroupsDimensions

FieldDescription
date Request date
datetime Request datetime truncated to the hour

ZoneHttpRequests1hGroupsIpClassMapElem

FieldDescription
ipType IP class
requests

ZoneHttpRequests1hGroupsResponseStatusMapElem

FieldDescription
edgeResponseStatus HTTP response status code returned to client
requests

ZoneHttpRequests1hGroupsSum

FieldDescription
browserMap
bytes Bytes returned to client
cachedBytes Bytes returned to client from cache
cachedRequests Requests served from cache
clientHTTPVersionMap
clientSSLMap
contentTypeMap
countryMap
encryptedBytes Bytes returned to client using SSL/TLS protocol
encryptedRequests Requests served using SSL/TLS protocol
ipClassMap
pageViews Successful requests for HTML content
requests
responseStatusMap
threatPathingMap
threats Requests classified as threats

ZoneHttpRequests1hGroupsThreatPathingMapElem

FieldDescription
requests
threatPathingName Threat type

ZoneHttpRequests1hGroupsUniq

FieldDescription
uniques A number of unique IPs

ZoneHttpRequests1mByColoGroups

Minutely rollups of request data by colo

FieldDescription
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

ZoneHttpRequests1mByColoGroupsCountryMapElem

FieldDescription
clientCountryName Country from which request originated
requests
threats Requests classified as threats

ZoneHttpRequests1mByColoGroupsDimensions

FieldDescription
coloCode Code of edge server
date Request date
datetime Request datetime
datetimeFifteenMinutes Request datetime truncated to multiple of 15 minutes
datetimeHalfOfHour Request datetime truncated to multiple of 30 minutes
datetimeHour Request datetime truncated to the hour

ZoneHttpRequests1mByColoGroupsResponseStatusMapElem

FieldDescription
edgeResponseStatus HTTP response status code returned to client
requests

ZoneHttpRequests1mByColoGroupsSum

FieldDescription
bytes Bytes returned to client
cachedBytes Bytes returned to client from cache
cachedRequests Requests served from cache
countryMap
requests
responseStatusMap
threatPathingMap

ZoneHttpRequests1mByColoGroupsThreatPathingMapElem

FieldDescription
requests
threatPathingName Threat type

ZoneHttpRequests1mGroups

Minutely rollups of request data

FieldDescription
avg The average value for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension
uniq The number of unique values for a metric per dimension

ZoneHttpRequests1mGroupsAvg

FieldDescription
bytes
sampleInterval Average sample interval

ZoneHttpRequests1mGroupsBrowserMapElem

FieldDescription
pageViews Successful requests for HTML content
uaBrowserFamily Browser type

ZoneHttpRequests1mGroupsClientHTTPVersionMapElem

FieldDescription
clientHTTPProtocol HTTP version
requests

ZoneHttpRequests1mGroupsClientSSLMapElem

FieldDescription
clientSSLProtocol Protocol version
requests

ZoneHttpRequests1mGroupsContentTypeMapElem

FieldDescription
bytes Bytes returned to client
edgeResponseContentTypeName Content type returned to client
requests

ZoneHttpRequests1mGroupsCountryMapElem

FieldDescription
bytes Bytes returned to client
clientCountryName Country from which request originated
requests
threats Requests classified as threats

ZoneHttpRequests1mGroupsDimensions

FieldDescription
date Request date
datetime Request datetime, truncated to the minute
datetimeDay Request datetime truncated to the day
datetimeFifteenMinutes Request datetime truncated to multiple of 15 minutes
datetimeFiveMinutes Request datetime truncated to multiple of 5 minutes
datetimeHalfOfHour Request datetime truncated to multiple of 30 minutes
datetimeHour Request datetime truncated to the hour
datetimeMinute DEPRECATED (Field is replaced with datetime): Request datetime truncated to the minute

ZoneHttpRequests1mGroupsIpClassMapElem

FieldDescription
ipType IP class
requests

ZoneHttpRequests1mGroupsResponseStatusMapElem

FieldDescription
edgeResponseStatus HTTP response status code returned to client
requests

ZoneHttpRequests1mGroupsSum

FieldDescription
browserMap
bytes Bytes returned to client
cachedBytes Bytes returned to client from cache
cachedRequests Requests served from cache
clientHTTPVersionMap
clientSSLMap
contentTypeMap
countryMap
encryptedBytes Bytes returned to client using SSL/TLS protocol
encryptedRequests Requests served using SSL/TLS protocol
ipClassMap
pageViews Successful requests for HTML content
requests
responseStatusMap
threatPathingMap
threats Requests classified as threats

ZoneHttpRequests1mGroupsThreatPathingMapElem

FieldDescription
requests
threatPathingName Threat type

ZoneHttpRequests1mGroupsUniq

FieldDescription
uniques A number of unique IPs

ZoneHttpRequestsAdaptive

Raw HTTP requests with adaptive sampling

FieldDescription
apiGatewayMatchedEndpoint API Gateway endpoint matched at the edge
apiGatewayMatchedHost API Gateway host matched at the edge
botDetectionIds Array of detections ids that matched this request
botDetectionTags Array of detections tags that matched this request
botManagementDecision Judgement of the bot management system
botScore The final score originated from bot management detections.
botScoreBucketBy10 Range of the bot management score
botScoreSrcName Name of the source detection which generated the bot management score.
cacheReserveUsed Used Cache Reserve to serve the response
cacheStatus Cache status
clientASNDescription The ASN of the visitor as string
clientAsn The ASN number of the visitor
clientCountryName Country from which request originated
clientDeviceType
clientIP The visitor's IP address (IPv4 or IPv6)
clientRefererHost The referrer host
clientRequestHTTPHost The HTTP hostname requested by the visitor
clientRequestHTTPMethodName HTTP method of client request
clientRequestHTTPProtocol The version of HTTP protocol requested by the visitor
clientRequestPath The path requested by visitor
clientRequestQuery Query parameters of client request
clientRequestReferer HTTP request referrer
clientRequestScheme The url scheme requested by the visitor
clientSSLProtocol SSL protocol version
coloCode
contentScanHasFailed 1 if not all contents for this request where successfully scanned, else 0
contentScanNumMaliciousObj Number of scannable content objects that are malicious
contentScanNumObj Number of scannable content objects
contentScanObjResults Array of scan results in order of detection
contentScanObjSizes Array of scan sizes in order of detection
contentScanObjTypes Array of content types in order of detection
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute
edgeDnsResponseTimeMs The time elapsed resolving a CNAME if it was required to reach your origin
edgeResponseContentTypeName
edgeResponseStatus HTTP response status code returned to browser
edgeTimeToFirstByteMs The time elapsed between processing the first byte of the request until when we started sending a response
httpApplicationVersion DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application
isCrossZoneSubrequest '1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise.
ja3Hash MD5 hash of the JA3 TLS fingerprint
ja4 JA4 TLS fingerprint
ja4Signals Inter-request statistics computed for this JA4 across Cloudflare's entire global edge network
leakedCredentialCheckResult The distinct result of checking for leaked credentials
originASN
originASNDescription ASN associated with origin
originIP
originResponseDurationMs
originResponseStatus HTTP origin response status code returned to browser
rayName The RayId of the request
requestSource
securityAction The code of the first-class action the Cloudflare Firewall took on this request
securitySource The Cloudflare security product triggered by this request
upperTierColoName
userAgent visitor's user-agent string
userAgentBrowser Browser parsed from the user agent
userAgentOS OS parsed from the user agent
wafAttackScore Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass Beta. Overall request score class generated by the WAF detection module
wafRceAttackScore Beta. WAF score for a RCE attack
wafSqliAttackScore Beta. WAF score for a SQLi attack
wafXssAttackScore Beta. WAF score for a XSS attack
xRequestedWith The X-Requested-With header of the client request
zoneVersion The version of a zone

