GraphQL
This lists all of the available datasets and fields in Cloudflare's GraphQL API.
AccountAccessLoginRequestsAdaptiveGroups
Access login requests
| Field | Description |
|---|---|
| avg | |
| count | Number of access login API events processed |
| dimensions | List of dimensions to group by |
AccountAccessLoginRequestsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval | Average sample interval |
AccountAccessLoginRequestsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| appId | Access application ID |
| approvingPolicyId | Policy ID that approved the user |
| cfRayId | CF ray id |
| country | Country tag |
| date | The date the access login event was emitted |
| datetime | The date and time the access login event was emitted |
| datetimeMinute | The date and time the access login event was emitted truncated to the minute |
| deviceId | Device ID |
| hasExistingJWT | Has existing JWT (0 = false, 1 = true) |
| hasGatewayEnabled | Has Gateway enabled (0 = false, 1 = true) |
| hasWarpEnabled | Has WARP enabled (0 = false, 1 = true) |
| identityProvider | Identity provider |
| ipAddress | User IP address |
| isSuccessfulLogin | If the login was successful (0 = false, 1 = true) |
| mtlsCertSerialId | MTLS certificate serial ID |
| mtlsCommonName | MTLS common name |
| mtlsStatus | MTLS status (may show error message if status is not successful) |
| serviceTokenId | Service token ID |
| userUuid | User UUID |
AccountAccessLoginRequestsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountAccessLoginRequestsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroups
Network analytics data for Advanced DNS Protection
| Field | Description |
|---|---|
| avg | The average of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
| bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
| bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
| bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
| bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
| bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
| bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
| packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
| packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
| packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
| packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
| packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
| packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
| packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| applicationTag | Application tag associated with the packet |
| coloCity | City where the Cloudflare datacenter that received the packet is located |
| coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
| coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
| coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
| coloName | Cloudflare datacenter that received the packet (unique site identifier) |
| date | Date that the packet was received |
| datetime | Date and time that the packet was received |
| datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
| datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
| datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
| datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
| datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
| destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
| destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
| destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
| destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
| destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
| direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
| dnsQueryName | The requested domain name in the DNS query |
| dnsQueryType | The query type in the DNS query |
| ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
| greChecksum | Value of the Checkusm header field in the GRE packet |
| greEthertype | Value of the Ethertype header field in the GRE packet |
| greHeaderLength | Length of the GRE packet header, in bytes |
| greKey | Value of the Key header field in the GRE packet |
| greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
| greVersion | Value of the Version header field in the GRE packet |
| icmpChecksum | Value of the Checkusm header field in the ICMP packet |
| icmpCode | Value of the Code header field in the ICMP packet |
| icmpType | Value of the Type header field in the ICMP packet |
| ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
| ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
| ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
| ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
| ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
| ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
| ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
| ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
| ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
| ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
| ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
| ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
| ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
| ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
| ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
| ipv4Identification | Value of the Identification header field in the IPv4 packet |
| ipv4Options | List of Options numbers included in the IPv4 packet header |
| ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
| ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
| ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
| ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
| ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
| leaseTag | IP lease tag associated with the packet |
| mitigationReason | Reason for applying a mitigation to the packet, if any |
| mitigationScope | Whether the packet matched a local or global mitigation, if any (possible values: local, global) |
| outcome | The action that was taken on the packet (possible values: pass, drop) |
| prefixTag | IP prefix tag associated with the packet |
| sampleInterval | ABR sample interval |
| sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
| sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
| sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
| sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
| sourcePort | Value of the Source Port header field in the TCP or UDP packet |
| tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
| tcpChecksum | Value of the Checkusm header field in the TCP packet |
| tcpDataOffset | Value of the Data Offset header field in the TCP packet |
| tcpFlags | Value of the Flags header field in the TCP packet |
| tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
| tcpMss | Value of the MSS option header field in the TCP packet |
| tcpOptions | List of Options numbers included in the TCP packet header |
| tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
| tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
| tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
| tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
| tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
| tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
| tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
| tcpWindowSize | Value of the Window Size header field in the TCP packet |
| udpChecksum | Value of the Checkusm header field in the UDP packet |
| udpPayloadLength | Value of the Payload Length header field in the UDP packet |
| verdict | The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop) |
AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsSum
| Field | Description |
|---|---|
| bits | Sum of bits received |
| packets | Sum of packets received |
AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroups
Network analytics data for Advanced TCP Protection
| Field | Description |
|---|---|
| avg | The average of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
| bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
| bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
| bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
| bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
| bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
| bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
| packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
| packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
| packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
| packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
| packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
| packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
| packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| applicationTag | Application tag associated with the packet |
| coloCity | City where the Cloudflare datacenter that received the packet is located |
| coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
| coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
| coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
| coloName | Cloudflare datacenter that received the packet (unique site identifier) |
| date | Date that the packet was received |
| datetime | Date and time that the packet was received |
| datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
| datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
| datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
| datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
| datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
| destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
| destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
| destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
| destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
| destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
| direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
| ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
| greChecksum | Value of the Checkusm header field in the GRE packet |
| greEthertype | Value of the Ethertype header field in the GRE packet |
| greHeaderLength | Length of the GRE packet header, in bytes |
| greKey | Value of the Key header field in the GRE packet |
| greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
| greVersion | Value of the Version header field in the GRE packet |
| icmpChecksum | Value of the Checkusm header field in the ICMP packet |
| icmpCode | Value of the Code header field in the ICMP packet |
| icmpType | Value of the Type header field in the ICMP packet |
| ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
| ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
| ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
| ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
| ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
| ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
| ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
| ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
| ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
| ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
| ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
| ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
| ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
| ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
| ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
| ipv4Identification | Value of the Identification header field in the IPv4 packet |
| ipv4Options | List of Options numbers included in the IPv4 packet header |
| ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
| ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
| ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
| ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
| ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
| leaseTag | IP lease tag associated with the packet |
| mitigationReason | Reason for applying a mitigation to the packet, if any |
| mitigationScope | Whether the packet matched a local or global mitigation, if any (possible values: local, global) |
| outcome | The action that was taken on the packet (possible values: pass, drop) |
| prefixTag | IP prefix tag associated with the packet |
| protocolState | State of the packet in the context of the protocol, if available |
| sampleInterval | ABR sample interval |
| sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
| sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
| sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
| sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
| sourcePort | Value of the Source Port header field in the TCP or UDP packet |
| tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
| tcpChecksum | Value of the Checkusm header field in the TCP packet |
| tcpDataOffset | Value of the Data Offset header field in the TCP packet |
| tcpFlags | Value of the Flags header field in the TCP packet |
| tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
| tcpMss | Value of the MSS option header field in the TCP packet |
| tcpOptions | List of Options numbers included in the TCP packet header |
| tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
| tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
| tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
| tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
| tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
| tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
| tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
| tcpWindowSize | Value of the Window Size header field in the TCP packet |
| udpChecksum | Value of the Checkusm header field in the UDP packet |
| udpPayloadLength | Value of the Payload Length header field in the UDP packet |
| verdict | The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop) |
AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsSum
| Field | Description |
|---|---|
| bits | Sum of bits received |
| packets | Sum of packets received |
AccountAiGatewayCacheAdaptiveGroups
AI Gateway Cache
| Field | Description |
|---|---|
| count | Total number of requests for an account with caching enabled: including hits and misses |
| dimensions | List of dimensions to group by |
AccountAiGatewayCacheAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| cacheOp | Cache Hit or Miss: 1 = cache hit, 0 = cache miss |
| date | The date when trigger was triggerd |
| datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
| datetimeFiveMinutes | The date and time truncated to five minutes |
| datetimeHour | The date and time truncated to the hour |
| datetimeMinute | The date and time truncated to the minute |
| gateway | Gateway name |
| model | Which model was the request sent to |
| provider | Which provider was the request sent to |
| tokensIn | Number of tokens in the request |
| tokensOut | Number of tokens in the response |
AccountAiGatewayCacheAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountAiGatewayCacheAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountAiGatewayErrorsAdaptiveGroups
AI Gateway Errors
| Field | Description |
|---|---|
| count | Number of errors |
| dimensions | List of dimensions to group by |
AccountAiGatewayErrorsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | The date when trigger was triggerd |
| datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
| datetimeFiveMinutes | The date and time truncated to five minutes |
| datetimeHour | The date and time truncated to the hour |
| datetimeMinute | The date and time truncated to the minute |
| gateway | Gateway name |
| model | Which models was the request sent to |
| provider | Which provider was the request sent to |
AccountAiGatewayErrorsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountAiGatewayErrorsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountAiGatewayRequestsAdaptiveGroups
AI Gateway Requests
| Field | Description |
|---|---|
| count | Number of processed requests |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountAiGatewayRequestsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| cached | Was the response served from cache?: 1 = cache hit, 0 = cache misss |
| date | The date when trigger was triggered |
| datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
| datetimeFiveMinutes | The date and time truncated to five minutes |
| datetimeHour | The date and time truncated to the hour |
| datetimeMinute | The date and time truncated to the minute |
| gateway | Gateway name |
| model | Which models was the request sent to |
| provider | Which provider was the request sent to |
| rateLimited | Was the request rate limited?: 1 = rate limit applied, 0 = rate limit not applied |
| tokensIn | Number of tokens in the request |
| tokensOut | Number of tokens in the response |
AccountAiGatewayRequestsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountAiGatewayRequestsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountAiGatewayRequestsAdaptiveGroupsSum
| Field | Description |
|---|---|
| cachedTokensIn | Sum of cached tokens in |
| cachedTokensOut | Sum of cached tokens out |
| uncachedTokensIn | Sum of uncached tokens in |
| uncachedTokensOut | Sum of uncached tokens out |
AccountAiInferenceAdaptive
AI Inference logs with adaptive sampling
| Field | Description |
|---|---|
| datetime | The date when inferance was triggered |
| errorCode | Error code |
| inferenceTimeMs | Inference time ms |
| modelId | ModelId that was trigger to inference |
| modelIsBeta | Model that was trigger to inference is Beta |
| neurons | Monetization unit |
| requestBytesIn | Request size in bytes |
| requestBytesOut | Request size out bytes |
| requestSource | Source who triggered (worker binding, pages binding, rest api) |
| sampleInterval | ABR sample interval |
AccountAiInferenceAdaptiveFilter_InputObject
| Field | Description |
|---|---|
AccountAiInferenceAdaptiveGroups
Aggregated AI Inference logs with adaptive sampling
| Field | Description |
|---|---|
| count | Total number of inferences for an account |
| dimensions | List of dimensions to group by |
| sum |
AccountAiInferenceAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | The date when starts the inference |
| datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
| datetimeFiveMinutes | The date and time truncated to five minutes |
| datetimeHour | The date and time truncated to the hour |
| datetimeMinute | The date and time truncated to the minute |
| errorCode | Error code |
| inferenceTimeMs | Inference time ms |
| modelId | ModelId that was trigger to inference |
| modelIsBeta | Model that was trigger to inference is Beta |
| neurons | Monetization unit |
| requestBytesIn | Request size in bytes |
| requestBytesOut | Request size out bytes |
| requestSource | Source who triggered (worker binding, pages binding, rest api) |
AccountAiInferenceAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountAiInferenceAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountAiInferenceAdaptiveGroupsSum
| Field | Description |
|---|---|
| totalInferenceTimeMs | Total inference time ms |
| totalNeurons | Total neurons |
| totalRequestBytesIn | Total bytes in per request |
| totalRequestBytesOut | Total bytes out per request |
AccountAiInferenceAdaptiveOrderBy
| Field | Description |
|---|---|
AccountBrowserRenderingEventsAdaptive
Browser Rendering events with adaptive sampling
| Field | Description |
|---|---|
| browserCloseReason | Browser session close code. Enum (-1, N/A) (0, Unknown) (1, NormalClosure) (2, BrowserIdle) (3, ClientClosedEarly) (4, ChromiumChrashed) (5, ClientAbnormalClosure) (6, ServerAbnormalClosure) (7, ClientError) (8, ServerError) (9, WorkerError) (10, ClientNeverConnected) (11, BrowserSessionEvicted) |
| browserEndTime | Browser session end time |
| browserStartTime | Browser session start time |
| connectionEndTime | When worker ended devtools connection to browser session |
| connectionId | Worker connection ID, when available |
| connectionStartTime | When worker started devtools connection to browser session |
| datetime | The time of the event |
| sampleInterval | ABR sample interval |
| scriptName | Name of worker who initiated the request |
| sessionId | Browser session ID |
AccountBrowserRenderingEventsAdaptiveFilter_InputObject
| Field | Description |
|---|---|
AccountBrowserRenderingEventsAdaptiveGroups
Aggregated Browser Rendering events with adaptive sampling
| Field | Description |
|---|---|
| count | Total number of events for an account |
| dimensions | List of dimensions to group by |
| max | The maximum value for a metric per dimension |
| min | The minimum value for a metric per dimension |
| uniq |
AccountBrowserRenderingEventsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| browserCloseReason | Browser session close code. Enum (-1, N/A) (0, Unknown) (1, NormalClosure) (2, BrowserIdle) (3, ClientClosedEarly) (4, ChromiumChrashed) (5, ClientAbnormalClosure) (6, ServerAbnormalClosure) (7, ClientError) (8, ServerError) (9, WorkerError) (10, ClientNeverConnected) (11, BrowserSessionEvicted) |
| connectionId | Worker connection ID, when available |
| date | The date of the event |
| datetimeFifteenMinutes | The date and time of the event truncated to fifteen minutes |
| datetimeFiveMinutes | The date and time of the event truncated to five minutes |
| datetimeHour | The date and time of the event truncated to the hour |
| datetimeMinute | The date and time of the event truncated to the minute |
| scriptName | Name of worker who initiated the request |
| sessionId | Browser session ID |
AccountBrowserRenderingEventsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountBrowserRenderingEventsAdaptiveGroupsMax
| Field | Description |
|---|---|
| finalBrowserCloseReason | Browser close reason |
| latestBrowserEndTime | Browser end time |
AccountBrowserRenderingEventsAdaptiveGroupsMin
| Field | Description |
|---|---|
| earliestBrowserStartTime | Browser start time |
AccountBrowserRenderingEventsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountBrowserRenderingEventsAdaptiveGroupsUniq
| Field | Description |
|---|---|
| connectionIdCount | Unique worker connections |
| sessionIdCount | Unique browser sessions |
AccountBrowserRenderingEventsAdaptiveOrderBy
| Field | Description |
|---|---|
AccountCallsStatusAdaptive
(TESTING ONLY, NOT FOR PRODUCTION) Raw Calls events with adaptive sampling
| Field | Description |
|---|---|
| appId | The appId that generated traffic |
| datetime | The date and time the event was recorded |
| event | The description of the event related to a session or a track |
| sessionId | The generated string that identifies a PeerConnection |
| trackId | The track identifier provided to us within a PeerConnection |
AccountCallsStatusAdaptiveFilter_InputObject
| Field | Description |
|---|---|
AccountCallsStatusAdaptiveOrderBy
| Field | Description |
|---|---|
AccountCallsUsageAdaptiveGroups
Beta. Aggregated Calls bandwidth usage with adaptive sampling
| Field | Description |
|---|---|
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountCallsUsageAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| appId | The appId that generated traffic |
| date | Calls bandwidth metrics date |
| datetimeFifteenMinutes | Calls bandwidth metrics timestamp, truncated to fifteen minutes |
| datetimeFiveMinutes | Calls bandwidth metrics timestamp, truncated to five minutes |
| datetimeHour | Calls bandwidth metrics timestamp, truncated to the hour |
| datetimeMinute | Calls bandwidth metrics timestamp, truncated to the minute |
| sessionId | The generated string that identifies a PeerConnection |
| trackId | The track identifier provided to us within a PeerConnection |
| trackType | Describes if the track contains video, audio, or data |
AccountCallsUsageAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountCallsUsageAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountCallsUsageAdaptiveGroupsSum
| Field | Description |
|---|---|
| egressBytes | The total bytes sent by Calls, observed over the queried time period |
| ingressBytes | The total bytes received by Calls, observed over the queried time period |
AccountCdnNetworkAnalyticsAdaptiveGroups
Network analytics data for Cloudflare CDN traffic
| Field | Description |
|---|---|
| avg | The average of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountCdnNetworkAnalyticsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
| bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
| bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
| bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
| bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
| bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
| bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
| packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
| packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
| packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
| packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
| packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
| packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
| packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountCdnNetworkAnalyticsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| applicationTag | Application tag associated with the packet |
| coloCity | City where the Cloudflare datacenter that received the packet is located |
| coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
| coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
| coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
| coloName | Cloudflare datacenter that received the packet (unique site identifier) |
| date | Date that the packet was received |
| datetime | Date and time that the packet was received |
| datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
| datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
| datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
| datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
| datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
| destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
| destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
| destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
| destinationDeviceTag | Device tag associated with the destination IP of the packet |
| destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
| destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
| direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
| ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
| greChecksum | Value of the Checkusm header field in the GRE packet |
| greEthertype | Value of the Ethertype header field in the GRE packet |
| greHeaderLength | Length of the GRE packet header, in bytes |
| greKey | Value of the Key header field in the GRE packet |
| greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
| greVersion | Value of the Version header field in the GRE packet |
| icmpChecksum | Value of the Checkusm header field in the ICMP packet |
| icmpCode | Value of the Code header field in the ICMP packet |
| icmpType | Value of the Type header field in the ICMP packet |
| ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
| ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
| ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
| ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
| ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
| ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
| ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
| ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
| ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
| ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
| ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
| ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
| ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
| ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
| ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
| ipv4Identification | Value of the Identification header field in the IPv4 packet |
| ipv4Options | List of Options numbers included in the IPv4 packet header |
| ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
| ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
| ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
| ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
| ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
| leaseTag | IP lease tag associated with the packet |
| mitigationSystem | Which system dropped the packet (possible values: dosd, flowtrackd, magic-firewall) |
| outcome | The action that was taken on the packet (possible values: pass, drop) |
| popName | Cloudflare PoP that received the packet (unique site identifier) |
| prefixTag | IP prefix tag associated with the packet |
| sampleInterval | ABR sample interval |
| sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
| sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
| sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
| sourceDeviceTag | Device tag associated with the source IP of the packet |
| sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
| sourcePort | Value of the Source Port header field in the TCP or UDP packet |
| tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
| tcpChecksum | Value of the Checkusm header field in the TCP packet |
| tcpDataOffset | Value of the Data Offset header field in the TCP packet |
| tcpFlags | Value of the Flags header field in the TCP packet |
| tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
| tcpMss | Value of the MSS option header field in the TCP packet |
| tcpOptions | List of Options numbers included in the TCP packet header |
| tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
| tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
| tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
| tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
| tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
| tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
| tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
| tcpWindowSize | Value of the Window Size header field in the TCP packet |
| udpChecksum | Value of the Checkusm header field in the UDP packet |
| udpPayloadLength | Value of the Payload Length header field in the UDP packet |
AccountCdnNetworkAnalyticsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountCdnNetworkAnalyticsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountCdnNetworkAnalyticsAdaptiveGroupsSum
| Field | Description |
|---|---|
| bits | Sum of bits received |
| packets | Sum of packets received |
AccountD1AnalyticsAdaptiveGroups
Beta. Aggregated D1 analytics with adaptive sampling
| Field | Description |
|---|---|
| avg | The average value for a metric per dimension |
| count | Number of requests to D1 processed |
| dimensions | List of dimensions to group by |
| quantiles | Quantiles of a metric per dimension |
| sum | The sum of values for a metric per dimension |
AccountD1AnalyticsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| queryBatchResponseBytes | The total number of bytes in the response, including all returned rows and metadata (average/mean). |
| queryBatchTimeMs | Query batch response time in milliseconds (average/mean). |
| sampleInterval | The average value used for sample interval |
AccountD1AnalyticsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| databaseId | The UUID of a D1 database |
| date | The date the D1 request was received |
| datetimeFifteenMinutes | The date and time the D1 request was received truncated to fifteen minutes |
| datetimeFiveMinutes | The date and time the D1 request was received truncated to five minutes |
| datetimeHour | The date and time the D1 request was received truncated to the hour |
| datetimeMinute | The date and time the D1 request was received truncated to the minute |
AccountD1AnalyticsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountD1AnalyticsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountD1AnalyticsAdaptiveGroupsQuantiles
| Field | Description |
|---|---|
| queryBatchResponseBytesP50 | The total number of bytes in the response, including all returned rows and metadata (50th percentile). |
| queryBatchResponseBytesP90 | The total number of bytes in the response, including all returned rows and metadata (90th percentile). |
| queryBatchTimeMsP50 | Query batch response time in milliseconds (50th percentile). |
| queryBatchTimeMsP90 | Query batch response time in milliseconds (90th percentile). |
AccountD1AnalyticsAdaptiveGroupsSum
| Field | Description |
|---|---|
| queryBatchResponseBytes | The total number of bytes in the response, including all returned rows and metadata. |
| readQueries | The number of read queries. |
| rowsRead | The number of rows your queries read. |
| rowsWritten | The number of rows your queries wrote. |
| writeQueries | The number of write queries. |
AccountD1QueriesAdaptiveGroups
Beta. D1 query metrics with adaptive sampling
| Field | Description |
|---|---|
| avg | The average value for a metric per dimension |
| count | Number of D1 queries processed |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountD1QueriesAdaptiveGroupsAvg
| Field | Description |
|---|---|
| queryDurationMs | The average duration queries in D1 took, observed over the queried time period. |
| rowsRead | The average number of rows scanned, observed over the queried time period. |
| rowsReturned | The average number of rows returned, observed over the queried time period. |
| rowsWritten | The average number of rows written, observed over the queried time period. |
| sampleInterval | The average value used for sample interval |
AccountD1QueriesAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| databaseId | The UUID of a D1 database |
| date | D1 query sample timestamp |
| datetimeFifteenMinutes | D1 query sample timestamp, truncated to fifteen minutes |
| datetimeFiveMinutes | D1 query sample timestamp, truncated to five minutes |
| datetimeHour | D1 query sample timestamp, truncated to the hour |
| datetimeMinute | D1 query sample timestamp, truncated to the minute |
| query | The SQL query that ran on a D1 database, with parameterized values replaced with placeholders. |
AccountD1QueriesAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountD1QueriesAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountD1QueriesAdaptiveGroupsSum
| Field | Description |
|---|---|
| queryDurationMs | The total duration queries in D1 took, observed over the queried time period. |
| rowsRead | The total number of rows scanned, observed over the queried time period. |
| rowsReturned | The total number of rows returned, observed over the queried time period. |
| rowsWritten | The total number of rows written, observed over the queried time period. |
AccountD1StorageAdaptiveGroups
Beta. D1 storage with adaptive sampling
| Field | Description |
|---|---|
| dimensions | List of dimensions to group by |
| max | The max of values for a metric per dimension |
AccountD1StorageAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| databaseId | The UUID of a D1 database |
| date | D1 storage sample timestamp |
| datetimeFifteenMinutes | D1 storage sample timestamp, truncated to fifteen minutes |
| datetimeFiveMinutes | D1 storage sample timestamp, truncated to five minutes |
| datetimeHour | D1 storage sample timestamp, truncated to the hour |
| datetimeMinute | D1 storage sample timestamp, truncated to the minute |
AccountD1StorageAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountD1StorageAdaptiveGroupsMax
| Field | Description |
|---|---|
| databaseSizeBytes | The maximum size of the database (measured in bytes) observed over the queried time period. |
AccountD1StorageAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountDosdAttackAnalyticsGroups
Attack analytics metadata for attacks detected by dosd
| Field | Description |
|---|---|
| attackId | Unique identifier of the mitigation that matched the packet, if any |
| attackType | DEPRECATED (Use attackVector for a richer description of the attack): Type of attack traffic |
| attackVector | Description of attack vector |
| bits | Sum of bits received during the attack |
| commonTcpFlags | Common TCP flags used by attack traffic, if any |
| commonTcpFlagsNames | Names of common TCP flags used by attack traffic, if any |
| destinationIp | Fixed destination IP used by attack traffic, if any |
| destinationPort | Fixed destination port used by attack traffic, if any |
| droppedBits | Sum of bits dropped during the attack |
| droppedPackets | Sum of packets dropped during the attack |
| endDatetime | Date and time that the attack ended; not available for ongoing attacks |
| ipProtocol | Fixed protocol used by attack traffic, if any |
| ipProtocolName | Fixed protocol used by attack traffic, if any |
| mitigationReason | Type of mitigation applied to attack traffic |
| mitigationScope | Whether mitigation was applied in only some locations or globally |
| mitigationType | Type of mitigation applied to attack traffic |
| packets | Sum of packets received during the attack |
| ruleId | Unique identifier of the rule that matched the packet, if any |
| ruleName | Human-readable name of the rule that matched the packet, if any |
| rulesetId | Unique identifier of the ruleset containing the rule that matched the packet, if any |
| rulesetOverrideId | Unique identifier of the ruleset override containing the rule that matched the packet, if any |
| sourceIp | Fixed source IP used by attack traffic, if any |
| sourcePort | Fixed source port used by attack traffic, if any |
| startDatetime | Date and time that the attack started |
| tcpFlags | Fixed TCP flags used by attack traffic, if any |
| tcpFlagsNames | Names of fixed TCP flags used by attack traffic, if any |
AccountDosdAttackAnalyticsGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountDosdAttackAnalyticsGroupsOrderBy
| Field | Description |
|---|---|
AccountDosdNetworkAnalyticsAdaptiveGroups
Network analytics data for dosd
| Field | Description |
|---|---|
| avg | The average of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountDosdNetworkAnalyticsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
| bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
| bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
| bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
| bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
| bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
| bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
| packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
| packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
| packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
| packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
| packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
| packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
| packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountDosdNetworkAnalyticsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| applicationTag | Application tag associated with the packet |
| attackId | Unique identifier of the mitigation that matched the packet, if any |
| attackVector | Attack vector of the rule that matched the packet, if any |
| coloCity | City where the Cloudflare datacenter that received the packet is located |
| coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
| coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
| coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
| coloName | Cloudflare datacenter that received the packet (unique site identifier) |
| date | Date that the packet was received |
| datetime | Date and time that the packet was received |
| datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
| datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
| datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
| datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
| datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
| destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
| destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
| destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
| destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
| destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
| direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
| ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
| greChecksum | Value of the Checkusm header field in the GRE packet |
| greEthertype | Value of the Ethertype header field in the GRE packet |
| greHeaderLength | Length of the GRE packet header, in bytes |
| greKey | Value of the Key header field in the GRE packet |
| greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
| greVersion | Value of the Version header field in the GRE packet |
| icmpChecksum | Value of the Checkusm header field in the ICMP packet |
| icmpCode | Value of the Code header field in the ICMP packet |
| icmpType | Value of the Type header field in the ICMP packet |
| ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
| ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
| ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
| ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
| ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
| ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
| ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
| ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
| ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
| ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
| ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
| ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
| ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
| ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
| ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
| ipv4Identification | Value of the Identification header field in the IPv4 packet |
| ipv4Options | List of Options numbers included in the IPv4 packet header |
| ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
| ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
| ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
| ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
| ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
| leaseTag | IP lease tag associated with the packet |
| mitigationReason | Reason for applying a mitigation to the packet, if any |
| mitigationScope | Whether the packet matched a local or global mitigation, if any (possible values: local, global) |
| outcome | The action that was taken on the packet (possible values: pass, drop) |
| prefixTag | IP prefix tag associated with the packet |
| protocolState | State of the packet in the context of the protocol, if available |
| ruleId | Unique identifier of the rule that matched the packet, if any |
| ruleName | Human-readable name of the rule that matched the packet, if any |
| rulesetId | Unique identifier of the ruleset containing the rule that matched the packet, if any |
| rulesetOverrideId | Unique identifier of the ruleset override containing the rule that matched the packet, if any |
| sampleInterval | ABR sample interval |
| sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
| sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
| sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
| sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
| sourcePort | Value of the Source Port header field in the TCP or UDP packet |
| tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
| tcpChecksum | Value of the Checkusm header field in the TCP packet |
| tcpDataOffset | Value of the Data Offset header field in the TCP packet |
| tcpFlags | Value of the Flags header field in the TCP packet |
| tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
| tcpMss | Value of the MSS option header field in the TCP packet |
| tcpOptions | List of Options numbers included in the TCP packet header |
| tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
| tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
| tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
| tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
| tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
| tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
| tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
| tcpWindowSize | Value of the Window Size header field in the TCP packet |
| udpChecksum | Value of the Checkusm header field in the UDP packet |
| udpPayloadLength | Value of the Payload Length header field in the UDP packet |
| verdict | The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop) |
AccountDosdNetworkAnalyticsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountDosdNetworkAnalyticsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountDosdNetworkAnalyticsAdaptiveGroupsSum
| Field | Description |
|---|---|
| bits | Sum of bits received |
| packets | Sum of packets received |
AccountDurableObjectsInvocationsAdaptiveGroups
Durable Objects invocations with adaptive sampling
| Field | Description |
|---|---|
| avg | The average value used for sample interval |
| dimensions | List of dimensions to group by |
| max | The max value for a metric |
| min | The min value for a metric |
| quantiles | Quantiles of a metric per dimension |
| sum | The sum of values for a metric per dimension |
AccountDurableObjectsInvocationsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval |
AccountDurableObjectsInvocationsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | Request datetime, truncated to start of a day |
| datetime | Request datetime |
| datetimeHour | Request datetime, truncated to start of an hour |
| datetimeMinute | Request datetime, truncated to start of a minute |
| environmentName | The name of the script environment |
| namespaceId | Durable Object namespace ID |
| objectId | Durable Object ID as a hex string |
| scriptName | The name of the script |
| status | Status of the worker invocation |
AccountDurableObjectsInvocationsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountDurableObjectsInvocationsAdaptiveGroupsMax
| Field | Description |
|---|---|
| responseBodySize | Maximum response body size for one request - bytes |
| wallTime | Maximum wall time for one request - microseconds |
AccountDurableObjectsInvocationsAdaptiveGroupsMin
| Field | Description |
|---|---|
| responseBodySize | Minimum response body size for one request - bytes |
| wallTime | Minimum wall time for one request - microseconds |
AccountDurableObjectsInvocationsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountDurableObjectsInvocationsAdaptiveGroupsQuantiles
| Field | Description |
|---|---|
| responseBodySizeP25 | Response body size 25th percentile - bytes |
| responseBodySizeP50 | Response body size 50th percentile - bytes |
| responseBodySizeP75 | Response body size 75th percentile - bytes |
| responseBodySizeP90 | Response body size 90th percentile - bytes |
| responseBodySizeP99 | Response body size 99th percentile - bytes |
| responseBodySizeP999 | Response body size 99.9th percentile - bytes |
| wallTimeP25 | Wall time 25th percentile - microseconds |
| wallTimeP50 | Wall time 50th percentile - microseconds |
| wallTimeP75 | Wall time 75th percentile - microseconds |
| wallTimeP90 | Wall time 90th percentile - microseconds |
| wallTimeP99 | Wall time 99th percentile - microseconds |
| wallTimeP999 | Wall time 99.9th percentile - microseconds |
AccountDurableObjectsInvocationsAdaptiveGroupsSum
| Field | Description |
|---|---|
| errors | Sum of errors |
| requests | Sum of requests |
| responseBodySize | Sum of response body sizes |
| wallTime | Sum of wall time |
AccountDurableObjectsPeriodicGroups
Durable Objects periodic metrics
| Field | Description |
|---|---|
| dimensions | List of dimensions to group by |
| max | The max value for a metric |
| sum | The sum of values for a metric per dimension |
AccountDurableObjectsPeriodicGroupsDimensions
| Field | Description |
|---|---|
| date | Datetime the metrics period started, truncated to start of a day |
| datetimeHour | Datetime the metrics period started, truncated to start of an hour |
| datetimeMinute | Datetime the metrics period started, truncated to start of a minute |
| namespaceId | Durable Object namespace ID |
| objectId | Durable Object ID as a hex string |
AccountDurableObjectsPeriodicGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountDurableObjectsPeriodicGroupsMax
| Field | Description |
|---|---|
| activeWebsocketConnections | Maximum active websocket connections in the time window |
AccountDurableObjectsPeriodicGroupsOrderBy
| Field | Description |
|---|---|
AccountDurableObjectsPeriodicGroupsSum
| Field | Description |
|---|---|
| activeTime | Sum of active time - microseconds |
| cpuTime | Sum of CPU time - microseconds |
| duration | Sum of Duration - GB*s |
| exceededCpuErrors | Sum of CPU exceeded errors |
| exceededMemoryErrors | Sum of memory exceeded errors |
| fatalInternalErrors | Sum of fatal internal server errors |
| inboundWebsocketMsgCount | Sum of incoming websocket messages |
| outboundWebsocketMsgCount | Sum of outbound websocket messages |
| storageDeletes | Sum of storage deletes |
| storageReadUnits | Sum of storage reads - in 4KB units |
| storageWriteUnits | Sum of storage writes - in 4KB units |
| subrequests | Sum of subrequests |
AccountDurableObjectsStorageGroups
Durable Objects storage metrics
| Field | Description |
|---|---|
| dimensions | List of dimensions to group by |
| max | The sum of values for a metric per dimension |
AccountDurableObjectsStorageGroupsDimensions
| Field | Description |
|---|---|
| date | Datetime that the storage usage was recorded, truncated to start of a day |
| datetimeHour | Datetime that the storage usage was recorded, truncated to start of an hour |
AccountDurableObjectsStorageGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountDurableObjectsStorageGroupsMax
| Field | Description |
|---|---|
| storedBytes | Max of stored bytes |
AccountDurableObjectsStorageGroupsOrderBy
| Field | Description |
|---|---|
AccountDurableObjectsSubrequestsAdaptiveGroups
Durable Objects subrequests with adaptive sampling
| Field | Description |
|---|---|
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountDurableObjectsSubrequestsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | Request datetime, truncated to start of a day |
| datetime | Request datetime |
| datetimeHour | Request datetime, truncated to start of an hour |
| datetimeMinute | Request datetime, truncated to start of a minute |
| environmentName | The name of the script environment |
| namespaceId | Durable Object namespace ID |
| objectId | Durable Object ID as a hex string |
| scriptName | The name of the script |
AccountDurableObjectsSubrequestsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountDurableObjectsSubrequestsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountDurableObjectsSubrequestsAdaptiveGroupsSum
| Field | Description |
|---|---|
| requestBodySizeUncached | Outgoing Durable Objects fetch request body size in bytes where the request was not cached |
AccountFbmAttackAnalyticsGroups
FBM analytics metadata for attacks detected by dosd
| Field | Description |
|---|---|
| attackId | Unique identifier of the mitigation that matched the packet, if any |
| attackType | DEPRECATED (Use attackVector for a richer description of the attack): Type of attack traffic |
| attackVector | Description of attack vector |
| bits | Sum of bits received during the attack |
| commonTcpFlags | Common TCP flags used by attack traffic, if any |
| commonTcpFlagsNames | Names of common TCP flags used by attack traffic, if any |
| destinationIp | Fixed destination IP used by attack traffic, if any |
| destinationPort | Fixed destination port used by attack traffic, if any |
| droppedBits | Sum of bits dropped during the attack |
| droppedPackets | Sum of packets dropped during the attack |
| endDatetime | Date and time that the attack ended; not available for ongoing attacks |
| ipProtocol | Fixed protocol used by attack traffic, if any |
| ipProtocolName | Fixed protocol used by attack traffic, if any |
| mitigationReason | Type of mitigation applied to attack traffic |
| mitigationScope | Whether mitigation was applied in only some locations or globally |
| mitigationType | Type of mitigation applied to attack traffic |
| packets | Sum of packets received during the attack |
| ruleId | Unique identifier of the rule that matched the packet, if any |
| ruleName | Human-readable name of the rule that matched the packet, if any |
| rulesetId | Unique identifier of the ruleset containing the rule that matched the packet, if any |
| rulesetOverrideId | Unique identifier of the ruleset override containing the rule that matched the packet, if any |
| sourceIp | Fixed source IP used by attack traffic, if any |
| sourcePort | Fixed source port used by attack traffic, if any |
| startDatetime | Date and time that the attack started |
| tcpFlags | Fixed TCP flags used by attack traffic, if any |
| tcpFlagsNames | Names of fixed TCP flags used by attack traffic, if any |
AccountFbmAttackAnalyticsGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountFbmAttackAnalyticsGroupsOrderBy
| Field | Description |
|---|---|
AccountFilter_InputObject
| Field | Description |
|---|---|
AccountFirewallEventsAdaptive
Raw Firewall events with adaptive sampling
| Field | Description |
|---|---|
| action | The code of the first-class action the Cloudflare Firewall took on this request |
| apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
| apiGatewayMatchedHost | API Gateway host matched at the edge |
| botDetectionIds | Array of detections ids that matched this request |
| botDetectionTags | Array of detections tags that matched this request |
| botScore | The final score originated from bot management detections. |
| botScoreSrcName | Name of the source detection which generated the bot management score. |
| clientASNDescription | The ASN of the visitor as string |
| clientAsn | The ASN number of the visitor |
| clientCountryName | Country from which request originated |
| clientIP | The visitor's IP address (IPv4 or IPv6) |
| clientIPClass | The classification of the visitor's IP address, possible values are: unknown | clean | badHost | searchEngine | allowlist | greylist | monitoringService | securityScanner | noRecord | scan | backupService | mobilePlatform | tor |
| clientRefererHost | The referer host |
| clientRefererPath | The referer path requested by visitor |
| clientRefererQuery | The referer query-string was requested by the visitor |
| clientRefererScheme | The referer url scheme requested by the visitor |
| clientRequestHTTPHost | The HTTP hostname requested by the visitor |
| clientRequestHTTPMethodName | The HTTP method used by the visitor |
| clientRequestHTTPProtocol | The version of HTTP protocol requested by the visitor |
| clientRequestPath | The path requested by visitor |
| clientRequestQuery | The query-string was requested by the visitor |
| clientRequestScheme | The url scheme requested by the visitor |
| contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
| contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
| contentScanNumObj | Number of scannable content objects |
| contentScanObjResults | Array of scan results in order of detection |
| contentScanObjSizes | Array of scan sizes in order of detection |
| contentScanObjTypes | Array of content types in order of detection |
| date | The date the event occurred at the edge |
| datetime | The date and time the event occurred at the edge |
| datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
| datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
| datetimeHour | The date and time the event occurred at the edge truncated to hours |
| datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
| description | The description of the rule triggered by this request |
| edgeColoName | The airport code of the Cloudflare datacenter that served this request |
| edgeResponseStatus | HTTP response status code returned to browser |
| httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application |
| ja3Hash | MD5 hash of the JA3 TLS fingerprint |
| ja4 | JA4 TLS fingerprint |
| ja4Signals | Inter-request statistics computed for this JA4 across Cloudflare's entire global edge network |
| kind | The kind of event, currently only possible values are: firewall |
| leakedCredentialCheckResult | The distinct result of checking for leaked credentials |
| matchIndex | Rules match index in the chain |
| metadata | Additional product-specific information. Metadata is organized in key:value pairs |
| originResponseStatus | HTTP origin response status code returned to browser |
| originatorRayName | The RayId of the request that issued the challenge/jschallenge |
| rayName | The RayId of the request |
| ref | The ref-field is a user-defined rule identifier that can be set via the API for some firewall products and allows users to label their rules individually alongside cloudflare provided identifiers (only available to entitled customers) |
| ruleId | The Cloudflare security product-specific RuleId triggered by this request |
| rulesetId | The Cloudflare security product-specific RulesetId triggered by this request |
| sampleInterval | ABR sample interval |
| source | The Cloudflare security product triggered by this request |
| userAgent | visitor's user-agent string |
| wafAttackScore | Beta. Overall request score generated by the WAF detection module |
| wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
| wafMlAttackScore | DEPRECATED (Field is replaced with wafAttackScore): Beta. Overall request score generated by the WAF detection module |
| wafMlSqliAttackScore | DEPRECATED (Field is replaced with wafSqliAttackScore): Beta. WAF ML score for an SQLi attack |
| wafMlXssAttackScore | DEPRECATED (Field is replaced with wafXssAttackScore): Beta. WAF ML score for an XSS attack |
| wafRceAttackScore | Beta. WAF score for a RCE attack |
| wafSqliAttackScore | Beta. WAF score for a SQLi attack |
| wafXssAttackScore | Beta. WAF score for a XSS attack |
| zoneTag | Associated zone |
| zoneVersion | The version of a zone |
AccountFirewallEventsAdaptiveFilter_InputObject
| Field | Description |
|---|---|
AccountFirewallEventsAdaptiveGroups
Aggregated Firewall events with adaptive sampling
| Field | Description |
|---|---|
| avg | The average value used for sample interval |
| count | The sum of sample interval values |
| dimensions | List of dimensions to group by |
AccountFirewallEventsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval |
AccountFirewallEventsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| action | The code of the first-class action the Cloudflare Firewall took on this request |
| apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
| apiGatewayMatchedHost | API Gateway host matched at the edge |
| botScore | The final score originated from bot management detections. |
| botScoreSrcName | Name of the source detection which generated the bot management score. |
| clientASNDescription | The ASN of the visitor as string |
| clientAsn | The ASN number of the visitor |
| clientCountryName | Country from which request originated |
| clientIP | The visitor's IP address (IPv4 or IPv6) |
| clientIPClass | The classification of the visitor's IP address, possible values are: unknown | clean | badHost | searchEngine | allowlist | greylist | monitoringService | securityScanner | noRecord | scan | backupService | mobilePlatform | tor |
| clientRefererHost | The referer host |
| clientRefererPath | The referer path requested by visitor |
| clientRefererQuery | The referer query-string was requested by the visitor |
| clientRefererScheme | The referer url scheme requested by the visitor |
| clientRequestHTTPHost | The HTTP hostname requested by the visitor |
| clientRequestHTTPMethodName | The HTTP method used by the visitor |
| clientRequestHTTPProtocol | The version of HTTP protocol requested by the visitor |
| clientRequestPath | The path requested by visitor |
| clientRequestQuery | The query-string was requested by the visitor |
| clientRequestScheme | The url scheme requested by the visitor |
| contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
| contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
| contentScanNumObj | Number of scannable content objects |
| contentScanObjResults | Array of scan results in order of detection |
| contentScanObjSizes | Array of scan sizes in order of detection |
| contentScanObjTypes | Array of content types in order of detection |
| date | The date the event occurred at the edge |
| datetime | The date and time the event occurred at the edge |
| datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
| datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
| datetimeHour | The date and time the event occurred at the edge truncated to hours |
| datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
| description | The description of the rule triggered by this request |
| edgeColoName | The airport code of the Cloudflare datacenter that served this request |
| edgeResponseStatus | HTTP response status code returned to browser |
| httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application |
| ja3Hash | MD5 hash of the JA3 TLS fingerprint |
| ja4 | JA4 TLS fingerprint |
| kind | The kind of event, currently only possible values are: firewall |
| matchIndex | Rules match index in the chain |
| originResponseStatus | HTTP origin response status code returned to browser |
| originatorRayName | The RayId of the request that issued the challenge/jschallenge |
| rayName | The RayId of the request |
| ref | The ref-field is a user-defined rule identifier that can be set via the API for some firewall products and allows users to label their rules individually alongside cloudflare provided identifiers (only available to entitled customers) |
| ruleId | The Cloudflare security product-specific RuleId triggered by this request |
| rulesetId | The Cloudflare security product-specific RulesetId triggered by this request |
| sampleInterval | ABR sample interval |
| source | The Cloudflare security product triggered by this request |
| userAgent | visitor's user-agent string |
| wafAttackScore | Beta. Overall request score generated by the WAF detection module |
| wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
| wafMlAttackScore | DEPRECATED (Field is replaced with wafAttackScore): Beta. Overall request score generated by the WAF ML detection module |
| wafMlSqliAttackScore | DEPRECATED (Field is replaced with wafSqliAttackScore): Beta. WAF ML score for an SQLi attack |
| wafMlXssAttackScore | DEPRECATED (Field is replaced with wafXssAttackScore): Beta. WAF ML score for an XSS attack |
| wafRceAttackScore | Beta. WAF score for a RCE attack |
| wafSqliAttackScore | Beta. WAF score for a SQLi attack |
| wafXssAttackScore | Beta. WAF score for a XSS attack |
| zoneTag | Associated zone |
| zoneVersion | The version of a zone |
AccountFirewallEventsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountFirewallEventsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountFirewallEventsAdaptiveJa4SignalsElem
| Field | Description |
|---|---|
| signalName | Signal name |
| signalValue | Signal value |
AccountFirewallEventsAdaptiveMetadataElem
| Field | Description |
|---|---|
| key | The key of the metadata. Key format can vary by Cloudflare security product and can change over time. |
| value | The value of the metadata. Value format can vary by Cloudflare security product and can change over time. |
AccountFirewallEventsAdaptiveOrderBy
| Field | Description |
|---|---|
AccountFlowtrackdNetworkAnalyticsAdaptiveGroups
Network analytics data for flowtrackd
| Field | Description |
|---|---|
| avg | The average of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
| bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
| bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
| bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
| bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
| bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
| bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
| packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
| packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
| packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
| packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
| packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
| packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
| packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| applicationTag | Application tag associated with the packet |
| coloCity | City where the Cloudflare datacenter that received the packet is located |
| coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
| coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
| coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
| coloName | Cloudflare datacenter that received the packet (unique site identifier) |
| date | Date that the packet was received |
| datetime | Date and time that the packet was received |
| datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
| datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
| datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
| datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
| datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
| destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
| destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
| destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
| destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
| destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
| direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
| ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
| greChecksum | Value of the Checkusm header field in the GRE packet |
| greEthertype | Value of the Ethertype header field in the GRE packet |
| greHeaderLength | Length of the GRE packet header, in bytes |
| greKey | Value of the Key header field in the GRE packet |
| greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
| greVersion | Value of the Version header field in the GRE packet |
| icmpChecksum | Value of the Checkusm header field in the ICMP packet |
| icmpCode | Value of the Code header field in the ICMP packet |
| icmpType | Value of the Type header field in the ICMP packet |
| ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
| ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
| ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
| ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
| ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
| ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
| ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
| ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
| ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
| ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
| ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
| ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
| ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
| ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
| ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
| ipv4Identification | Value of the Identification header field in the IPv4 packet |
| ipv4Options | List of Options numbers included in the IPv4 packet header |
| ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
| ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
| ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
| ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
| ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
| leaseTag | IP lease tag associated with the packet |
| mitigationReason | Reason for applying a mitigation to the packet, if any |
| mitigationScope | Whether the packet matched a local or global mitigation, if any (possible values: local, global) |
| outcome | The action that was taken on the packet (possible values: pass, drop) |
| prefixTag | IP prefix tag associated with the packet |
| protocolState | State of the packet in the context of the protocol, if available |
| sampleInterval | ABR sample interval |
| sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
| sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
| sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
| sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
| sourcePort | Value of the Source Port header field in the TCP or UDP packet |
| tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
| tcpChecksum | Value of the Checkusm header field in the TCP packet |
| tcpDataOffset | Value of the Data Offset header field in the TCP packet |
| tcpFlags | Value of the Flags header field in the TCP packet |
| tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
| tcpMss | Value of the MSS option header field in the TCP packet |
| tcpOptions | List of Options numbers included in the TCP packet header |
| tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
| tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
| tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
| tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
| tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
| tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
| tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
| tcpWindowSize | Value of the Window Size header field in the TCP packet |
| udpChecksum | Value of the Checkusm header field in the UDP packet |
| udpPayloadLength | Value of the Payload Length header field in the UDP packet |
| verdict | The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop) |
AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsSum
| Field | Description |
|---|---|
| bits | Sum of bits received |
| packets | Sum of packets received |
AccountGatewayL4DownstreamSessionsAdaptiveGroups
Aggregated metrics about downstream (client to edge) L4 Gateway Sessions. Metrics are reported on TCP or UDP session close
| Field | Description |
|---|---|
| count | The number of downstream sessions |
| dimensions | List of dimensions to group by |
| quantiles | |
| sum |
AccountGatewayL4DownstreamSessionsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| coloCode | IATA Airport code that represents the city in which a Cloudflare data center (colo) is located |
| coloCountry | ISO 3166-1 alpha-2 code that represents the country in which a Cloudflare data center (colo) is located |
| date | Start timestamp of this session, truncated to date |
| datetimeFifteenMinutes | Start timestamp of this session, truncated to multiple of 15 minutes |
| datetimeFiveMinutes | Start timestamp of this session, truncated to multiple of 5 minutes |
| datetimeHour | Start timestamp of this session, truncated to the hour |
| datetimeMinute | Start timestamp of this session, truncated to the minute |
| quicErrorCode | QUIC specific error code. Possible values are https://www.iana.org/assignments/quic/quic.xhtml#quic-transport-error-codes |
| rttUs | Last Round Trip Time estimation for this session in microseconds |
| sessionId | Identifier for this session |
| sourceIP | IP address of the client making this session |
| tokenAuthStatus | Client token authentication status. Possible values are success | failed with invalid token and upto date token key ID | failed with invalid token due to outdated/missing token key ID | failed due to reused token |
| tokenSigningRegion | Broad location assigned to client in this session |
| transport | Transport protocol used for this session. Possible values are tcp | quic | udp |
| transportHandshakeDurationUs | Time taken for TCP/TLS or QUIC handshake in microsecond |
| transportStatus | Transport Status. Possible values are unknown | success | failure |
AccountGatewayL4DownstreamSessionsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountGatewayL4DownstreamSessionsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountGatewayL4DownstreamSessionsAdaptiveGroupsQuantiles
| Field | Description |
|---|---|
| tokenAuthDurationUsP50 | Time taken for Client Token Authentication in microseconds |
| transportHandshakeDurationUsP50 | Time taken for TCP/TLS or QUIC handshake in microseconds |
AccountGatewayL4DownstreamSessionsAdaptiveGroupsSum
| Field | Description |
|---|---|
| bytesRecvd | Total bytes received in this session |
| bytesSent | Total bytes sent in this session |
| clientBytesRetransmitted | Total bytes retransmitted by client in this session |
| packetsRecvd | Total number of packets received in this session |
| packetsSent | Total number of packets sent in this session |
| tokenAuthDurationUs | Time taken for client token authentication in microseconds |
AccountGatewayL4SessionsAdaptiveGroups
BETA - Aggregate counts of Gateway L4 sessions with adaptive sampling
| Field | Description |
|---|---|
| count | The number of Gateway L4 sessions |
| dimensions | List of dimensions to group by |
AccountGatewayL4SessionsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| action | action taken by gateway |
| coloCode | Colo Code of edge server |
| datetime | Datetime that the session was started |
| datetimeHour | Datetime that the session was started truncated to hours |
| datetimeMinute | Datetime that the session was started truncated to minutes |
| destinationIp | The destination IP address for the session |
| destinationPort | The destination port for the session |
| detectedProtocol | The detected protocol of network traffic |
| deviceId | The device ID of the gateway user who initiated the session |
| The email address of the gateway user who initiated the session | |
| sni | The SNI pulled from the session tls handshake, if present |
| sourceInternalIp | Local LAN IP of the device. Only available when connected via a GRE/IPsec tunnel on-ramp |
| sourceIp | The source IP address for the session |
| sourcePort | The source port for the session |
| transport | The transport protocol used in the session, one of (0, tcp) (1, quic) (2, udp) |
| userId | The ID of the gateway user who initiated the session |
AccountGatewayL4SessionsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountGatewayL4SessionsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountGatewayL4UpstreamSessionsAdaptiveGroups
Aggregated metrics about upstream (edge to client) L4 Gateway Sessions. Metrics are reported on TCP, QUIC or UDP session close
| Field | Description |
|---|---|
| count | The number of upstream sessions |
| dimensions | List of dimensions to group by |
| quantiles | |
| sum |
AccountGatewayL4UpstreamSessionsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| coloCode | IATA Airport code that represents the city in which a Cloudflare data center (colo) is located |
| coloCountry | ISO 3166-1 alpha-2 code that represents the country in which a Cloudflare data center (colo) is located |
| date | Start timestamp of this session, truncated to date |
| datetimeFifteenMinutes | Start timestamp of this session, truncated to multiple of 15 minutes |
| datetimeFiveMinutes | Start timestamp of this session, truncated to multiple of 5 minutes |
| datetimeHour | Start timestamp of this session, truncated to the hour |
| datetimeMinute | Start timestamp of this session, truncated to the minute |
| destinationIP | IP address of the origin server |
| domainName | SNI domain name for this session |
| downstreamSessionId | Downstream session identifier of this session |
| httpConnectReqStatus | Client HTTP CONNECT request status. Possible values are unknown | success | failure |
| quicErrorCode | QUIC error code. Possible values are https://www.iana.org/assignments/quic/quic.xhtml#quic-transport-error-codes |
| rttUs | Last Round Trip Time estimation for this session in microseconds |
| tokenSigningRegion | Broad location assigned to client in this session |
| totalTunnelSetupDurationUs | Total time taken for tunnel setup in microseconds |
| transport | Transport protocol used for this session. Possible values are tcp | quic | udp |
| transportStatus | Transport status. Possible values are unknown | success | failure |
AccountGatewayL4UpstreamSessionsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountGatewayL4UpstreamSessionsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountGatewayL4UpstreamSessionsAdaptiveGroupsQuantiles
| Field | Description |
|---|---|
| connectReqHandlingDurationUsP50 | Time taken for CONNECT request handling in microseconds |
| totalTunnelSetupDurationUsP50 | Total time taken for tunnel setup in microseconds |
| tunnelSetupDurationUsP50 | Time taken to setup the tunnel in microseconds |
AccountGatewayL4UpstreamSessionsAdaptiveGroupsSum
| Field | Description |
|---|---|
| bytesRecvd | Total bytes received in this session |
| bytesSent | Total bytes sent in this session |
| connectReqHandlingDurationUs | Time taken for CONNECT request handling in microseconds |
| originBytesRetransmitted | Total bytes retransmitted by origin in this session |
| packetsRecvd | Total number of packets received in this session |
| packetsSent | Total number of packets sent in this session |
| totalTunnelSetupDurationUs | Total time taken for tunnel setup in microseconds |
| tunnelSetupDurationUs | Time taken for tunnel setup in microseconds |
AccountGatewayL7RequestsAdaptiveGroups
BETA - Aggregate counts of Gateway L7 requests with adaptive sampling
| Field | Description |
|---|---|
| count | The number of Gateway L7 requests |
| dimensions | List of dimensions to group by |
AccountGatewayL7RequestsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| action | action taken by gateway |
| coloCode | Colo Code of edge server |
| datetime | Datetime that the request happened |
| datetimeHour | Datetime that the request happened truncated to hours |
| datetimeMinute | Datetime that the request happened truncated to minutes |
| deviceId | The device ID of the gateway user who made the request |
| The email address of the gateway user who made the request | |
| httpHost | The destination host for the request |
| httpStatusCode | HTTP status code gateway returned to the user. 0 if nothing was returned(e.g client disconnected) |
| isIsolated | Indicates whether this request was made through an isolated link |
| sourceInternalIp | Local LAN IP of the device. Only available when connected via a GRE/IPsec tunnel on-ramp |
| untrustedCertificateAction | Action taken when an untrusted origin certificate error occurs |
| userId | The ID of the gateway user who made the request |
AccountGatewayL7RequestsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountGatewayL7RequestsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountGatewayResolverByCategoryAdaptiveGroups
BETA - Aggregate counts of Gateway Resolver queries by category with adaptive sampling
| Field | Description |
|---|---|
| count | The number of Gateway Resolver queries |
| dimensions | List of dimensions to group by |
AccountGatewayResolverByCategoryAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| categoryId | ID of the category that was assigned to the domain |
| datetime | The date and time the DNS query was resolved |
| datetimeHour | The date and time the event occurred at the edge truncated to hours |
| datetimeMinute | The date and time the event occurred at the edge truncated to minutes |
| locationId | The uuid identifying the customer Location used when resolving |
| resolverDecision | Enum identifier for the decision made by gateway-resolver, one of: (0, unknown) (1, allowedByQueryName) (2, blockedByQueryName) (3, blockedByCategory) (4, allowedOnNoLocation) (5, allowedOnNoPolicyMatch) (6, blockedAlwaysCategory) (7, overrideForSafeSearch) (8, overrideApplied) (9, blockedRule) (10, allowedRule) |
AccountGatewayResolverByCategoryAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountGatewayResolverByCategoryAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountGatewayResolverByCustomResolverGroups
Stats on dns custom resolvers
| Field | Description |
|---|---|
| avg | The average value for a metric |
| count | The number of Gateway Resolver queries |
| dimensions | List of dimensions to group by |
| max | Maximum response time |
AccountGatewayResolverByCustomResolverGroupsAvg
| Field | Description |
|---|---|
| customResolverTimeInMs | Average latency |
| sampleInterval | Average sample interval |
AccountGatewayResolverByCustomResolverGroupsDimensions
| Field | Description |
|---|---|
| cacheStatus | whether the response was cached or not |
| customResolverAddress | address at which custom resolver query was resolved at |
| customResolverResponseCode | Response code recieved from the custom resolver 0 => unknown 27 => dnsFirewallSuccess 29 => dnsFirewallCustomerRatelimit 31 => dnsFirewallUpstreamFailure 32 => dnsFirewallUpstreamServfail |
| customResolverTimeInMs | time took for custom resolver to respond |
| datetime | The date and time the DNS query was resolved |
| locationId | The uuid identifying the customer Location used when resolving |
| queryName | Name of the query, e.g. one.dash.cloudflare.com |
| resolverDecision | Enum identifier for the decision made by gateway-resolver, one of: (0, unknown) (1, allowedByQueryName) (2, blockedByQueryName) (3, blockedByCategory) (4, allowedOnNoLocation) (5, allowedOnNoPolicyMatch) (6, blockedAlwaysCategory) (7, overrideForSafeSearch) (8, overrideApplied) (9, blockedRule) (10, allowedRule) |
AccountGatewayResolverByCustomResolverGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountGatewayResolverByCustomResolverGroupsMax
| Field | Description |
|---|---|
| customResolverTimeInMs | Maximum response time |
AccountGatewayResolverByCustomResolverGroupsOrderBy
| Field | Description |
|---|---|
AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroups
Total time spent on executing firewall rules at the edge
| Field | Description |
|---|---|
| avg | The average value for a metric per dimension |
| count | The number of Gateway Resolver queries |
| dimensions | List of dimensions to group by |
| max | Maximum execution time |
| quantiles | Quantiles of a rule execution performance |
AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval | Average sample interval |
AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| datetime | Request timestamp |
| datetimeMonth | Request timestamp month |
AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsMax
| Field | Description |
|---|---|
| executionTime | Maximum execution time |
AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsQuantiles
| Field | Description |
|---|---|
| executionTimeMsP25 | Execution time performance of 25th percentile in milliseconds |
| executionTimeMsP50 | Execution time performance of 50th percentile in milliseconds |
| executionTimeMsP75 | Execution time performance of 75th percentile in milliseconds |
| executionTimeMsP90 | Execution time performance of 90th percentile in milliseconds |
| executionTimeMsP95 | Execution time performance of 95th percentile in milliseconds |
| executionTimeMsP98 | Execution time performance of 98th percentile in milliseconds |
| executionTimeMsP99 | Execution time performance of 99th percentile in milliseconds |