ZoneHttpRequestsAdaptiveGroups

Aggregated HTTP requests data with adaptive sampling

FieldDescription
avg The average value used for sample interval
confidence ALPHA - DO NOT USE
count The number of values for a metric per dimension
dimensions List of dimensions to group by
quantiles Quantiles of a metric per dimension
ratio The ratio of a range of status codes, between 0 and 1
sum The sum of values for a metric per dimension

ZoneHttpRequestsAdaptiveGroupsAvg

FieldDescription
crossZoneSubrequests The proportion of requests that were inititiated by a Cloudflare Worker on another zone
edgeDnsResponseTimeMs
edgeTimeToFirstByteMs
originResponseDurationMs The average originResponseDuration, in milliseconds, excluding 0 values (i.e. cached ones)
sampleInterval

ZoneHttpRequestsAdaptiveGroupsConfidence

FieldDescription
count The number of values for a metric per dimension, with confidence intervals
level Confidence level that was requested
sum The sum of values for a metric per dimension, with confidence intervals

ZoneHttpRequestsAdaptiveGroupsDimensions

FieldDescription
apiGatewayMatchedEndpoint API Gateway endpoint matched at the edge
apiGatewayMatchedHost API Gateway host matched at the edge
botDetectionIds Array of detections ids that matched this request
botDetectionTags Array of detections tags that matched this request
botManagementDecision Judgement of the bot management system
botScore The final score originated from bot management detections.
botScoreBucketBy10 Range of the bot management score
botScoreSrcName Name of the source detection which generated the bot management score.
cacheReserveUsed Used Cache Reserve to serve the response
cacheStatus
clientASNDescription The ASN of the visitor as string
clientAsn
clientCountryName Country from which request originated
clientDeviceType
clientIP
clientRefererHost The referrer host
clientRequestHTTPHost Host requested by the client
clientRequestHTTPMethodName HTTP method of client request
clientRequestHTTPProtocol HTTP protocol version
clientRequestPath Path of client request
clientRequestQuery Query parameters of client request
clientRequestReferer HTTP request referrer
clientRequestScheme HTTP request URI scheme (http/https)
clientSSLProtocol SSL protocol version
coloCode
contentScanHasFailed 1 if not all contents for this request where successfully scanned, else 0
contentScanNumMaliciousObj Number of scannable content objects that are malicious
contentScanNumObj Number of scannable content objects
contentScanObjResults Array of scan results in order of detection
contentScanObjSizes Array of scan sizes in order of detection
contentScanObjTypes Array of content types in order of detection
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute
edgeDnsResponseTimeMs The time elapsed resolving a CNAME if it was required to reach your origin
edgeResponseContentTypeName
edgeResponseStatus
edgeTimeToFirstByteMs The time elapsed between processing the first byte of the request until when we started sending a response
httpApplicationVersion DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application
isCrossZoneSubrequest '1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise.
ja3Hash MD5 hash of the JA3 TLS fingerprint
ja4 JA4 TLS fingerprint
leakedCredentialCheckResult The distinct result of checking for leaked credentials
originASN
originASNDescription ASN associated with origin
originIP
originResponseDurationMs
originResponseStatus HTTP response status code returned by the origin
requestSource
sampleInterval ABR sample interval
securityAction The code of the first-class action the Cloudflare Firewall took on this request
securitySource The Cloudflare security product triggered by this request
upperTierColoName
userAgent
userAgentBrowser Browser parsed from the user agent
userAgentOS OS parsed from the user agent
wafAttackScore Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass Beta. Overall request score class generated by the WAF detection module
wafRceAttackScore Beta. WAF score for a RCE attack
wafSqliAttackScore Beta. WAF score for a SQLi attack
wafXssAttackScore Beta. WAF score for a XSS attack
xRequestedWith The X-Requested-With header of the client request
zoneVersion The version of a zone

ZoneHttpRequestsAdaptiveGroupsQuantiles

FieldDescription
edgeDnsResponseTimeMsP50 50th percentile DNS Response Time (milliseconds)
edgeDnsResponseTimeMsP95 95th percentile DNS Response Time (milliseconds)
edgeDnsResponseTimeMsP99 99th percentile DNS Response Time (milliseconds)
edgeTimeToFirstByteMsP50 50th percentile Time To First Byte (milliseconds)
edgeTimeToFirstByteMsP95 95th percentile Time To First Byte (milliseconds)
edgeTimeToFirstByteMsP99 99th percentile Time To First Byte (milliseconds)
originResponseDurationMsP50 50th percentile Origin Response Duration (milliseconds)
originResponseDurationMsP95 95th percentile Origin Response Duration (milliseconds)
originResponseDurationMsP99 99th percentile Origin Response Duration (milliseconds)

ZoneHttpRequestsAdaptiveGroupsRatio

FieldDescription
status4xx
status5xx

ZoneHttpRequestsAdaptiveGroupsSum

FieldDescription
botDetectionIdArray Array of bot management detection ids
botDetectionIdCountArray Count array of bot management detection ids. Elements in this array correspond to elements in botDetectionIdArray by index.
botDetectionTagArray Array of bot management detection tags
botDetectionTagCountArray Count array of bot management detection tags. Elements in this array correspond to elements in botDetectionTagArray by index.
crossZoneSubrequests The number of requests that were inititiated by a Cloudflare Worker on another zone
edgeDnsResponseTimeMs
edgeResponseBytes
edgeTimeToFirstByteMs
originResponseDurationMs
visits The number of requests by end-users that were initiated from a different website (i.e. where the request HTTP Referer header does not match the host in the HTTP Host header)

ZoneHttpRequestsAdaptiveGroupsSumConfidence

FieldDescription
edgeResponseBytes Confidence interval for the corresponding point estimate

ZoneHttpRequestsAdaptiveJa4SignalsElem

FieldDescription
signalName Signal name
signalValue Signal value

ZoneHttpRequestsOverviewAdaptiveGroups

A high-level summary of HTTP requests made by end users.

FieldDescription
avg The average value for a metric per dimension
dimensions List of dimensions to group by
ratio The ratio of a metric in comparison to the rest of the traffic, between 0 and 1
sum The sum of values for a metric per dimension

ZoneHttpRequestsOverviewAdaptiveGroupsAvg

FieldDescription
originResponseDurationMs The average originResponseDuration, in milliseconds, excluding 0 values (i.e. cached ones)
sampleInterval Average sample interval

ZoneHttpRequestsOverviewAdaptiveGroupsDimensions

FieldDescription
clientCountryName Country from which request originated
clientRequestHTTPProtocol HTTP protocol version
clientSSLProtocol SSL protocol version
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute
edgeResponseContentTypeName Content type returned to client
edgeResponseStatus HTTP response status code returned to client
httpApplicationVersion DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application
userAgentBrowser Browser parsed from the user agent
zoneVersion The version of a zone

ZoneHttpRequestsOverviewAdaptiveGroupsRatio

FieldDescription
cachedBytes
cachedRequests
encryptedBytes
encryptedRequests
status4xx
status5xx

ZoneHttpRequestsOverviewAdaptiveGroupsSum

FieldDescription
bytes
cachedBytes Bytes returned to client from cache
cachedRequests Requests served from cache
pageViews Successful requests for HTML content
requests
visits The number of requests by end-users that were initiated from a different website (i.e. where the request HTTP Referer header does not match the host in the HTTP Host header)

ZoneImageResizingRequests1mGroups

Minutely rollups of Image Resizing requests

FieldDescription
count Counts a number of rows per specific dimensions
dimensions List of dimensions to group by
sum Calculates a sum of each field per speicific dimensions

ZoneImageResizingRequests1mGroupsDimensions

FieldDescription
contentType
date
datetime
datetimeFifteenMinutes
datetimeFiveMinutes
datetimeHour
datetimeMinute
resizeError Error description when a resized image was requested but could not be served

ZoneImageResizingRequests1mGroupsSum

FieldDescription
originalBytes The size of the image before resizing
originalPixels The area of the image before resizing
requests Count of image resizing requests
resizedBytes The size of the image after resizing
resizedPixels The area of the image after resizing

ZoneLoadBalancingRequestsAdaptive

Raw Load Balancing origin requests with adaptive sampling

FieldDescription
coloCode IATA airport code of data center that received the request
datetime Request datetime
errorType Error generated when selecting an origin
lbName Load balancer name
numberOriginsSelected Number of origins that were selected and returned to the client
origins All origins in the pool that was selected based on steering policy
pools List of pools from which a pool will be selected based on steering policy
proxied Whether traffic is proxied through the Cloudflare network (orange-clouded)
region Load balancing region where request originated
sampleInterval ABR sample interval
selectedOriginIndex Index of the selected origin from the list of all origins. If multiple origins were selected, this is the index of the first origin in that list
selectedPoolAvgRttMs Average RTT (milliseconds) to reach the origins within the selected pool
selectedPoolHealthChecksEnabled Health checks active status for the selected pool
selectedPoolHealthy Health status for the selected pool
selectedPoolId A unique identifier for the selected pool
selectedPoolIndex Index of the selected pool from the list of all pools
selectedPoolName Name for the selected pool
sessionAffinity Type of session affinity enabled
sessionAffinityStatus Current status of session affinity
steeringPolicy Policy by which the load balancer will route traffic

ZoneLoadBalancingRequestsAdaptiveGroups

Aggregated Load Balancing origin requests with adaptive sampling

FieldDescription
avg
count The number of values for a metric per dimension
dimensions List of dimensions to group by

ZoneLoadBalancingRequestsAdaptiveGroupsAvg

FieldDescription
sampleInterval Average sample interval

ZoneLoadBalancingRequestsAdaptiveGroupsDimensions

FieldDescription
coloCode IATA airport code of data center that received the request
datetime Request datetime
datetimeFifteenMinutes Request datetime truncated to multiple of 15 minutes
datetimeFiveMinutes Request datetime truncated to multiple of 5 minutes
datetimeHalfOfHour Request datetime truncated to multiple of 30 minutes
datetimeHour Request datetime truncated to the hour
datetimeMinute Request datetime truncated to multiple of 1 minute
errorType Error generated when selecting an origin
lbName Load balancer name
multipleOriginsSelected Indicates whether multiple origins were returned to the client
numberOriginsSelected Number of origins that were selected and returned to the client
proxied Whether traffic is proxied through the Cloudflare network (orange-clouded)
region Load balancing region where request originated
sampleInterval ABR sample interval
selectedOriginIndex Index of the selected origin from the list of all origins. If multiple origins were selected, this is the index of the first origin in that list
selectedOriginName Name of the selected origin
selectedOriginNames Names of each selected origin
selectedPoolAvgRttMs Dynamic Latency: RTT (milliseconds) to reach the origin pool
selectedPoolHealthChecksEnabled Health checks status for the selected pool
selectedPoolHealthy Health status for the selected pool
selectedPoolId A unique identifier for the selected pool
selectedPoolIndex Index of the selected pool from the list of all pools
selectedPoolName Name for the selected pool
sessionAffinityEnabled Type of session affinity enabled
sessionAffinityStatus Current status of session affinity
steeringPolicy Policy by which the load balancer will route traffic

ZoneLoadBalancingRequestsAdaptiveOriginsElem

FieldDescription
fqdn Fully qualified domain name of the origin (if available)
health Origin health status
ipv4 IPv4 Address of the origin
ipv6 IPv6 address of the origin
originName Origin name
selected All the origins that were returned to the client
weight Ratio of traffic that will be distributed to this origin among all origins in the pool

ZoneLoadBalancingRequestsAdaptivePoolsElem

FieldDescription
avgRttMs Dynamic Latency: RTT (milliseconds) to reach the origin pool
distance Distance to Pool KM
healthCheckEnabled Health checks status
healthy Pool health status
id A unique identifier for the pool
poolName Pool name

ZoneLogpushHealthAdaptiveGroups

Beta. Logpush job health metrics

FieldDescription
avg
count The number of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

ZoneLogpushHealthAdaptiveGroupsAvg

FieldDescription
sampleInterval Average sample interval

ZoneLogpushHealthAdaptiveGroupsDimensions

FieldDescription
date Date that we completed pushing the log batch
datetime Datetime that we completed pushing the log batch
datetimeFifteenMinutes Datetime that we completed pushing the log batch, truncated to multiple of 15 minutes
datetimeFiveMinutes Datetime that we completed pushing the log batch, truncated to multiple of 5 minutes
datetimeHour Datetime that we completed pushing the log batch, truncated to the hour
datetimeMinute Datetime that we completed pushing the log batch, truncated to the minute
destinationType Destination type, e.g. 'S3' or 'GCS'
final Cloudflare may attempt to push a batch of logs multiple times if we encounter a failure. This field will be set to 'true' if this was the last push attempt for this batch of logs. If this field is set to false, it means the push failed but another retry was attempted. If this field is set to true and status >= 300, then the batch of logs failed to push and log data was lost. If you want to count the total number of logs that succeeded or failed, you should always set final = true.
jobId The Logpush Job ID
status HTTP response status code of the log destination

ZoneLogpushHealthAdaptiveGroupsSum

FieldDescription
bytes Bytes of uncompressed log data pushed
bytesCompressed Bytes of compressed log data pushed
records A count of the total number of records pushed.

ZoneNelReportsAdaptiveGroups

Data to visualize network error logs

FieldDescription
avg
count The number of NEL Reports
dimensions List of dimensions to group by

ZoneNelReportsAdaptiveGroupsAvg

FieldDescription
sampleInterval Average sample interval

ZoneNelReportsAdaptiveGroupsDimensions

FieldDescription
clientIPASN Client ASN
clientIPASNDescription Client ASN Description
clientIPCountry Client Country
clientIPCountryCode 2 letter client country code using ISO 3166-1 alpha-2 syntax
clientIPVersion IP Version the client used to connect
date Request date from browser
datetime Request datetime from browser
datetimeFifteenMinutes Request datetime from browser, truncated to multiple of 15 minutes
datetimeFiveMinutes Request datetime from browser, truncated to multiple of 5 minutes
datetimeHalfOfHour Request datetime from browser, truncated to multiple of 30 minutes
datetimeHour Request datetime from browser, truncated to the hour
datetimeMinute Request datetime from browser, truncated to the minute
lastKnownGoodColoCode IATA airport code of colo the client connected to
phase The phase of connection the error occurred in
protocol HTTP Protocol used when the error occured
type The type of error in the phase

ZonePageShieldReportsAdaptiveGroups

Page Shield CSP reports

FieldDescription
avg
count Number of Page Shield CSP reports
dimensions List of dimensions to group by