AccountGatewayResolverQueriesAdaptiveGroups
BETA - Aggregate counts of Gateway Resolver queries with adaptive sampling
| Field | Description |
|---|---|
| count | The number of Gateway Resolver queries |
| dimensions | List of dimensions to group by |
AccountGatewayResolverQueriesAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| categoryIds | Json array of categories for this query |
| datetime | The date and time the DNS query was resolved |
| datetimeHour | The date and time the event occurred at the edge truncated to hours |
| datetimeMinute | The date and time the event occurred at the edge truncated to minutes |
| locationId | The uuid identifying the customer Location used when resolving |
| matchedIndicatorFeedIds | Json array of indicator feed IDs for this query that matched rule |
| queryName | Name of the query, e.g. one.dash.cloudflare.com |
| queryNameReversed | Name of the query in reverse order, e.g. com.cloudflare.dash.one |
| resolverDecision | Enum identifier for the decision made by gateway-resolver, one of: (0, unknown) (1, allowedByQueryName) (2, blockedByQueryName) (3, blockedByCategory) (4, allowedOnNoLocation) (5, allowedOnNoPolicyMatch) (6, blockedAlwaysCategory) (7, overrideForSafeSearch) (8, overrideApplied) (9, blockedRule) (10, allowedRule) |
| scheduleInfo | Json object of schedule releated information |
AccountGatewayResolverQueriesAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountGatewayResolverQueriesAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountHttpRequests1dGroups
Daily rollups of request data
| Field | Description |
|---|---|
| avg | The average value for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
| uniq | The number of unique values for a metric per dimension |
AccountHttpRequests1dGroupsAvg
| Field | Description |
|---|---|
| bytes | |
| sampleInterval | Average sample interval |
AccountHttpRequests1dGroupsBrowserMapElem
| Field | Description |
|---|---|
| pageViews | Successful requests for HTML content |
| uaBrowserFamily | Browser type |
AccountHttpRequests1dGroupsClientHTTPVersionMapElem
| Field | Description |
|---|---|
| clientHTTPProtocol | HTTP version |
| requests |
AccountHttpRequests1dGroupsClientSSLMapElem
| Field | Description |
|---|---|
| clientSSLProtocol | Protocol version |
| requests |
AccountHttpRequests1dGroupsContentTypeMapElem
| Field | Description |
|---|---|
| bytes | Bytes returned to client |
| edgeResponseContentTypeName | Content type returned to client |
| requests |
AccountHttpRequests1dGroupsCountryMapElem
| Field | Description |
|---|---|
| bytes | Bytes returned to client |
| clientCountryName | Country from which request originated |
| requests | |
| threats | Requests classified as threats |
AccountHttpRequests1dGroupsDimensions
| Field | Description |
|---|---|
| date | Request date |
AccountHttpRequests1dGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountHttpRequests1dGroupsIpClassMapElem
| Field | Description |
|---|---|
| ipType | IP class |
| requests |
AccountHttpRequests1dGroupsOrderBy
| Field | Description |
|---|---|
AccountHttpRequests1dGroupsResponseStatusMapElem
| Field | Description |
|---|---|
| edgeResponseStatus | HTTP response status code returned to client |
| requests |
AccountHttpRequests1dGroupsSum
| Field | Description |
|---|---|
| browserMap | |
| bytes | Bytes returned to client |
| cachedBytes | Bytes returned to client from cache |
| cachedRequests | Requests served from cache |
| clientHTTPVersionMap | |
| clientSSLMap | |
| contentTypeMap | |
| countryMap | |
| encryptedBytes | Bytes returned to client using SSL/TLS protocol |
| encryptedRequests | Requests served using SSL/TLS protocol |
| ipClassMap | |
| pageViews | Successful requests for HTML content |
| requests | |
| responseStatusMap | |
| threatPathingMap | |
| threats | Requests classified as threats |
AccountHttpRequests1dGroupsThreatPathingMapElem
| Field | Description |
|---|---|
| requests | |
| threatPathingName | Threat type |
AccountHttpRequests1dGroupsUniq
| Field | Description |
|---|---|
| uniques | A number of unique IPs |
AccountHttpRequests1hGroups
Hourly rollups of request data
| Field | Description |
|---|---|
| avg | The average value for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
| uniq | The number of unique values for a metric per dimension |
AccountHttpRequests1hGroupsAvg
| Field | Description |
|---|---|
| bytes | |
| sampleInterval | Average sample interval |
AccountHttpRequests1hGroupsBrowserMapElem
| Field | Description |
|---|---|
| pageViews | Successful requests for HTML content |
| uaBrowserFamily | Browser type |
AccountHttpRequests1hGroupsClientHTTPVersionMapElem
| Field | Description |
|---|---|
| clientHTTPProtocol | HTTP version |
| requests |
AccountHttpRequests1hGroupsClientSSLMapElem
| Field | Description |
|---|---|
| clientSSLProtocol | Protocol version |
| requests |
AccountHttpRequests1hGroupsContentTypeMapElem
| Field | Description |
|---|---|
| bytes | Bytes returned to client |
| edgeResponseContentTypeName | Content type returned to client |
| requests |
AccountHttpRequests1hGroupsCountryMapElem
| Field | Description |
|---|---|
| bytes | Bytes returned to client |
| clientCountryName | Country from which request originated |
| requests | |
| threats | Requests classified as threats |
AccountHttpRequests1hGroupsDimensions
| Field | Description |
|---|---|
| date | Request date |
| datetime | Request datetime truncated to the hour |
AccountHttpRequests1hGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountHttpRequests1hGroupsIpClassMapElem
| Field | Description |
|---|---|
| ipType | IP class |
| requests |
AccountHttpRequests1hGroupsOrderBy
| Field | Description |
|---|---|
AccountHttpRequests1hGroupsResponseStatusMapElem
| Field | Description |
|---|---|
| edgeResponseStatus | HTTP response status code returned to client |
| requests |
AccountHttpRequests1hGroupsSum
| Field | Description |
|---|---|
| browserMap | |
| bytes | Bytes returned to client |
| cachedBytes | Bytes returned to client from cache |
| cachedRequests | Requests served from cache |
| clientHTTPVersionMap | |
| clientSSLMap | |
| contentTypeMap | |
| countryMap | |
| encryptedBytes | Bytes returned to client using SSL/TLS protocol |
| encryptedRequests | Requests served using SSL/TLS protocol |
| ipClassMap | |
| pageViews | Successful requests for HTML content |
| requests | |
| responseStatusMap | |
| threatPathingMap | |
| threats | Requests classified as threats |
AccountHttpRequests1hGroupsThreatPathingMapElem
| Field | Description |
|---|---|
| requests | |
| threatPathingName | Threat type |
AccountHttpRequests1hGroupsUniq
| Field | Description |
|---|---|
| uniques | A number of unique IPs |
AccountHttpRequests1mGroups
Minutely rollups of request data
| Field | Description |
|---|---|
| avg | The average value for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
| uniq | The number of unique values for a metric per dimension |
AccountHttpRequests1mGroupsAvg
| Field | Description |
|---|---|
| bytes | |
| sampleInterval | Average sample interval |
AccountHttpRequests1mGroupsBrowserMapElem
| Field | Description |
|---|---|
| pageViews | Successful requests for HTML content |
| uaBrowserFamily | Browser type |
AccountHttpRequests1mGroupsClientHTTPVersionMapElem
| Field | Description |
|---|---|
| clientHTTPProtocol | HTTP version |
| requests |
AccountHttpRequests1mGroupsClientSSLMapElem
| Field | Description |
|---|---|
| clientSSLProtocol | Protocol version |
| requests |
AccountHttpRequests1mGroupsContentTypeMapElem
| Field | Description |
|---|---|
| bytes | Bytes returned to client |
| edgeResponseContentTypeName | Content type returned to client |
| requests |
AccountHttpRequests1mGroupsCountryMapElem
| Field | Description |
|---|---|
| bytes | Bytes returned to client |
| clientCountryName | Country from which request originated |
| requests | |
| threats | Requests classified as threats |
AccountHttpRequests1mGroupsDimensions
| Field | Description |
|---|---|
| date | Request date |
| datetime | Request datetime, truncated to the minute |
| datetimeDay | Request datetime truncated to the day |
| datetimeFifteenMinutes | Request datetime truncated to multiple of 15 minutes |
| datetimeFiveMinutes | Request datetime truncated to multiple of 5 minutes |
| datetimeHalfOfHour | Request datetime truncated to multiple of 30 minutes |
| datetimeHour | Request datetime truncated to the hour |
| datetimeMinute | DEPRECATED (Field is replaced with datetime): Request datetime truncated to the minute |
AccountHttpRequests1mGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountHttpRequests1mGroupsIpClassMapElem
| Field | Description |
|---|---|
| ipType | IP class |
| requests |
AccountHttpRequests1mGroupsOrderBy
| Field | Description |
|---|---|
AccountHttpRequests1mGroupsResponseStatusMapElem
| Field | Description |
|---|---|
| edgeResponseStatus | HTTP response status code returned to client |
| requests |
AccountHttpRequests1mGroupsSum
| Field | Description |
|---|---|
| browserMap | |
| bytes | Bytes returned to client |
| cachedBytes | Bytes returned to client from cache |
| cachedRequests | Requests served from cache |
| clientHTTPVersionMap | |
| clientSSLMap | |
| contentTypeMap | |
| countryMap | |
| encryptedBytes | Bytes returned to client using SSL/TLS protocol |
| encryptedRequests | Requests served using SSL/TLS protocol |
| ipClassMap | |
| pageViews | Successful requests for HTML content |
| requests | |
| responseStatusMap | |
| threatPathingMap | |
| threats | Requests classified as threats |
AccountHttpRequests1mGroupsThreatPathingMapElem
| Field | Description |
|---|---|
| requests | |
| threatPathingName | Threat type |
AccountHttpRequests1mGroupsUniq
| Field | Description |
|---|---|
| uniques | A number of unique IPs |
AccountHttpRequestsAdaptive
Raw HTTP requests with adaptive sampling
| Field | Description |
|---|---|
| apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
| apiGatewayMatchedHost | API Gateway host matched at the edge |
| botDetectionIds | Array of detections ids that matched this request |
| botDetectionTags | Array of detections tags that matched this request |
| botManagementDecision | Judgement of the bot management system |
| botScore | The final score originated from bot management detections. |
| botScoreBucketBy10 | Range of the bot management score |
| botScoreSrcName | Name of the source detection which generated the bot management score. |
| cacheReserveUsed | Used Cache Reserve to serve the response |
| cacheStatus | Cache status |
| clientASNDescription | The ASN of the visitor as string |
| clientAsn | The ASN number of the visitor |
| clientCountryName | Country from which request originated |
| clientDeviceType | |
| clientIP | The visitor's IP address (IPv4 or IPv6) |
| clientRefererHost | The referrer host |
| clientRequestHTTPHost | The HTTP hostname requested by the visitor |
| clientRequestHTTPMethodName | HTTP method of client request |
| clientRequestHTTPProtocol | The version of HTTP protocol requested by the visitor |
| clientRequestPath | The path requested by visitor |
| clientRequestQuery | Query parameters of client request |
| clientRequestReferer | HTTP request referrer |
| clientRequestScheme | The url scheme requested by the visitor |
| clientSSLProtocol | SSL protocol version |
| coloCode | |
| contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
| contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
| contentScanNumObj | Number of scannable content objects |
| contentScanObjResults | Array of scan results in order of detection |
| contentScanObjSizes | Array of scan sizes in order of detection |
| contentScanObjTypes | Array of content types in order of detection |
| date | The date the event occurred at the edge |
| datetime | The date and time the event occurred at the edge |
| datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
| datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
| datetimeHour | The date and time the event occurred at the edge truncated to hours |
| datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
| edgeDnsResponseTimeMs | The time elapsed resolving a CNAME if it was required to reach your origin |
| edgeResponseContentTypeName | |
| edgeResponseStatus | HTTP response status code returned to browser |
| edgeTimeToFirstByteMs | The time elapsed between processing the first byte of the request until when we started sending a response |
| httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application |
| isCrossZoneSubrequest | '1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise. |
| ja3Hash | MD5 hash of the JA3 TLS fingerprint |
| ja4 | JA4 TLS fingerprint |
| ja4Signals | Inter-request statistics computed for this JA4 across Cloudflare's entire global edge network |
| leakedCredentialCheckResult | The distinct result of checking for leaked credentials |
| originASN | |
| originASNDescription | ASN associated with origin |
| originIP | |
| originResponseDurationMs | |
| originResponseStatus | HTTP origin response status code returned to browser |
| rayName | The RayId of the request |
| requestSource | |
| securityAction | The code of the first-class action the Cloudflare Firewall took on this request |
| securitySource | The Cloudflare security product triggered by this request |
| upperTierColoName | |
| userAgent | visitor's user-agent string |
| userAgentBrowser | Browser parsed from the user agent |
| userAgentOS | OS parsed from the user agent |
| wafAttackScore | Beta. Overall request score generated by the WAF detection module |
| wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
| wafRceAttackScore | Beta. WAF score for a RCE attack |
| wafSqliAttackScore | Beta. WAF score for a SQLi attack |
| wafXssAttackScore | Beta. WAF score for a XSS attack |
| xRequestedWith | The X-Requested-With header of the client request |
| zoneTag | Associated zone |
| zoneVersion | The version of a zone |
AccountHttpRequestsAdaptiveFilter_InputObject
| Field | Description |
|---|---|
AccountHttpRequestsAdaptiveGroups
Aggregated HTTP requests data with adaptive sampling
| Field | Description |
|---|---|
| avg | The average value used for sample interval |
| confidence | ALPHA - DO NOT USE |
| count | The number of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| quantiles | Quantiles of a metric per dimension |
| ratio | The ratio of a range of status codes, between 0 and 1 |
| sum | The sum of values for a metric per dimension |
AccountHttpRequestsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| crossZoneSubrequests | The proportion of requests that were inititiated by a Cloudflare Worker on another zone |
| edgeDnsResponseTimeMs | |
| edgeTimeToFirstByteMs | |
| originResponseDurationMs | The average originResponseDuration, in milliseconds, excluding 0 values (i.e. cached ones) |
| sampleInterval |
AccountHttpRequestsAdaptiveGroupsConfidence
| Field | Description |
|---|---|
| count | The number of values for a metric per dimension, with confidence intervals |
| level | Confidence level that was requested |
| sum | The sum of values for a metric per dimension, with confidence intervals |
AccountHttpRequestsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
| apiGatewayMatchedHost | API Gateway host matched at the edge |
| botManagementDecision | Judgement of the bot management system |
| botScore | The final score originated from bot management detections. |
| botScoreBucketBy10 | Range of the bot management score |
| botScoreSrcName | Name of the source detection which generated the bot management score. |
| cacheReserveUsed | Used Cache Reserve to serve the response |
| cacheStatus | |
| clientASNDescription | The ASN of the visitor as string |
| clientAsn | |
| clientCountryName | Country from which request originated |
| clientDeviceType | |
| clientIP | |
| clientRefererHost | The referrer host |
| clientRequestHTTPHost | Host requested by the client |
| clientRequestHTTPMethodName | HTTP method of client request |
| clientRequestHTTPProtocol | HTTP protocol version |
| clientRequestPath | Path of client request |
| clientRequestQuery | Query parameters of client request |
| clientRequestReferer | HTTP request referrer |
| clientRequestScheme | HTTP request URI scheme (http/https) |
| clientSSLProtocol | SSL protocol version |
| coloCode | |
| contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
| contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
| contentScanNumObj | Number of scannable content objects |
| contentScanObjResults | Array of scan results in order of detection |
| contentScanObjSizes | Array of scan sizes in order of detection |
| contentScanObjTypes | Array of content types in order of detection |
| date | The date the event occurred at the edge |
| datetime | The date and time the event occurred at the edge |
| datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
| datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
| datetimeHour | The date and time the event occurred at the edge truncated to hours |
| datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
| edgeDnsResponseTimeMs | The time elapsed resolving a CNAME if it was required to reach your origin |
| edgeResponseContentTypeName | |
| edgeResponseStatus | |
| edgeTimeToFirstByteMs | The time elapsed between processing the first byte of the request until when we started sending a response |
| httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application |
| isCrossZoneSubrequest | '1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise. |
| ja3Hash | MD5 hash of the JA3 TLS fingerprint |
| ja4 | JA4 TLS fingerprint |
| leakedCredentialCheckResult | The distinct result of checking for leaked credentials |
| originASN | |
| originASNDescription | ASN associated with origin |
| originIP | |
| originResponseDurationMs | |
| originResponseStatus | HTTP response status code returned by the origin |
| requestSource | |
| sampleInterval | ABR sample interval |
| securityAction | The code of the first-class action the Cloudflare Firewall took on this request |
| securitySource | The Cloudflare security product triggered by this request |
| upperTierColoName | |
| userAgent | |
| userAgentBrowser | Browser parsed from the user agent |
| userAgentOS | OS parsed from the user agent |
| wafAttackScore | Beta. Overall request score generated by the WAF detection module |
| wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
| wafRceAttackScore | Beta. WAF score for a RCE attack |
| wafSqliAttackScore | Beta. WAF score for a SQLi attack |
| wafXssAttackScore | Beta. WAF score for a XSS attack |
| xRequestedWith | The X-Requested-With header of the client request |
| zoneTag | Associated zone |
| zoneVersion | The version of a zone |
AccountHttpRequestsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountHttpRequestsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountHttpRequestsAdaptiveGroupsQuantiles
| Field | Description |
|---|---|
| edgeDnsResponseTimeMsP50 | 50th percentile DNS Response Time (milliseconds) |
| edgeDnsResponseTimeMsP95 | 95th percentile DNS Response Time (milliseconds) |
| edgeDnsResponseTimeMsP99 | 99th percentile DNS Response Time (milliseconds) |
| edgeTimeToFirstByteMsP50 | 50th percentile Time To First Byte (milliseconds) |
| edgeTimeToFirstByteMsP95 | 95th percentile Time To First Byte (milliseconds) |
| edgeTimeToFirstByteMsP99 | 99th percentile Time To First Byte (milliseconds) |
| originResponseDurationMsP50 | 50th percentile Origin Response Duration (milliseconds) |
| originResponseDurationMsP95 | 95th percentile Origin Response Duration (milliseconds) |
| originResponseDurationMsP99 | 99th percentile Origin Response Duration (milliseconds) |
AccountHttpRequestsAdaptiveGroupsRatio
| Field | Description |
|---|---|
| status4xx | |
| status5xx |
AccountHttpRequestsAdaptiveGroupsSum
| Field | Description |
|---|---|
| crossZoneSubrequests | The number of requests that were inititiated by a Cloudflare Worker on another zone |
| edgeDnsResponseTimeMs | |
| edgeResponseBytes | |
| edgeTimeToFirstByteMs | |
| originResponseDurationMs | |
| visits | The number of requests by end-users that were initiated from a different website (i.e. where the request HTTP Referer header does not match the host in the HTTP Host header) |
AccountHttpRequestsAdaptiveGroupsSumConfidence
| Field | Description |
|---|---|
| edgeResponseBytes | Confidence interval for the corresponding point estimate |
AccountHttpRequestsAdaptiveJa4SignalsElem
| Field | Description |
|---|---|
| signalName | Signal name |
| signalValue | Signal value |
AccountHttpRequestsAdaptiveOrderBy
| Field | Description |
|---|---|
AccountHttpRequestsOverviewAdaptiveGroups
A high-level summary of HTTP requests made by end users.