ZonePageShieldReportsAdaptiveGroupsAvg

FieldDescription
sampleInterval Average sample interval

ZonePageShieldReportsAdaptiveGroupsDimensions

FieldDescription
action policy action, log | allow
cspDirective csp directive e.g 'script-src'
date
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes Report datetime from edge, truncated to multiple of 15 minutes
datetimeFiveMinutes Report datetime from edge, truncated to multiple of 5 minutes
datetimeHalfOfHour Report datetime from edge, truncated to multiple of 30 minutes
datetimeHour Report datetime from edge, truncated to the hour
datetimeMinute Report datetime from edge, truncated to the minute
host hostname of the zone
pageURL page on which the resource was found
policyID The ID of the Policy
resourceType resource type e.g script
url URL of the CSP reported resource
urlHost hostname of the resource URL

ZoneSettings

Access and limitations for a zone

FieldDescription
apiGatewayGraphqlQueryAnalyticsGroups
apiGatewayMatchedSessionIDsAdaptiveGroups
apiGatewayMatchedSessionIDsPerEndpointAdaptiveGroups
apiRequestSequencesGroups
cacheReserveOperationsAdaptiveGroups
cacheReserveRequestsAdaptiveGroups
cacheReserveStorageAdaptiveGroups
dmarcReportsAdaptive
dmarcReportsSourcesAdaptiveGroups
dnsAnalyticsAdaptive
dnsAnalyticsAdaptiveGroups
emailRoutingAdaptive
emailRoutingAdaptiveGroups
firewallEventsAdaptive
firewallEventsAdaptiveByTimeGroups
firewallEventsAdaptiveGroups
healthCheckEventsAdaptive
healthCheckEventsAdaptiveGroups
httpRequests1dByColoGroups
httpRequests1dGroups
httpRequests1hGroups
httpRequests1mByColoGroups
httpRequests1mGroups
httpRequestsAdaptive
httpRequestsAdaptiveGroups
httpRequestsOverviewAdaptiveGroups
imageResizingRequests1mGroups
loadBalancingRequestsAdaptive
loadBalancingRequestsAdaptiveGroups
logpushHealthAdaptiveGroups
nelReportsAdaptiveGroups
pageShieldReportsAdaptiveGroups
waitingRoomAnalyticsAdaptive
waitingRoomAnalyticsAdaptiveGroups
workersZoneInvocationsAdaptiveGroups
workersZoneSubrequestsAdaptiveGroups
zarazActionsAdaptiveGroups
zarazAnalyticsIdentitiesAdaptiveGroups
zarazAnalyticsOrderedTrackAdaptive
zarazAnalyticsOrderedTrackAdaptiveGroups
zarazAnalyticsTrackAdaptiveGroups
zarazAnalyticsTrackTrafficSourcesAdaptiveGroups
zarazAnalyticsTriggersAdaptiveGroups
zarazAnalyticsTriggersTrafficSourcesAdaptiveGroups
zarazTrackAdaptiveGroups
zarazTriggersAdaptiveGroups

ZoneWaitingRoomAnalyticsAdaptive

Raw Waiting Room analytics logs

FieldDescription
datetime The date and time of the state of analytics for the waiting room
maxEstimatedTimeMinutes Maximum value of estimated time in minutes
newUsersPerMinute Actual value of new users per minute
newUsersPerMinuteConfig Configured value of new users per minute
sampleInterval ABR sample interval
sessionDuration Configured value of session duration
sessionsRevoked Actual value of sessions revoked
timeBetweenRefreshesP50 50th percentile of the time between session refreshes in seconds
timeBetweenRefreshesP75 75th percentile of the time between session refreshes in seconds
timeBetweenRefreshesP90 90th percentile of the time between session refreshes in seconds
timeBetweenRefreshesP95 95th percentile of the time between session refreshes in seconds
timeInQueueP50 50th percentile of the time spent waiting in queue in seconds
timeInQueueP75 75th percentile of the time spent waiting in queue in seconds
timeInQueueP90 90th percentile of the time spent waiting in queue in seconds
timeInQueueP95 95th percentile of the time spent waiting in queue in seconds
timeOnOriginP50 50th percentile of the time spent on the origin in seconds
timeOnOriginP75 75th percentile of the time spent on the origin in seconds
timeOnOriginP90 90th percentile of the time spent on the origin in seconds
timeOnOriginP95 95th percentile of the time spent on the origin in seconds
totalActiveUsers Actual value of total active users
totalActiveUsersConfig Configured value of total active users
totalQueuedUsers Total number of users that are queued
totalTimeWaitedP50 50th percentile of the total time (in seconds) spent waiting in queue by users who were queued and then gained access to the origin
totalTimeWaitedP75 75th percentile of the total time (in seconds) spent waiting in queue by users who were queued and then gained access to the origin
totalTimeWaitedP90 90th percentile of the total time (in seconds) spent waiting in queue by users who were queued and then gained access to the origin
totalTimeWaitedP95 95th percentile of the total time (in seconds) spent waiting in queue by users who were queued and then gained access to the origin
waitingRoomId Unique Identifier for the waiting room
waitingRoomName Name of the waiting room

ZoneWaitingRoomAnalyticsAdaptiveGroups

Aggregated Waiting Room analytics logs with adaptive sampling

FieldDescription
avg Beta. The avg of values for a metric per dimension
avgWeighted Beta. The avgWeighted values for a metric per dimension
dimensions List of dimensions to group by
max Beta. The max value for a metric per dimenstion
min Beta. The minimum value for a metric per dimenstion
sum The sum for a metric per dimension. Use for shorter queries since data gets sampled after 7 days.

ZoneWaitingRoomAnalyticsAdaptiveGroupsAvg

FieldDescription
maxEstimatedTimeMinutes Average of the maximum estimated wait time per minute. A negative number means no data
newUsersPerMinute Average rate of new users per minute. A negative number means no data
newUsersPerMinuteConfig Configured value of new users per minute. A negative number means no data
sampleInterval Average sample interval
sessionDuration Configured value of session duration. A negative number means no data
sessionsRevoked Average rate of sessions revoked. A negative number means no data
totalActiveUsers Average rate of total active users. A negative number means no data
totalActiveUsersConfig Configured value of total active users. A negative number means no data
totalQueuedUsers Average of total queued users

ZoneWaitingRoomAnalyticsAdaptiveGroupsAvgWeighted

FieldDescription
timeBetweenRefreshesP50 Weighted average of 50th percentile of time spent between session refreshes in seconds. A negative number means no data
timeBetweenRefreshesP75 Weighted average of 75th percentile of time spent between session refreshes in seconds. A negative number means no data
timeBetweenRefreshesP90 Weighted average of 90th percentile of time spent between session refreshes in seconds. A negative number means no data
timeBetweenRefreshesP95 Weighted average of 95th percentile of time spent between session refreshes in seconds. A negative number means no data
timeInQueueP50 Weighted average of 50th percentile of time spent in queue in seconds. A negative number means no data
timeInQueueP75 Weighted average of 75th percentile of time spent in queue in seconds. A negative number means no data
timeInQueueP90 Weighted average of 90th percentile of time spent in queue in seconds. A negative number means no data
timeInQueueP95 Weighted average of 95th percentile of time spent in queue in seconds. A negative number means no data
timeOnOriginP50 Weighted average of 50th percentile of time spent on origin in seconds. A negative number means no data
timeOnOriginP75 Weighted average of 75th percentile of time spent on origin in seconds. A negative number means no data
timeOnOriginP90 Weighted average of 90th percentile of time spent on origin in seconds. A negative number means no data
timeOnOriginP95 Weighted average of 95th percentile of time spent on origin in seconds. A negative number means no data
totalTimeWaitedP50 Weighted average of 50th percentile of the total time spent waiting in queue by users who have gained access to the origin in seconds. A negative number means no data
totalTimeWaitedP75 Weighted average of 75th percentile of the total time spent waiting in queue by users who have gained access to the origin in seconds. A negative number means no data
totalTimeWaitedP90 Weighted average of 90th percentile of the total time spent waiting in queue by users who have gained access to the origin in seconds. A negative number means no data
totalTimeWaitedP95 Weighted average of 95th percentile of the total time spent waiting in queue by users who have gained access to the origin in seconds. A negative number means no data

ZoneWaitingRoomAnalyticsAdaptiveGroupsDimensions

FieldDescription
date The date the event was written to the database
datetime The date and time the event was written to the database
datetimeFifteenMinutes The date and time the event was written to the database, truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event was written to the database, truncated to a multiple of 5 minutes
datetimeHour The date and time the event was written to the database, truncated to the hour
datetimeMinute The date and time the event was written to the database, truncated to the minute
sampleInterval ABR sample interval
waitingRoomId Unique Identifier for the waiting room

ZoneWaitingRoomAnalyticsAdaptiveGroupsMax

FieldDescription
maxEstimatedTimeMinutes The maximum value of estimated time in minutes. A negative number means no data
newUsersPerMinute The maximum value of the actual new users per minute. A negative number means no data
newUsersPerMinuteConfig The maximum value of the configured new users per minute. A negative number means no data
sessionDuration The maximum value of the configured session duration configuration. A negative number means no data
sessionsRevoked The maximum value of the actual sessions revoked. A negative number means no data
totalActiveUsers The maximum value of the actual total active users. A negative number means no data
totalActiveUsersConfig The maximum value of the configured total active users. A negative number means no data
totalQueuedUsers The maximum value of total number of queued users. A negative number means no data

ZoneWaitingRoomAnalyticsAdaptiveGroupsMin

FieldDescription
maxEstimatedTimeMinutes The minimum value of estimated time in minutes. A negative number means no data
newUsersPerMinute The minimum value of the actual new users per minute. A negative number means no data
newUsersPerMinuteConfig The minimum value of the configured new users per minute. A negative number means either Waiting Room is in passthrough or no data
sessionDuration The minimum value of the configured session duration configuration. A negative number means no data
sessionsRevoked The minimum value of the actual sessions revoked. A negative number means no data
totalActiveUsers The minimum value of the actual total active users. A negative number means no data
totalActiveUsersConfig The minimum value of the configured total active users. A negative number means either Waiting Room is in passthrough or no data
totalQueuedUsers The minimum value of total number of queued users. A negative number means no data

ZoneWaitingRoomAnalyticsAdaptiveGroupsSum

FieldDescription
newUsersPerMinute Sum of new users per minute. A negative number means no data
sessionsRevoked Sum of sessions revoked. A negative number means no data

ZoneWorkersZoneInvocationsAdaptiveGroups

Workers invocations with adaptive sampling

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

ZoneWorkersZoneInvocationsAdaptiveGroupsAvg

FieldDescription
avgCpuTime Average CPU time used per request (in microseconds)

ZoneWorkersZoneInvocationsAdaptiveGroupsDimensions

FieldDescription
constantScriptId Worker script Id
date Request datetime, truncated to start of a day
datetime Request datetime
datetimeHour Request datetime, truncated to start of an hour
datetimeMinute Request datetime, truncated to start of an minute
httpResponseStatus Origin HTTP response code
status Status of the worker invocation

ZoneWorkersZoneInvocationsAdaptiveGroupsSum

FieldDescription
requests Sum of Requests
responseBodySize Bandwidth (in bytes) returned to eyeball
subrequests Number of sub-requests issued by the edge worker
totalCpuTime Total CPU time used (in microseconds)

ZoneWorkersZoneSubrequestsAdaptiveGroups

Workers subrequests with adaptive sampling

FieldDescription
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

ZoneWorkersZoneSubrequestsAdaptiveGroupsDimensions

FieldDescription
cacheStatus Cache status
date Request datetime, truncated to start of a day
datetime Request datetime
datetimeHour Request datetime, truncated to start of an hour
datetimeMinute Request datetime, truncated to start of an minute
httpResponseStatus Origin HTTP response code

ZoneWorkersZoneSubrequestsAdaptiveGroupsSum

FieldDescription
responseBodySize Bandwidth (in bytes) received via subrequests
subrequests Number of subrequests issued by a worker

ZoneZarazActionsAdaptiveGroups

Zaraz Actions Analytics

FieldDescription
count Number of processed Zaraz Actions
dimensions List of dimensions to group by

ZoneZarazActionsAdaptiveGroupsDimensions

FieldDescription
actionName Action Name
date The date the Action was triggered
datetimeFifteenMinutes The date and time truncated to fifteen minutes
datetimeFiveMinutes The date and time truncated to five minutes
datetimeHour The date and time truncated to the hour
datetimeMinute The date and time truncated to the minute
toolName Tool Name

ZoneZarazAnalyticsIdentitiesAdaptiveGroups

Zaraz Analytics Identities - zaraz.identify calls

FieldDescription
count Number of processed Zaraz identify requests
dimensions List of dimensions to group by

ZoneZarazAnalyticsIdentitiesAdaptiveGroupsDimensions

FieldDescription
clientId Client ID
date Date when zaraz.identify() method was called
datetimeFifteenMinutes The date and time truncated to fifteen minutes
datetimeFiveMinutes The date and time truncated to five minutes
datetimeHour The date and time truncated to the hour
datetimeMinute The date and time truncated to the minute
identity Identity

ZoneZarazAnalyticsOrderedTrackAdaptive

Zaraz Analytics Tracks ordered per session

FieldDescription
browserName User Agent browser name
cityRegion City, region
clientId Client ID
colors Color depth
country Country
date Date when track was called
datetime Date & time when track was called
datetimeFifteenMinutes The date and time truncated to fifteen minutes
datetimeFiveMinutes The date and time truncated to five minutes
datetimeHour The date and time truncated to the hour
datetimeMinute The date and time truncated to the minute
deviceModel User Agent device model
deviceType User Agent device type
deviceVendor User Agent device vendor
ip IP
language Language
orderInClient Track's order number for its clientId
orderInSession Track's order number within its session (first track having orderInSession 1)
osName User Agent OS name
osVersion User Agent OS version
pageTitle Page Title
resolution Screen resolution, cantor paired width & heigh
reverseOrderInClient Track's reverse order number for its clientId
reverseOrderInSession Track's reverse order number within its session (last track having reverseOrderInSession 1)
sampleInterval ABR sample interval
sessionId Session ID
timezoneOffset Timezone Offset
trackData Track Data
trackName Track Name
trafficSrc Traffic Source
ua User Agent string
uaObj User Agent stringified object
urlParams URL query parameters
urlPath URL Path
viewport Viewport, cantor paired width & heigh

ZoneZarazAnalyticsOrderedTrackAdaptiveGroups

Zaraz Analytics Tracks ordered per session

FieldDescription
count Number of processed Zaraz Track requests
dimensions List of dimensions to group by
uniq