| Field | Description |
|---|---|
| avg | The average value for a metric per dimension |
| dimensions | List of dimensions to group by |
| ratio | The ratio of a metric in comparison to the rest of the traffic, between 0 and 1 |
| sum | The sum of values for a metric per dimension |
AccountHttpRequestsOverviewAdaptiveGroupsAvg
| Field | Description |
|---|---|
| originResponseDurationMs | The average originResponseDuration, in milliseconds, excluding 0 values (i.e. cached ones) |
| sampleInterval | Average sample interval |
AccountHttpRequestsOverviewAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| clientCountryName | Country from which request originated |
| clientRequestHTTPProtocol | HTTP protocol version |
| clientSSLProtocol | SSL protocol version |
| date | The date the event occurred at the edge |
| datetime | The date and time the event occurred at the edge |
| datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
| datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
| datetimeHour | The date and time the event occurred at the edge truncated to hours |
| datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
| edgeResponseContentTypeName | Content type returned to client |
| edgeResponseStatus | HTTP response status code returned to client |
| httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application |
| userAgentBrowser | Browser parsed from the user agent |
| zoneVersion | The version of a zone |
AccountHttpRequestsOverviewAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountHttpRequestsOverviewAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountHttpRequestsOverviewAdaptiveGroupsRatio
| Field | Description |
|---|---|
| cachedBytes | |
| cachedRequests | |
| encryptedBytes | |
| encryptedRequests | |
| status4xx | |
| status5xx |
AccountHttpRequestsOverviewAdaptiveGroupsSum
| Field | Description |
|---|---|
| bytes | |
| cachedBytes | Bytes returned to client from cache |
| cachedRequests | Requests served from cache |
| pageViews | Successful requests for HTML content |
| requests | |
| visits | The number of requests by end-users that were initiated from a different website (i.e. where the request HTTP Referer header does not match the host in the HTTP Host header) |
AccountHyperdriveQueriesAdaptiveGroups
Hyperdrive query events with adaptive sampling.
| Field | Description |
|---|---|
| avg | The average value for a metric per dimension |
| count | Total number of Hyperdrive queries |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountHyperdriveQueriesAdaptiveGroupsAvg
| Field | Description |
|---|---|
| connectionLatency | Average latency (in milliseconds) of retrieving a connection to the origin database |
| queryBytes | Average size (in bytes) of queries handled by Hyperdrive |
| queryLatency | Average latency (in milliseconds) of serving a query using Hyperdrive |
| resultBytes | Average size (in bytes) of query results served by Hyperdrive |
| sampleInterval | The average value used for sample interval |
AccountHyperdriveQueriesAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| cacheStatus | The cache status of the Hyperdrive query event |
| configId | The ID of the Hyperdrive Config |
| date | Hyperdrive query event timestamp, truncated to start of a day |
| datetime | Hyperdrive query event timestamp |
| datetimeHour | Hyperdrive query event timestamp, truncated to start of hour |
| datetimeMinute | Hyperdrive query event timestamp, truncated to start of minute |
| eventStatus | The result of the Hyperdrive event: 'error' or 'complete'. Error events may not have complete data. |
AccountHyperdriveQueriesAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountHyperdriveQueriesAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountHyperdriveQueriesAdaptiveGroupsSum
| Field | Description |
|---|---|
| clientWriteLatency | Total latency (in milliseconds) of sending query results back to client |
| connectionLatency | Total latency (in milliseconds) of retrieving a connection to the origin database |
| originReadLatency | Total latency (in milliseconds) of receiving responses from origin to Hyperdrive |
| originWriteLatency | Total latency (in milliseconds) of sending queries to origin from Hyperdrive |
| queryBytes | Total size (in bytes) of queries handled by Hyperdrive |
| queryLatency | Total latency (in milliseconds) of serving a query using Hyperdrive |
| resultBytes | Total size (in bytes) of query results served by Hyperdrive |
AccountImagesRequestsAdaptiveGroups
A high-level summary of Cloudflare Images served to end users.
| Field | Description |
|---|---|
| avg | The average value for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountImagesRequestsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval |
AccountImagesRequestsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | The date the event occurred at the edge |
| datetime | The date and time the event occurred at the edge |
| datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
| datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
| datetimeHour | The date and time the event occurred at the edge truncated to hours |
| datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
AccountImagesRequestsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountImagesRequestsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountImagesRequestsAdaptiveGroupsSum
| Field | Description |
|---|---|
| requests |
AccountImagesUniqueTransformations
Image unique transfromations per day
| Field | Description |
|---|---|
| date | The date uniques are calculated for |
| transformations | Number of unique image transformations per day in sliding window |
AccountImagesUniqueTransformationsFilter_InputObject
| Field | Description |
|---|---|
AccountImagesUniqueTransformationsOrderBy
| Field | Description |
|---|---|
AccountKvOperationsAdaptiveGroups
KV operations data with adaptive sampling
| Field | Description |
|---|---|
| avg | The average value for a metric per dimension |
| count | Number of requests |
| dimensions | List of dimensions to group by |
| max | The max of values for a metric per dimension |
| min | The min of values for a metric per dimension |
| quantiles | Quantiles of a metric per dimension |
| sum | The sum of values for a metric per dimension |
AccountKvOperationsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval | The average value used for sample interval |
AccountKvOperationsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| action | The type of the action (GET,PUT,DELETE,LIST,CREATE_NAMESPACE) |
| date | Message operation timestamp, truncated to start of a day |
| datetime | Message operation timestamp |
| datetimeHour | Message operation timestamp, truncated to start of an hour |
| datetimeMinute | Message operation timestamp, truncated to start of an minute |
| namespaceId | The hexa-encoded namespace id |
| responseStatusCode | The http status code of the response. |
| result | The result of the action (HIT,MISS,READ_FROM_STORAGE,DELETED,UPLOADED,NAMESPACE_CREATED,ERROR,NOT_FOUND,UNDEFINED,UNKNOWN) |
AccountKvOperationsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountKvOperationsAdaptiveGroupsMax
| Field | Description |
|---|---|
| latencyMs | Max latency |
| objectBytes | Max object bytes |
AccountKvOperationsAdaptiveGroupsMin
| Field | Description |
|---|---|
| latencyMs | Min latency |
| objectBytes | Min object bytes |
AccountKvOperationsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountKvOperationsAdaptiveGroupsQuantiles
| Field | Description |
|---|---|
| latencyMsP25 | 25th percentile latency (milliseconds) |
| latencyMsP50 | 50th percentile latency (milliseconds) |
| latencyMsP75 | 75th percentile latency (milliseconds) |
| latencyMsP90 | 90th percentile latency (milliseconds) |
| latencyMsP99 | 99th percentile latency (milliseconds) |
| latencyMsP999 | 99.9th percentile latency (milliseconds) |
AccountKvOperationsAdaptiveGroupsSum
| Field | Description |
|---|---|
| objectBytes | Total bytes of all objects |
| requests | Total number of requests |
AccountKvStorageAdaptiveGroups
KV stored data with adaptive sampling
| Field | Description |
|---|---|
| dimensions | List of dimensions to group by |
| max | The max of values for a metric per dimension |
AccountKvStorageAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | Message operation timestamp, truncated to start of a day |
| datetime | Message operation timestamp |
| datetimeHour | Message operation timestamp, truncated to start of an hour |
| datetimeMinute | Message operation timestamp, truncated to start of an minute |
| namespaceId | The hexa-encoded namespace id |
AccountKvStorageAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountKvStorageAdaptiveGroupsMax
| Field | Description |
|---|---|
| byteCount | Max number of bytes |
| keyCount | Max number of keys |
AccountKvStorageAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountLogpushHealthAdaptiveGroups
Beta. Logpush job health metrics
| Field | Description |
|---|---|
| avg | |
| count | The number of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountLogpushHealthAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval | Average sample interval |
AccountLogpushHealthAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | Date that we completed pushing the log batch |
| datetime | Datetime that we completed pushing the log batch |
| datetimeFifteenMinutes | Datetime that we completed pushing the log batch, truncated to multiple of 15 minutes |
| datetimeFiveMinutes | Datetime that we completed pushing the log batch, truncated to multiple of 5 minutes |
| datetimeHour | Datetime that we completed pushing the log batch, truncated to the hour |
| datetimeMinute | Datetime that we completed pushing the log batch, truncated to the minute |
| destinationType | Destination type, e.g. 'S3' or 'GCS' |
| final | Cloudflare may attempt to push a batch of logs multiple times if we encounter a failure. This field will be set to 'true' if this was the last push attempt for this batch of logs. If this field is set to false, it means the push failed but another retry was attempted. If this field is set to true and status >= 300, then the batch of logs failed to push and log data was lost. If you want to count the total number of logs that succeeded or failed, you should always set final = true. |
| jobId | The Logpush Job ID |
| status | HTTP response status code of the log destination |
AccountLogpushHealthAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountLogpushHealthAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountLogpushHealthAdaptiveGroupsSum
| Field | Description |
|---|---|
| bytes | Bytes of uncompressed log data pushed |
| bytesCompressed | Bytes of compressed log data pushed |
| records | A count of the total number of records pushed. |
AccountMagicFirewallNetworkAnalyticsAdaptiveGroups
Network analytics data for Magic Firewall
| Field | Description |
|---|---|
| avg | The average of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountMagicFirewallNetworkAnalyticsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
| bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
| bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
| bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
| bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
| bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
| bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
| packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
| packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
| packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
| packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
| packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
| packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
| packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountMagicFirewallNetworkAnalyticsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| applicationTag | Application tag associated with the packet |
| coloCity | City where the Cloudflare datacenter that received the packet is located |
| coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
| coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
| coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
| coloName | Cloudflare datacenter that received the packet (unique site identifier) |
| date | Date that the packet was received |
| datetime | Date and time that the packet was received |
| datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
| datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
| datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
| datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
| datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
| destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
| destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
| destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
| destinationDeviceTag | Device tag associated with the destination IP of the packet |
| destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
| destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
| direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
| ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
| greChecksum | Value of the Checkusm header field in the GRE packet |
| greEthertype | Value of the Ethertype header field in the GRE packet |
| greHeaderLength | Length of the GRE packet header, in bytes |
| greKey | Value of the Key header field in the GRE packet |
| greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
| greVersion | Value of the Version header field in the GRE packet |
| icmpChecksum | Value of the Checkusm header field in the ICMP packet |
| icmpCode | Value of the Code header field in the ICMP packet |
| icmpType | Value of the Type header field in the ICMP packet |
| ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
| ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
| ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
| ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
| ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
| ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
| ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
| ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
| ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
| ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
| ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
| ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
| ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
| ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
| ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
| ipv4Identification | Value of the Identification header field in the IPv4 packet |
| ipv4Options | List of Options numbers included in the IPv4 packet header |
| ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
| ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
| ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
| ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
| ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
| leaseTag | IP lease tag associated with the packet |
| outcome | The action that was taken on the packet (possible values: pass, drop) |
| prefixTag | IP prefix tag associated with the packet |
| ruleId | Unique identifier of the rule that matched the packet, if any |
| rulesetId | Unique identifier of the ruleset containing the rule that matched the packet, if any |
| sampleInterval | ABR sample interval |
| sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
| sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
| sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
| sourceDeviceTag | Device tag associated with the source IP of the packet |
| sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
| sourcePort | Value of the Source Port header field in the TCP or UDP packet |
| tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
| tcpChecksum | Value of the Checkusm header field in the TCP packet |
| tcpDataOffset | Value of the Data Offset header field in the TCP packet |
| tcpFlags | Value of the Flags header field in the TCP packet |
| tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
| tcpMss | Value of the MSS option header field in the TCP packet |
| tcpOptions | List of Options numbers included in the TCP packet header |
| tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
| tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
| tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
| tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
| tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
| tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
| tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
| tcpWindowSize | Value of the Window Size header field in the TCP packet |
| udpChecksum | Value of the Checkusm header field in the UDP packet |
| udpPayloadLength | Value of the Payload Length header field in the UDP packet |
| verdict | The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop) |
AccountMagicFirewallNetworkAnalyticsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountMagicFirewallNetworkAnalyticsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountMagicFirewallNetworkAnalyticsAdaptiveGroupsSum
| Field | Description |
|---|---|
| bits | Sum of bits received |
| packets | Sum of packets received |
AccountMagicFirewallSamplesAdaptiveGroups
Data to visualize traffic allowed and blocked by Magic Firewall rules
| Field | Description |
|---|---|
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountMagicFirewallSamplesAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| datetime | Date and time that the packet was received |
| datetimeFiveMinute | Date and time that the packet was received, rounded to the start of the nearest five minutes |
| ruleId | Unique identifier of the rule that matched the packet, if any |
AccountMagicFirewallSamplesAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountMagicFirewallSamplesAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountMagicFirewallSamplesAdaptiveGroupsSum
| Field | Description |
|---|---|
| bits | Sum of bits received |
| packets | Sum of packets received |
AccountMagicIDPSNetworkAnalyticsAdaptiveGroups
Network analytics data for Magic IDS
| Field | Description |
|---|---|
| avg | The average of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountMagicIDPSNetworkAnalyticsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
| bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
| bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
| bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
| bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
| bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
| bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
| packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
| packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
| packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
| packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
| packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
| packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
| packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountMagicIDPSNetworkAnalyticsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| coloCity | City where the Cloudflare datacenter that received the packet is located |
| coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
| coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
| coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
| coloName | Cloudflare datacenter that received the packet (unique site identifier) |
| date | Date that the packet was received |
| datetime | Date and time that the packet was received |
| datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
| datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
| datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
| datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
| datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
| destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
| destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
| destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
| destinationDeviceTag | Device tag associated with the destination IP of the packet |
| destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
| destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
| direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
| ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
| greChecksum | Value of the Checkusm header field in the GRE packet |
| greEthertype | Value of the Ethertype header field in the GRE packet |
| greHeaderLength | Length of the GRE packet header, in bytes |
| greKey | Value of the Key header field in the GRE packet |
| greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
| greVersion | Value of the Version header field in the GRE packet |
| icmpChecksum | Value of the Checkusm header field in the ICMP packet |
| icmpCode | Value of the Code header field in the ICMP packet |
| icmpType | Value of the Type header field in the ICMP packet |
| ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
| ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
| ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
| ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
| ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
| ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
| ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
| ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
| ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
| ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
| ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
| ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
| ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
| ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
| ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
| ipv4Identification | Value of the Identification header field in the IPv4 packet |
| ipv4Options | List of Options numbers included in the IPv4 packet header |
| ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
| ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
| ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
| ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
| ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
| outcome | The action that was taken on the packet (possible values: pass, drop) |
| sampleInterval | ABR sample interval |
| sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
| sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
| sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
| sourceDeviceTag | Device tag associated with the source IP of the packet |
| sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
| sourcePort | Value of the Source Port header field in the TCP or UDP packet |
| tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
| tcpChecksum | Value of the Checkusm header field in the TCP packet |
| tcpDataOffset | Value of the Data Offset header field in the TCP packet |
| tcpFlags | Value of the Flags header field in the TCP packet |
| tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
| tcpMss | Value of the MSS option header field in the TCP packet |
| tcpOptions | List of Options numbers included in the TCP packet header |
| tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
| tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
| tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
| tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
| tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
| tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
| tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
| tcpWindowSize | Value of the Window Size header field in the TCP packet |
| udpChecksum | Value of the Checkusm header field in the UDP packet |
| udpPayloadLength | Value of the Payload Length header field in the UDP packet |
| verdict | The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop) |
AccountMagicIDPSNetworkAnalyticsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountMagicIDPSNetworkAnalyticsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountMagicIDPSNetworkAnalyticsAdaptiveGroupsSum
| Field | Description |
|---|---|
| bits | Sum of bits received |
| packets | Sum of packets received |
AccountMagicTransitNetworkAnalyticsAdaptiveGroups
Network analytics data for Magic Transit traffic
| Field | Description |
|---|---|
| avg | The average of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountMagicTransitNetworkAnalyticsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
| bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
| bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
| bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
| bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
| bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
| bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
| packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
| packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
| packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
| packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
| packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
| packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
| packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountMagicTransitNetworkAnalyticsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| applicationTag | Application tag associated with the packet |
| coloCity | City where the Cloudflare datacenter that received the packet is located |
| coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
| coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
| coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
| coloName | Cloudflare datacenter that received the packet (unique site identifier) |
| date | Date that the packet was received |
| datetime | Date and time that the packet was received |
| datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
| datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
| datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
| datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
| datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
| destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
| destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
| destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
| destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
| destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
| direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
| egressTunnelID | GRE or IPSec Egress Tunnel ID for Magic WAN and Magic Transit traffic |
| egressTunnelName | GRE or IPSec Egress Tunnel name for Magic WAN and Magic Transit traffic |
| ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
| greChecksum | Value of the Checkusm header field in the GRE packet |
| greEthertype | Value of the Ethertype header field in the GRE packet |
| greHeaderLength | Length of the GRE packet header, in bytes |
| greKey | Value of the Key header field in the GRE packet |
| greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
| greVersion | Value of the Version header field in the GRE packet |
| icmpChecksum | Value of the Checkusm header field in the ICMP packet |
| icmpCode | Value of the Code header field in the ICMP packet |
| icmpType | Value of the Type header field in the ICMP packet |
| ingressTunnelID | GRE or IPSec Ingress Tunnel ID for Magic WAN and Magic Transit traffic |
| ingressTunnelName | GRE or IPSec Ingress Tunnel name for Magic WAN and Magic Transit traffic |
| ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
| ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
| ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
| ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
| ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
| ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
| ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
| ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
| ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
| ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
| ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
| ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
| ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
| ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
| ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
| ipv4Identification | Value of the Identification header field in the IPv4 packet |
| ipv4Options | List of Options numbers included in the IPv4 packet header |
| ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
| ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
| ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
| ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
| ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
| leaseTag | IP lease tag associated with the packet |
| mitigationSystem | Which system dropped the packet (possible values: dosd, flowtrackd, magic-firewall) |
| offRamp | Offramp method for Magic WAN and Magic Transit traffic - GRE, IPSec, CNI, Warp, Cloudflared |
| onRamp | Onramp method for Magic WAN and Magic Transit traffic - GRE, IPSec, CNI, Warp, Cloudflared |
| outcome | The action that was taken on the packet (possible values: pass, drop) |
| prefixTag | IP prefix tag associated with the packet |
| sampleInterval | ABR sample interval |
| sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
| sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
| sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
| sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
| sourcePort | Value of the Source Port header field in the TCP or UDP packet |
| tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
| tcpChecksum | Value of the Checkusm header field in the TCP packet |
| tcpDataOffset | Value of the Data Offset header field in the TCP packet |
| tcpFlags | Value of the Flags header field in the TCP packet |
| tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
| tcpMss | Value of the MSS option header field in the TCP packet |
| tcpOptions | List of Options numbers included in the TCP packet header |
| tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
| tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
| tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
| tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
| tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
| tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
| tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
| tcpWindowSize | Value of the Window Size header field in the TCP packet |
| trafficType | Custom protocol or traffic type for Magic Wan and Magic Transit traffic - Unidirectional and Bidirectional Tunnel Health Check |
| udpChecksum | Value of the Checkusm header field in the UDP packet |
| udpPayloadLength | Value of the Payload Length header field in the UDP packet |
AccountMagicTransitNetworkAnalyticsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountMagicTransitNetworkAnalyticsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountMagicTransitNetworkAnalyticsAdaptiveGroupsSum
| Field | Description |
|---|---|
| bits | Sum of bits received |
| packets | Sum of packets received |
AccountMagicTransitTunnelHealthChecksAdaptiveGroups
Beta. Magic Transit Health check results for customer GRE Tunnels with adaptive sampling (ABR).