ZoneZarazAnalyticsOrderedTrackAdaptiveGroupsDimensions

FieldDescription
browserName User Agent browser name
cityRegion City, region
clientId Client ID
colors Color depth
country Country
date Date when track was called
datetimeFifteenMinutes The date and time truncated to fifteen minutes
datetimeFiveMinutes The date and time truncated to five minutes
datetimeHour The date and time truncated to the hour
datetimeMinute The date and time truncated to the minute
deviceModel User Agent device model
deviceType User Agent device type
deviceVendor User Agent device vendor
ip IP
language Language
orderInClient Track's order number for its clientId
orderInSession Track's order number within its session (first track having orderInSession 1)
osName User Agent OS name
osVersion User Agent OS version
pageTitle Page Title
resolution Screen resolution, cantor paired width & heigh
reverseOrderInClient Track's reverse order number for its clientId
reverseOrderInSession Track's reverse order number within its session (last track having reverseOrderInSession 1)
sessionId Session ID
timezoneOffset Timezone Offset
trackData Track Data
trackName Track Name
trafficSrc Traffic Source
ua User Agent string
uaObj User Agent stringified object
urlParams URL query parameters
urlPath URL Path
viewport Viewport, cantor paired width & heigh

ZoneZarazAnalyticsOrderedTrackAdaptiveGroupsUniq

FieldDescription
clientIdCount Minimum number of distinct client IDs
sessionIdCount Minimum number of distinct session IDs

ZoneZarazAnalyticsTrackAdaptiveGroups

Zaraz Analytics Track - counts zaraz.track calls

FieldDescription
count Number of processed Zaraz Track requests
dimensions List of dimensions to group by
uniq

ZoneZarazAnalyticsTrackAdaptiveGroupsDimensions

FieldDescription
browserName User Agent browser name
cityRegion City, region
clientId Client ID
colors Color depth
country Country
date Date when track was called
datetimeFifteenMinutes The date and time truncated to fifteen minutes
datetimeFiveMinutes The date and time truncated to five minutes
datetimeHour The date and time truncated to the hour
datetimeMinute The date and time truncated to the minute
deviceModel User Agent device model
deviceType User Agent device type
deviceVendor User Agent device vendor
ip IP
language Language
osName User Agent OS name
osVersion User Agent OS version
pageTitle Page Title
resolution Screen resolution, cantor paired width & heigh
sessionId Session ID
timezoneOffset Timezone Offset
trackData Track Data
trackName Track Name
trafficSrc Traffic Source
ua User Agent string
uaObj User Agent stringified object
urlParams URL query parameters
urlPath URL Path
viewport Viewport, cantor paired width & heigh

ZoneZarazAnalyticsTrackAdaptiveGroupsUniq

FieldDescription
clientIdCount Minimum number of distinct client IDs
sessionIdCount Minimum number of distinct session IDs

ZoneZarazAnalyticsTrackTrafficSourcesAdaptiveGroups

Zaraz Analytics Track Traffic Sources

FieldDescription
avg
count Number of unique sessions
dimensions List of dimensions to group by
uniq

ZoneZarazAnalyticsTrackTrafficSourcesAdaptiveGroupsAvg

FieldDescription
sessionDuration Average session duration

ZoneZarazAnalyticsTrackTrafficSourcesAdaptiveGroupsDimensions

FieldDescription
cityRegion City, region
clientId Client ID
country Country
duration Session duration (seconds)
exitPage URL Path at session end
firstTrafficSrc Traffic source at session start
landingPage URL Path at session start
sessionEnd Date when the session ended
sessionEndFifteenMinutes The date and time truncated to fifteen minutes
sessionEndFiveMinutes The date and time truncated to five minutes
sessionEndHour The date and time truncated to the hour
sessionEndMinute The date and time truncated to the minute
sessionId Session ID
sessionStart Date when the session started
sessionStartFifteenMinutes The date and time truncated to fifteen minutes
sessionStartFiveMinutes The date and time truncated to five minutes
sessionStartHour The date and time truncated to the hour
sessionStartMinute The date and time truncated to the minute
tracks Unique track names within a session

ZoneZarazAnalyticsTrackTrafficSourcesAdaptiveGroupsUniq

FieldDescription
clientIdCount Minimum number of distinct client IDs
sessionIdCount Minimum number of distinct session IDs

ZoneZarazAnalyticsTriggersAdaptiveGroups

Zaraz Analytics Triggers (a trigger is a set of rules that can trigger a zaraz action)

FieldDescription
count Number of processed Zaraz Triggers
dimensions List of dimensions to group by
uniq

ZoneZarazAnalyticsTriggersAdaptiveGroupsDimensions

FieldDescription
browserName User Agent browser name
cityRegion City, region
clientId Client ID
colors Color depth
country Country
date The date when trigger was triggerd
datetimeFifteenMinutes The date and time truncated to fifteen minutes
datetimeFiveMinutes The date and time truncated to five minutes
datetimeHour The date and time truncated to the hour
datetimeMinute The date and time truncated to the minute
deviceModel User Agent device model
deviceType User Agent device type
deviceVendor User Agent device vendor
ip IP
language Language
osName User Agent OS name
osVersion User Agent OS version
pageTitle Page Title
resolution Screen resolution, cantor paired width & heigh
sessionId Session ID
timezoneOffset Timezone Offset
trafficSrc Traffic Source
triggerName Trigger Name
ua User Agent string
uaObj User Agent stringified object
urlParams URL query parameters
urlPath URL Path
viewport Viewport, cantor paired width & heigh

ZoneZarazAnalyticsTriggersAdaptiveGroupsUniq

FieldDescription
clientIdCount Minimum number of distinct client IDs
sessionIdCount Minimum number of distinct session IDs

ZoneZarazAnalyticsTriggersTrafficSourcesAdaptiveGroups

Zaraz Analytics Triggers Traffic Sources

FieldDescription
count Number of unique sessions
dimensions List of dimensions to group by
uniq

ZoneZarazAnalyticsTriggersTrafficSourcesAdaptiveGroupsDimensions

FieldDescription
cityRegion City, region
clientId Client ID
country Country
firstTrafficSrc Traffic source at session start
sessionEnd Date when the session ended
sessionEndFifteenMinutes The date and time truncated to fifteen minutes
sessionEndFiveMinutes The date and time truncated to five minutes
sessionEndHour The date and time truncated to the hour
sessionEndMinute The date and time truncated to the minute
sessionId Session ID
sessionStart Date when the session started
sessionStartFifteenMinutes The date and time truncated to fifteen minutes
sessionStartFiveMinutes The date and time truncated to five minutes
sessionStartHour The date and time truncated to the hour
sessionStartMinute The date and time truncated to the minute
triggers Unique trigger names within a session

ZoneZarazAnalyticsTriggersTrafficSourcesAdaptiveGroupsUniq

FieldDescription
clientIdCount Minimum number of distinct client IDs
sessionIdCount Minimum number of distinct session IDs

ZoneZarazTrackAdaptiveGroups

Zaraz Track Analytics - counts zaraz.track calls

FieldDescription
count Number of processed Zaraz Track requests
dimensions List of dimensions to group by

ZoneZarazTrackAdaptiveGroupsDimensions

FieldDescription
date Date when track was called
datetimeFifteenMinutes The date and time truncated to fifteen minutes
datetimeFiveMinutes The date and time truncated to five minutes
datetimeHour The date and time truncated to the hour
datetimeMinute The date and time truncated to the minute
trackName Track Name
urlPath The URL from where Track was called

ZoneZarazTriggersAdaptiveGroups

Zaraz Triggers Analytics (a trigger is a set of rules that can trigger a zaraz action)

FieldDescription
count Number of processed Zaraz Triggers
dimensions List of dimensions to group by

ZoneZarazTriggersAdaptiveGroupsDimensions

FieldDescription
date The date when trigger was triggerd
datetimeFifteenMinutes The date and time truncated to fifteen minutes
datetimeFiveMinutes The date and time truncated to five minutes
datetimeHour The date and time truncated to the hour
datetimeMinute The date and time truncated to the minute
triggerName Trigger Name

account

FieldDescription
MagicWANConnectorMetricsAdaptiveGroups Beta. Magic WAN Connector Metrics
accessLoginRequestsAdaptiveGroups Access login requests
accountTag
advancedDnsProtectionNetworkAnalyticsAdaptiveGroups Network analytics data for Advanced DNS Protection
advancedTcpProtectionNetworkAnalyticsAdaptiveGroups DEPRECATED (This node is an alias for advancedTcpProtectionNetworkAnalyticsAdaptiveGroups; prefer using the new name instead): Network analytics data for Advanced TCP Protection
aiGatewayCacheAdaptiveGroups AI Gateway Cache
aiGatewayErrorsAdaptiveGroups AI Gateway Errors
aiGatewayRequestsAdaptiveGroups AI Gateway Requests
aiInferenceAdaptive AI Inference logs with adaptive sampling
aiInferenceAdaptiveGroups Aggregated AI Inference logs with adaptive sampling
browserRenderingEventsAdaptive Browser Rendering events with adaptive sampling
browserRenderingEventsAdaptiveGroups Aggregated Browser Rendering events with adaptive sampling
callsStatusAdaptive (TESTING ONLY, NOT FOR PRODUCTION) Raw Calls events with adaptive sampling
callsTurnUsageAdaptiveGroups Aggregated Calls TURN bandwidth usage with adaptive sampling"
callsUsageAdaptiveGroups Beta. Aggregated Calls SFU bandwidth usage with adaptive sampling
cdnNetworkAnalyticsAdaptiveGroups Network analytics data for Cloudflare CDN traffic
d1AnalyticsAdaptiveGroups Beta. Aggregated D1 analytics with adaptive sampling
d1QueriesAdaptiveGroups Beta. D1 query metrics with adaptive sampling
d1StorageAdaptiveGroups Beta. D1 storage with adaptive sampling
dosdAttackAnalyticsGroups Attack analytics metadata for attacks detected by dosd
dosdNetworkAnalyticsAdaptiveGroups Network analytics data for dosd
durableObjectsInvocationsAdaptiveGroups Durable Objects invocations with adaptive sampling
durableObjectsPeriodicGroups Durable Objects periodic metrics
durableObjectsStorageGroups Durable Objects storage metrics
durableObjectsSubrequestsAdaptiveGroups Durable Objects subrequests with adaptive sampling
fbmAttackAnalyticsGroups FBM analytics metadata for attacks detected by dosd
firewallEventsAdaptive Raw Firewall events with adaptive sampling
firewallEventsAdaptiveGroups Aggregated Firewall events with adaptive sampling
flowtrackdNetworkAnalyticsAdaptiveGroups DEPRECATED (This node is an alias for advancedTcpProtectionNetworkAnalyticsAdaptiveGroups; prefer using the new name instead): Network analytics data for flowtrackd
gatewayL4DownstreamSessionsAdaptiveGroups Aggregated metrics about downstream (client to edge) L4 Gateway Sessions. Metrics are reported on TCP or UDP session close
gatewayL4SessionsAdaptiveGroups BETA - Aggregate counts of Gateway L4 sessions with adaptive sampling
gatewayL4UpstreamSessionsAdaptiveGroups Aggregated metrics about upstream (edge to client) L4 Gateway Sessions. Metrics are reported on TCP, QUIC or UDP session close
gatewayL7RequestsAdaptiveGroups BETA - Aggregate counts of Gateway L7 requests with adaptive sampling
gatewayResolverByCategoryAdaptiveGroups BETA - Aggregate counts of Gateway Resolver queries by category with adaptive sampling
gatewayResolverByCustomResolverGroups Stats on dns custom resolvers
gatewayResolverByRuleExecutionPerformanceAdaptiveGroups Total time spent on executing firewall rules at the edge
gatewayResolverQueriesAdaptiveGroups BETA - Aggregate counts of Gateway Resolver queries with adaptive sampling
httpRequests1dGroups Daily rollups of request data
httpRequests1hGroups Hourly rollups of request data
httpRequests1mGroups Minutely rollups of request data
httpRequestsAdaptive Raw HTTP requests with adaptive sampling
httpRequestsAdaptiveGroups Aggregated HTTP requests data with adaptive sampling
httpRequestsOverviewAdaptiveGroups A high-level summary of HTTP requests made by end users.
hyperdriveQueriesAdaptiveGroups Hyperdrive query events with adaptive sampling.
imagesRequestsAdaptiveGroups A high-level summary of Cloudflare Images served to end users.
imagesUniqueTransformations Image unique transfromations per day
kvOperationsAdaptiveGroups KV operations data with adaptive sampling
kvStorageAdaptiveGroups KV stored data with adaptive sampling
logpushHealthAdaptiveGroups Beta. Logpush job health metrics
magicFirewallNetworkAnalyticsAdaptiveGroups Network analytics data for Magic Firewall
magicFirewallRateLimitNetworkAnalyticsAdaptiveGroups Network analytics data for Magic Firewall Ratelimiting
magicFirewallSamplesAdaptiveGroups Data to visualize traffic allowed and blocked by Magic Firewall rules
magicIDPSNetworkAnalyticsAdaptiveGroups Network analytics data for Magic IDS
magicTransitNetworkAnalyticsAdaptiveGroups Network analytics data for Magic Transit traffic
magicTransitTunnelHealthChecksAdaptiveGroups Beta. Magic Transit Health check results for customer GRE Tunnels with adaptive sampling (ABR).
magicTransitTunnelTrafficAdaptiveGroups Bandwidth usage metric of a Magic Transit tunnel.
mnmFlowDataAdaptiveGroups Flow data collected through Magic Network Monitoring
nelReportsAdaptiveGroups Data to visualize network error logs
ohttpMetricsAdaptive oHTTP request metrics with adaptive sampling
ohttpMetricsAdaptiveGroups Aggregated oHTTP request metrics with adaptive sampling
pagesFunctionsInvocationsAdaptiveGroups Pages Functions invocations with adaptive sampling
queueBacklogAdaptiveGroups Beta. Queue backlog data with adaptive sampling. Queues that are not being written to, or read from, will not return data, even if they have a backlog.
queueConsumerMetricsAdaptiveGroups Beta. Queue consumer metrics with adaptive sampling. Inactive queues will not return data.
queueDelayedBacklogAdaptiveGroups Beta. Queue delayed backlog data with adaptive sampling. Queues that are not being written to, or read from, will not return data, even if they have a backlog.
queueMessageOperationsAdaptiveGroups Beta. Queue message operation data with adaptive sampling
r2OperationsAdaptiveGroups Beta. R2 operations with adaptive sampling
r2StorageAdaptiveGroups Beta. R2 storage with adaptive sampling
rumPageloadEventsAdaptiveGroups Beta. Aggregated RUM pageload event metrics with adaptive sampling
rumPerformanceEventsAdaptiveGroups Beta. Aggregated RUM performance event metrics with adaptive sampling
rumWebVitalsEventsAdaptive Beta. RUM Web Vitals event metrics with adaptive sampling
rumWebVitalsEventsAdaptiveGroups Beta. Aggregated RUM Web Vitals event metrics with adaptive sampling
settings
sinkholeRequestLogsAdaptive Sinkhole Request Logs
sinkholeRequestLogsAdaptiveGroups Sinkhole Request Logs
sippyOperationsAdaptiveGroups Sippy operations with adaptive sampling
spectrumNetworkAnalyticsAdaptiveGroups Network analytics data for Spectrum traffic
storageTraces Storage Tracing Information
streamMinutesViewedAdaptiveGroups A high-level summary of Cloudflare Stream minutes viewed.
turnstileAdaptiveGroups Beta. Cloudflare Turnstile aggregated events with adaptive sampling
vectorizeQueriesAdaptiveGroups Beta. Vectorize usage with adaptive sampling
vectorizeStorageAdaptiveGroups Beta. Vectorize storage with adaptive sampling
vectorizeV2OperationsAdaptiveGroups Vectorize operations with adaptive sampling
vectorizeV2QueriesAdaptiveGroups Vectorize queries with adaptive sampling
vectorizeV2StorageAdaptiveGroups Vectorize storage with adaptive sampling
vectorizeV2WritesAdaptiveGroups Vectorize writes with adaptive sampling
videoBufferEventsAdaptiveGroups Beta. Aggregated video streaming buffer event metrics with adaptive sampling
videoPlaybackEventsAdaptiveGroups Beta. Aggregated video streaming playback event metrics with adaptive sampling
videoQualityEventsAdaptiveGroups Beta. Aggregated video streaming quality change event metrics with adaptive sampling
warpDeviceAdaptiveGroups Beta. Warp device health events with adaptive sampling
workerPlacementAdaptiveGroups Worker placement metrics
workersAnalyticsEngineAdaptiveGroups Beta. Custom Events with adaptive sampling
workersInvocationsAdaptive Beta. Workers invocations with adaptive sampling
workersInvocationsScheduled Workers scheduled invocations
workersOverviewDataAdaptiveGroups Beta. Workers account overview invocation data with adaptive sampling
workersOverviewRequestsAdaptiveGroups Beta. Workers account overview invocation count with adaptive sampling
workersSubrequestsAdaptiveGroups Beta. Workers subrequests with adaptive sampling
workflowsAdaptive Workflows analytics
workflowsAdaptiveGroups Workflows analytics
zarazTrackAdaptiveGroups Zaraz Track Analytics - counts zaraz.track calls
zarazTriggersAdaptiveGroups Zaraz Triggers Analytics (a trigger is a set of rules that can trigger a zaraz action)
zeroTrustPrivateNetworkDiscoveryGroups Beta - Unique origins, applications, and users discovered for Zero Trust private networks
zones