| Field | Description |
|---|---|
| avg | |
| count | Total number of healthcheck results |
| dimensions | List of dimensions to group by |
AccountMagicTransitTunnelHealthChecksAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval | Average sample interval per dimension |
| tunnelState | Combined Tunnel State aggregated from multiple results. 0 is down, 0.5 is degraded and 1 is healthy |
AccountMagicTransitTunnelHealthChecksAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| active | Returns 1 if the colo had traffic for this tunnel in the last 6 hours, otherwise 0 |
| datetime | The time the healthcheck request was sent |
| datetimeFifteenMinutes | The time the healthcheck request was sent, truncated to multiple of 15 minutes |
| datetimeFiveMinutes | The time the healthcheck request was sent, truncated to multiple of 5 minutes |
| datetimeHalfOfHour | The time the healthcheck request was sent, truncated to multiple of 30 minutes |
| datetimeHour | The time the healthcheck request was sent, truncated to the hour |
| datetimeMinute | The time the healthcheck request was sent, truncated to the last minute |
| edgeColoCity | City of the Cloudflare datacenter from where the healthcheck was run |
| edgeColoCode | IATA airport code of the Cloudflare datacenter from where the healthcheck was run |
| edgeColoCountry | Country of the Cloudflare datacenter from where the healthcheck was run |
| edgeColoName | The name of the Cloudflare datacenter from where the healthcheck was run |
| edgeColoRegion | Region of the Cloudflare datacenter from where the healthcheck was run |
| edgePopName | The name of the Cloudflare POP from where the healthcheck was run |
| remoteTunnelIPv4 | IP address of the remote end of the tunnel |
| resultStatus | The status of the request |
| siteName | Human friendly site name associated with the tunnel |
| tunnelName | Human friendly tunnel name |
AccountMagicTransitTunnelHealthChecksAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountMagicTransitTunnelTrafficAdaptiveGroups
Bandwidth usage metric of a Magic Transit tunnel.
| Field | Description |
|---|---|
| avg | The average of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountMagicTransitTunnelTrafficAdaptiveGroupsAvg
| Field | Description |
|---|---|
| bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
| bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
| bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
| bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
| bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
| bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
| bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
| packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
| packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
| packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
| packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
| packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
| packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
| packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountMagicTransitTunnelTrafficAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | Date that the packet was received |
| datetime | Date and time that the packet was received |
| datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
| datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
| datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
| datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
| direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
| edgeColoCity | City where the Cloudflare datacenter that received the packet is located |
| edgeColoCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
| edgeColoCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
| edgeColoGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
| edgeColoName | Cloudflare datacenter that received the packet (unique site identifier) |
| edgePopName | Cloudflare PoP that received the packet (unique site identifier) |
| egressTunnelID | GRE, IPSec or CNI Egress Tunnel ID for Magic WAN and Magic Transit traffic |
| egressTunnelName | GRE, IPSec or CNIec Egress Tunnel name for Magic WAN and Magic Transit traffic |
| ingressTunnelID | GRE, IPSec or CNI Ingress Tunnel ID for Magic WAN and Magic Transit traffic |
| ingressTunnelName | GRE, IPSec or CNI Ingress Tunnel name for Magic WAN and Magic Transit traffic |
| tunnelName | Tunnel device name |
AccountMagicTransitTunnelTrafficAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountMagicTransitTunnelTrafficAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountMagicTransitTunnelTrafficAdaptiveGroupsSum
| Field | Description |
|---|---|
| bits | Sum of bits received |
| packets | Sum of packets received |
AccountMagicWANConnectorMetricsAdaptiveGroups
Beta. Magic WAN Connector Metrics
| Field | Description |
|---|---|
| avg | |
| dimensions | List of dimensions to group by |
| max |
AccountMagicWANConnectorMetricsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| cpuLoadPercentage | Average CPU load percentage |
| cpuTemperature | Average CPU temperature |
| diskUsagePercentage | Average Disk usage percentage |
| memoryUsagePercentage | Average Memory usage percentage |
| rxBitrateFiveMinute | Rx Bitrate over 5 minutes |
| rxBitrateMinute | Rx Bitrate over 1 minute |
| rxPacketrateFiveMinute | Rx Packet rate over 5 minutes |
| rxPacketrateMinute | Rx Packet rate over 1 minute |
| txBitrateFiveMinute | Tx Bitrate over 5 minutes |
| txBitrateMinute | Tx Bitrate over 1 minute |
| txPacketrateFiveMinute | Tx Packet rate over 5 minutes |
| txPacketrateMinute | Tx Packet rate over 1 minute |
AccountMagicWANConnectorMetricsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| datetime | The date and time the event was recorded |
| datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
| datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
| mconnInterfaceName | Name of connector interface |
| mconnInterfaceType | Interface type LAN, WAN or IPSEC |
| mconnSiteID | Customer site identifier |
AccountMagicWANConnectorMetricsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountMagicWANConnectorMetricsAdaptiveGroupsMax
| Field | Description |
|---|---|
| interfaceCount | Number of interfaces of a given Type |
AccountMagicWANConnectorMetricsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountMnmFlowDataAdaptiveGroups
Flow data collected through Magic Network Monitoring
| Field | Description |
|---|---|
| avg | The average of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountMnmFlowDataAdaptiveGroupsAvg
| Field | Description |
|---|---|
| bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
| bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
| bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
| bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
| bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
| bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
| bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
| packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
| packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
| packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
| packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
| packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
| packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
| packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
| sampleInterval | Average sample interval applied to the data |
AccountMnmFlowDataAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | Date that the packet was received |
| datetime | Date and time that the packet was received |
| datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
| datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
| datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
| datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
| datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
| destinationAddress | IP to which the data was sent |
| destinationPort | Value of the Destination Port header field in the packet |
| ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
| protocol | Layer 4 protocol |
| protocolString | Human-readable string representation of the protocol |
| routerAddress | IP of the router that sampled the flows |
| ruleIDs | List of flow matching rules |
| sourceAddress | IP from which the data was sent |
| sourcePort | Value of the Source Port header field in the packet |
| tcpFlags | Value of the Flags header field in the TCP packet |
| tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
| version | Version of the record schema |
AccountMnmFlowDataAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountMnmFlowDataAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountMnmFlowDataAdaptiveGroupsSum
| Field | Description |
|---|---|
| bits | Sum of bits |
| packets | Sum of packets |
AccountNelReportsAdaptiveGroups
Data to visualize network error logs
| Field | Description |
|---|---|
| avg | |
| count | The number of NEL Reports |
| dimensions | List of dimensions to group by |
AccountNelReportsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval | Average sample interval |
AccountNelReportsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| clientIPASN | Client ASN |
| clientIPASNDescription | Client ASN Description |
| clientIPCountry | Client Country |
| clientIPCountryCode | 2 letter client country code using ISO 3166-1 alpha-2 syntax |
| clientIPVersion | IP Version the client used to connect |
| date | Request date from browser |
| datetime | Request datetime from browser |
| datetimeFifteenMinutes | Request datetime from browser, truncated to multiple of 15 minutes |
| datetimeFiveMinutes | Request datetime from browser, truncated to multiple of 5 minutes |
| datetimeHalfOfHour | Request datetime from browser, truncated to multiple of 30 minutes |
| datetimeHour | Request datetime from browser, truncated to the hour |
| datetimeMinute | Request datetime from browser, truncated to the minute |
| lastKnownGoodColoCode | IATA airport code of colo the client connected to |
| phase | The phase of connection the error occurred in |
| protocol | HTTP Protocol used when the error occured |
| type | The type of error in the phase |
AccountNelReportsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountNelReportsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountOhttpMetricsAdaptive
oHTTP request metrics with adaptive sampling
| Field | Description |
|---|---|
| bytesToClient | Bytes returned to client |
| bytesToGateway | Total bytes received from the client |
| colo | The airport code of the Cloudflare datacenter that served this request |
| datetime | The date and time the event was recorded |
| gatewayStatusCode | The status code returned by the gateway |
| relayStatusCode | The status code returned by the relay |
AccountOhttpMetricsAdaptiveFilter_InputObject
| Field | Description |
|---|---|
AccountOhttpMetricsAdaptiveGroups
Aggregated oHTTP request metrics with adaptive sampling
| Field | Description |
|---|---|
| count | |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountOhttpMetricsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| colo | The airport code of the Cloudflare datacenter that served this request |
| date | Ohttp requests metrics date |
| datetimeFifteenMinutes | Ohttp requests metrics timestamp, truncated to fifteen minutes |
| datetimeFiveMinutes | Ohttp requests metrics timestamp, truncated to five minutes |
| datetimeHour | Ohttp requests metrics timestamp, truncated to the hour |
| datetimeMinute | Ohttp requests metrics timestamp, truncated to the minute |
| endpoint | The appId that generated traffic |
| gatewayStatusCode | Status code returned by the gateway |
| relayStatusCode | Status code returned by the relay |
AccountOhttpMetricsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountOhttpMetricsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountOhttpMetricsAdaptiveGroupsSum
| Field | Description |
|---|---|
| bytesToClient | The total bytes sent from gateway to client, observed over the queried time period |
| bytesToGateway | The total bytes from client to gateway, observed over the queried time period |
| clientRequestErrors | The total number of client request errors, observed over the queried time period |
| gatewayResponseErrors | The total number of gateway response errors, observed over the queried time period |
AccountOhttpMetricsAdaptiveOrderBy
| Field | Description |
|---|---|
AccountPagesFunctionsInvocationsAdaptiveGroups
Pages Functions invocations with adaptive sampling
| Field | Description |
|---|---|
| avg | |
| dimensions | List of dimensions to group by |
| quantiles | Quantiles of a metric per dimension |
| sum | The sum of values for a metric per dimension |
AccountPagesFunctionsInvocationsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval | Average sample interval |
AccountPagesFunctionsInvocationsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | Request datetime, truncated to start of a day |
| datetime | Request datetime |
| datetimeHour | Request datetime, truncated to start of an hour |
| datetimeMinute | Request datetime, truncated to start of an minute |
| scriptName | The name of the script |
| status | Status of the worker invocation |
| usageModel | Usage model of the worker invocation |
AccountPagesFunctionsInvocationsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountPagesFunctionsInvocationsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountPagesFunctionsInvocationsAdaptiveGroupsQuantiles
| Field | Description |
|---|---|
| cpuTimeP50 | CPU time 50th percentile - microseconds |
| cpuTimeP75 | CPU time 75th percentile - microseconds |
| cpuTimeP99 | CPU time 99th percentile - microseconds |
| cpuTimeP999 | CPU time 99.9th percentile - microseconds |
| durationP50 | Duration 50th percentile - GB*s |
| durationP75 | Duration 75th percentile - GB*s |
| durationP99 | Duration 99th percentile - GB*s |
| durationP999 | Duration 99.9th percentile - GB*s |
AccountPagesFunctionsInvocationsAdaptiveGroupsSum
| Field | Description |
|---|---|
| duration | Sum of Duration - GB*s |
| errors | Sum of Errors |
| requests | Sum of Requests |
| responseBodySize | Sum of Response Body Sizes |
| subrequests | Sum of Subrequests |
| wallTime | Sum of Wall Time |
AccountQueueBacklogAdaptiveGroups
Beta. Queue backlog data with adaptive sampling. Queues that are not being written to, or read from, will not return data, even if they have a backlog.
| Field | Description |
|---|---|
| avg | The average value for a metric per dimension |
| dimensions | List of dimensions to group by |
AccountQueueBacklogAdaptiveGroupsAvg
| Field | Description |
|---|---|
| bytes | The average size of the backlog in bytes for sample interval |
| messages | The average number of messages in the backlog for sample interval |
| sampleInterval | The average value used for sample interval |
AccountQueueBacklogAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | Message operation timestamp, truncated to start of a day |
| datetime | Message operation timestamp |
| datetimeHour | Message operation timestamp, truncated to start of an hour |
| datetimeMinute | Message operation timestamp, truncated to start of an minute |
| queueId | The ID of the Queue |
AccountQueueBacklogAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountQueueBacklogAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountQueueConsumerMetricsAdaptiveGroups
Beta. Queue consumer metrics with adaptive sampling. Inactive queues will not return data.
| Field | Description |
|---|---|
| avg | The average value for a metric per dimension |
| dimensions | List of dimensions to group by |
AccountQueueConsumerMetricsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| concurrency | The average concurrency of the queue |
| sampleInterval | The average value used for sample interval |
AccountQueueConsumerMetricsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | Consumer metric timestamp, truncated to start of a day |
| datetime | Consumer metric timestamp |
| datetimeHour | Consumer metric timestamp, truncated to start of an hour |
| datetimeMinute | Consumer metric timestamp, truncated to start of an minute |
| queueId | The ID of the Queue |
AccountQueueConsumerMetricsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountQueueConsumerMetricsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountQueueDelayedBacklogAdaptiveGroups
Beta. Queue delayed backlog data with adaptive sampling. Queues that are not being written to, or read from, will not return data, even if they have a backlog.