bool

Scalar type bool

FieldDescription

bytes

Scalar type []uint8

FieldDescription

float32

Scalar type float32

FieldDescription

float64

Scalar type float64

FieldDescription

int16

Scalar type int16

FieldDescription

int32

Scalar type int32

FieldDescription

int64

Scalar type int64

FieldDescription

int8

Scalar type int8

FieldDescription

organization

FieldDescription
httpRequestsAdaptiveGroups Aggregated HTTP requests data with adaptive sampling
organizationTag
settings

string

Scalar type string

FieldDescription

uint16

Scalar type uint16

FieldDescription

uint32

Scalar type uint32

FieldDescription

uint64

Scalar type uint64

FieldDescription

uint8

Scalar type uint8

FieldDescription

viewer

FieldDescription
accounts
budget
organizations
zones

zone

FieldDescription
apiGatewayGraphqlQueryAnalyticsGroups GraphQL query attributes and trends
apiGatewayMatchedSessionIDsAdaptiveGroups Beta. Aggregated count of Session Identifier matches
apiGatewayMatchedSessionIDsPerEndpointAdaptiveGroups Beta. Aggregated count of Session Identifier matches per endpoint
apiRequestSequencesGroups Sequences of API endpoint operations. Sequences are learned by grouping requests by AuthID. Correlation scores are estimated over a 24 hour window and are current to within 10 minutes
cacheReserveOperationsAdaptiveGroups Beta. Cache Reserve operations with adaptive sampling
cacheReserveRequestsAdaptiveGroups Cache Reserve HTTP requests data with adaptive sampling
cacheReserveStorageAdaptiveGroups Beta. Cache Reserve storage with adaptive sampling
dmarcReportsAdaptive Dmarc report records with adaptive sampling
dmarcReportsSourcesAdaptiveGroups Aggregated dmarc reports by sources logs with adaptive sampling
dnsAnalyticsAdaptive Analytics data for DNS queries
dnsAnalyticsAdaptiveGroups Analytics data for DNS queries
emailRoutingAdaptive Beta. Raw email routing logs with adaptive sampling
emailRoutingAdaptiveGroups Beta. Aggregated email routing logs with adaptive sampling
firewallEventsAdaptive Raw Firewall events with adaptive sampling
firewallEventsAdaptiveByTimeGroups Aggregated Firewall events with adaptive sampling grouped by time
firewallEventsAdaptiveGroups Aggregated Firewall events with adaptive sampling
healthCheckEventsAdaptive Raw Health Check events with adaptive sampling
healthCheckEventsAdaptiveGroups Aggregated Health Check events with adaptive sampling
httpRequests1dByColoGroups DEPRECATED (Node is replaced with more capable httpRequestsAdaptiveGroups): Daily rollups of request data by colo
httpRequests1dGroups Daily rollups of request data
httpRequests1hGroups Hourly rollups of request data
httpRequests1mByColoGroups DEPRECATED (Node is replaced with more capable httpRequestsAdaptiveGroups): Minutely rollups of request data by colo
httpRequests1mGroups Minutely rollups of request data
httpRequestsAdaptive Raw HTTP requests with adaptive sampling
httpRequestsAdaptiveGroups Aggregated HTTP requests data with adaptive sampling
httpRequestsOverviewAdaptiveGroups A high-level summary of HTTP requests made by end users.
imageResizingRequests1mGroups Minutely rollups of Image Resizing requests
loadBalancingRequestsAdaptive Raw Load Balancing origin requests with adaptive sampling
loadBalancingRequestsAdaptiveGroups Aggregated Load Balancing origin requests with adaptive sampling
logpushHealthAdaptiveGroups Beta. Logpush job health metrics
nelReportsAdaptiveGroups Data to visualize network error logs
pageShieldReportsAdaptiveGroups Page Shield CSP reports
settings
waitingRoomAnalyticsAdaptive Raw Waiting Room analytics logs
waitingRoomAnalyticsAdaptiveGroups Aggregated Waiting Room analytics logs with adaptive sampling
workersZoneInvocationsAdaptiveGroups Workers invocations with adaptive sampling
workersZoneSubrequestsAdaptiveGroups Workers subrequests with adaptive sampling
zarazActionsAdaptiveGroups Zaraz Actions Analytics
zarazAnalyticsIdentitiesAdaptiveGroups Zaraz Analytics Identities - zaraz.identify calls
zarazAnalyticsOrderedTrackAdaptive Zaraz Analytics Tracks ordered per session
zarazAnalyticsOrderedTrackAdaptiveGroups Zaraz Analytics Tracks ordered per session
zarazAnalyticsTrackAdaptiveGroups Zaraz Analytics Track - counts zaraz.track calls
zarazAnalyticsTrackTrafficSourcesAdaptiveGroups Zaraz Analytics Track Traffic Sources
zarazAnalyticsTriggersAdaptiveGroups Zaraz Analytics Triggers (a trigger is a set of rules that can trigger a zaraz action)
zarazAnalyticsTriggersTrafficSourcesAdaptiveGroups Zaraz Analytics Triggers Traffic Sources
zarazTrackAdaptiveGroups Zaraz Track Analytics - counts zaraz.track calls
zarazTriggersAdaptiveGroups Zaraz Triggers Analytics (a trigger is a set of rules that can trigger a zaraz action)
zoneTag