| Field | Description |
|---|---|
| avg | The average value for a metric per dimension |
| dimensions | List of dimensions to group by |
AccountQueueDelayedBacklogAdaptiveGroupsAvg
| Field | Description |
|---|---|
| messages | The average number of messages in the delayed backlog for sample interval |
| sampleInterval | The average value used for sample interval |
AccountQueueDelayedBacklogAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | Message operation timestamp, truncated to start of a day |
| datetime | Message operation timestamp |
| datetimeHour | Message operation timestamp, truncated to start of an hour |
| datetimeMinute | Message operation timestamp, truncated to start of an minute |
| queueId | The ID of the Queue |
AccountQueueDelayedBacklogAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountQueueDelayedBacklogAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountQueueMessageOperationsAdaptiveGroups
Beta. Queue message operation data with adaptive sampling
| Field | Description |
|---|---|
| avg | The average value for a metric per dimension |
| count | Number of Message Operations |
| dimensions | List of dimensions to group by |
| max | The max of values for a metric per dimension |
| sum | The sum of values for a metric per dimension |
AccountQueueMessageOperationsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| lagTime | The average time in milliseconds between when the message was written to the queue and the current operation over the sample interval. Will always be 0 for WriteMessage operations. |
| retryCount | The average number of retries per message operation. A retry occurs after an unsucessful delivery, if the queue is configured to retry failed attempts. Only applicable to ReadMessage and DeleteMessage operations. Will always be 0 for WriteMessage operations. |
| sampleInterval | The average value used for sample interval |
AccountQueueMessageOperationsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| actionType | The type of the Queue message operation |
| consumerType | The queue consumer type for the operation. Only applicable for ReadMessage and DeleteMessge action types. |
| date | Message operation timestamp, truncated to start of a day |
| datetime | Message operation timestamp |
| datetimeHour | Message operation timestamp, truncated to start of an hour |
| datetimeMinute | Message operation timestamp, truncated to start of an minute |
| outcome | The outcome of the operation. Only applicable to DeleteMessage action types. Can be 'success', 'dlq', or 'fail'. Always 'none' for other operations. |
| queueId | The ID of the Queue |
AccountQueueMessageOperationsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountQueueMessageOperationsAdaptiveGroupsMax
| Field | Description |
|---|---|
| messageSize | Max Message Size |
AccountQueueMessageOperationsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountQueueMessageOperationsAdaptiveGroupsSum
| Field | Description |
|---|---|
| billableOperations | Number of Billable Operations (some message operations count as multiple billable operations) |
| bytes | Total size (in bytes) of message operations |
AccountR2OperationsAdaptiveGroups
Beta. R2 operations with adaptive sampling
| Field | Description |
|---|---|
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountR2OperationsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| actionStatus | Status of the R2 operation |
| actionType | The name of the R2 operation |
| bucketName | The name of the R2 bucket, if applicable to this request |
| date | Request timestamp, truncated to start of a day |
| datetime | Request timestamp |
| datetimeHour | Request timestamp, truncated to start of an hour |
| datetimeMinute | Request timestamp, truncated to start of an minute |
| objectName | The name of the R2 object, if applicable to this request |
| responseStatusCode | HTTP status code returned by R2 |
| storageClass | The storage class that applies to this request |
AccountR2OperationsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountR2OperationsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountR2OperationsAdaptiveGroupsSum
| Field | Description |
|---|---|
| requests | Sum of Requests |
| responseBytes | Sum of retrieved bytes |
| responseObjectSize | Sum of Response Object Sizes |
AccountR2StorageAdaptiveGroups
Beta. R2 storage with adaptive sampling
| Field | Description |
|---|---|
| dimensions | List of dimensions to group by |
| max | The max of values for a metric per dimension |
AccountR2StorageAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| bucketName | The name of the R2 bucket, if applicable to this request |
| date | Storage sample timestamp, truncated to start of a day |
| datetime | Storage sample timestamp |
| datetimeHour | Storage sample timestamp, truncated to start of an hour |
| datetimeMinute | Storage sample timestamp, truncated to start of an minute |
| storageClass | The storage class that applies to this request |
AccountR2StorageAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountR2StorageAdaptiveGroupsMax
| Field | Description |
|---|---|
| metadataSize | Max of metadata size |
| objectCount | Max of object count |
| payloadSize | Max of payload size |
| uploadCount | Max of upload count |
AccountR2StorageAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountRumPageloadEventsAdaptiveGroups
Beta. Aggregated RUM pageload event metrics with adaptive sampling
| Field | Description |
|---|---|
| avg | |
| count | The number of pages viewed by end-users |
| dimensions | List of dimensions to group by |
| sum |
AccountRumPageloadEventsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval | Average sample interval |
AccountRumPageloadEventsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| bot | Indicates if the request is likely from a bot (non-human traffic). Returns 1 if from a bot, 0 otherwise. |
| countryName | Client country ISO 3166 alpha2 code |
| customTagInternalSxg | Signed Exchange enabled status |
| date | Request date from browser |
| datetimeFifteenMinutes | Request datetime from browser, truncated to multiple of 15 minutes |
| datetimeFiveMinutes | Request datetime from browser, truncated to multiple of 5 minutes |
| datetimeHalfOfHour | Request datetime from browser, truncated to multiple of 30 minutes |
| datetimeHour | Request datetime from browser, truncated to the hour |
| datetimeMinute | Request datetime from browser, truncated to the minute |
| deviceType | Device type used for view the page |
| refererHost | Host of the HTTP request referer |
| refererPath | Path of the HTTP request referer |
| refererScheme | Scheme of the HTTP request referer (http or https) |
| requestHost | HTTP Host of the web page URL |
| requestPath | Path of the web page URL |
| requestScheme | Scheme of the web page URL (http or https) |
| siteTag | The key value to identify a site |
| userAgentBrowser | Browser parsed from the user agent |
| userAgentOS | OS parsed from the user agent |
AccountRumPageloadEventsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountRumPageloadEventsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountRumPageloadEventsAdaptiveGroupsSum
| Field | Description |
|---|---|
| visits | The number of pages viewed by end-users that were initiated from a different website (i.e. where the Document.referrer does not match the hostname) |
AccountRumPerformanceEventsAdaptiveGroups
Beta. Aggregated RUM performance event metrics with adaptive sampling
| Field | Description |
|---|---|
| avg | |
| count | The number of pages viewed by end-users |
| dimensions | List of dimensions to group by |
| quantiles | |
| sum |
AccountRumPerformanceEventsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| connectionTime | Connection time |
| dnsTime | Domain lookup time |
| firstContentfulPaint | The time when the first content piece from the DOM is painted (i.e. some text or an image) |
| firstPaint | The time when the first pixel is painted onto the screen (i.e. background of the page) |
| loadEventTime | The time taken for the load event |
| pageLoadTime | The time to download and display the entire content of a web page in the browser window |
| pageRenderTime | The time to download and display the entire content of a web page in the browser window |
| requestTime | The time between initiating the request and receiving the first byte of the response |
| responseTime | The time between receiving the first byte and the last byte of the response |
| sampleInterval | Average sample interval |
AccountRumPerformanceEventsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| bot | Indicates if the request is likely from a bot (non-human traffic). Returns 1 if from a bot, 0 otherwise. |
| countryName | Client country ISO 3166 alpha2 code |
| customTagInternalSxg | Signed Exchange enabled status |
| date | Request date from browser |
| datetimeFifteenMinutes | Request datetime from browser, truncated to multiple of 15 minutes |
| datetimeFiveMinutes | Request datetime from browser, truncated to multiple of 5 minutes |
| datetimeHalfOfHour | Request datetime from browser, truncated to multiple of 30 minutes |
| datetimeHour | Request datetime from browser, truncated to the hour |
| datetimeMinute | Request datetime from browser, truncated to the minute |
| deviceType | Device type used for view the page |
| refererHost | Host of the HTTP request referer |
| refererPath | Path of the HTTP request referer |
| refererScheme | Scheme of the HTTP request referer (http or https) |
| requestHost | HTTP Host of the web page URL |
| requestPath | Path of the web page URL |
| requestScheme | Scheme of the web page URL (http or https) |
| siteTag | The key value to identify a site |
| userAgentBrowser | Browser parsed from the user agent |
| userAgentOS | OS parsed from the user agent |
AccountRumPerformanceEventsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountRumPerformanceEventsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountRumPerformanceEventsAdaptiveGroupsQuantiles
| Field | Description |
|---|---|
| connectionTimeP50 | Connection time |
| connectionTimeP75 | Connection time |
| connectionTimeP90 | Connection time |
| connectionTimeP99 | Connection time |
| dnsTimeP50 | Domain lookup time |
| dnsTimeP75 | Domain lookup time |
| dnsTimeP90 | Domain lookup time |
| dnsTimeP99 | Domain lookup time |
| firstContentfulPaintP50 | The time when the first content piece from the DOM is painted (i.e. some text or an image) |
| firstContentfulPaintP75 | The time when the first content piece from the DOM is painted (i.e. some text or an image) |
| firstContentfulPaintP90 | The time when the first content piece from the DOM is painted (i.e. some text or an image) |
| firstContentfulPaintP99 | The time when the first content piece from the DOM is painted (i.e. some text or an image) |
| firstPaintP50 | The time when the first pixel is painted onto the screen (i.e. background of the page) |
| firstPaintP75 | The time when the first pixel is painted onto the screen (i.e. background of the page) |
| firstPaintP90 | The time when the first pixel is painted onto the screen (i.e. background of the page) |
| firstPaintP99 | The time when the first pixel is painted onto the screen (i.e. background of the page) |
| loadEventTimeP50 | The time taken for the load event |
| loadEventTimeP75 | The time taken for the load event |
| loadEventTimeP90 | The time taken for the load event |
| loadEventTimeP99 | The time taken for the load event |
| pageLoadTimeP50 | The time to download and display the entire content of a web page in the browser window |
| pageLoadTimeP75 | The time to download and display the entire content of a web page in the browser window |
| pageLoadTimeP90 | The time to download and display the entire content of a web page in the browser window |
| pageLoadTimeP99 | The time to download and display the entire content of a web page in the browser window |
| pageRenderTimeP50 | The time to download and display the entire content of a web page in the browser window |
| pageRenderTimeP75 | The time to download and display the entire content of a web page in the browser window |
| pageRenderTimeP90 | The time to download and display the entire content of a web page in the browser window |
| pageRenderTimeP99 | The time to download and display the entire content of a web page in the browser window |
| requestTimeP50 | The time between initiating the request and receiving the first byte of the response |
| requestTimeP75 | The time between initiating the request and receiving the first byte of the response |
| requestTimeP90 | The time between initiating the request and receiving the first byte of the response |
| requestTimeP99 | The time between initiating the request and receiving the first byte of the response |
| responseTimeP50 | The time between receiving the first byte and the last byte of the response |
| responseTimeP75 | The time between receiving the first byte and the last byte of the response |
| responseTimeP90 | The time between receiving the first byte and the last byte of the response |
| responseTimeP99 | The time between receiving the first byte and the last byte of the response |
AccountRumPerformanceEventsAdaptiveGroupsSum
| Field | Description |
|---|---|
| visits | The number of pages viewed by end-users that were initiated from a different website (i.e. where the Document.referrer does not match the hostname) |
AccountRumWebVitalsEventsAdaptive
Beta. RUM Web Vitals event metrics with adaptive sampling
| Field | Description |
|---|---|
| bot | Indicates if the request is likely from a bot (non-human traffic). Returns 1 if from a bot, 0 otherwise. |
| countryName | Client country ISO 3166 alpha2 code |
| cumulativeLayoutShift | Cumulative Layout Shift (Core Web Vitals) (-1 indicates N/A) |
| cumulativeLayoutShiftCurrentRect | Layout values of the rectangular area after the changes |
| cumulativeLayoutShiftElement | DOM selector name of the largest layout shift |
| cumulativeLayoutShiftPath | Observed path of the Cumulative Layout Shift (Core Web Vitals) |
| cumulativeLayoutShiftPreviousRect | Layout values of the rectangular area before the changes |
| customTagInternalSxg | Signed Exchange enabled status |
| date | Request date from browser |
| datetime | Request datetime from browser |
| datetimeFifteenMinutes | Request datetime from browser, truncated to multiple of 15 minutes |
| datetimeFiveMinutes | Request datetime from browser, truncated to multiple of 5 minutes |
| datetimeHalfOfHour | Request datetime from browser, truncated to multiple of 30 minutes |
| datetimeHour | Request datetime from browser, truncated to the hour |
| datetimeMinute | Request datetime from browser, truncated to the minute |
| deviceType | Device type used for view the page |
| refererHost | Host of the HTTP request referer |
| refererPath | Path of the HTTP request referer |
| refererScheme | Scheme of the HTTP request referer (http or https) |
| requestHost | HTTP Host of the web page URL |
| requestPath | Path of the web page URL |
| requestScheme | Scheme of the web page URL (http or https) |
| sampleInterval | ABR sample interval |
| siteTag | The key value to identify a site |
| userAgentBrowser | Browser parsed from the user agent |
| userAgentOS | OS parsed from the user agent |
AccountRumWebVitalsEventsAdaptiveFilter_InputObject
| Field | Description |
|---|---|
AccountRumWebVitalsEventsAdaptiveGroups
Beta. Aggregated RUM Web Vitals event metrics with adaptive sampling
| Field | Description |
|---|---|
| avg | |
| count | The number of pages viewed by end-users |
| dimensions | List of dimensions to group by |
| quantiles | |
| sum |
AccountRumWebVitalsEventsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| cumulativeLayoutShift | Cumulative Layout Shift (Core Web Vitals) (negative value indicates N/A) |
| firstContentfulPaint | First Contentful Paint in microseconds (negative value indicates N/A) |
| firstInputDelay | First Input Delay (Core Web Vitals) in microseconds (negative value indicates N/A) |
| interactionToNextPaint | Interaction to Next Paint in microseconds (negative value indicates N/A) |
| largestContentfulPaint | Largest Contentful Paint (Core Web Vitals) in microseconds (negative value indicates N/A) |
| lcpElementRenderDelay | Largest Contentful Paint Attributions Element Render Delay in microseconds (negative value indicates N/A) |
| lcpResourceLoadDelay | Largest Contentful Paint Attributions Resource Load Delay in microseconds (negative value indicates N/A) |
| lcpResourceLoadTime | Largest Contentful Paint Attributions Resource Load Time in microseconds (negative value indicates N/A) |
| sampleInterval | Average sample interval |
| timeToFirstByte | Time to First Byte in microseconds (negative value indicates N/A) |
AccountRumWebVitalsEventsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| bot | Indicates if the request is likely from a bot (non-human traffic). Returns 1 if from a bot, 0 otherwise. |
| countryName | Client country ISO 3166 alpha2 code |
| cumulativeLayoutShiftElement | DOM selector name of the largest layout shift |
| cumulativeLayoutShiftPath | Observed path of the Cumulative Layout Shift (Core Web Vitals) |
| customTagInternalSxg | Signed Exchange enabled status |
| date | Request date from browser |
| datetimeFifteenMinutes | Request datetime from browser, truncated to multiple of 15 minutes |
| datetimeFiveMinutes | Request datetime from browser, truncated to multiple of 5 minutes |
| datetimeHalfOfHour | Request datetime from browser, truncated to multiple of 30 minutes |
| datetimeHour | Request datetime from browser, truncated to the hour |
| datetimeMinute | Request datetime from browser, truncated to the minute |
| deviceType | Device type used for view the page |
| firstInputDelayElement | DOM selector name of the input delay |
| firstInputDelayName | Action name of the input delay |
| firstInputDelayPath | Observed path of the First Input Delay (Core Web Vitals) |
| largestContentfulPaintElement | DOM selector name of the largest object |
| largestContentfulPaintObjectHost | Host of the largest object |
| largestContentfulPaintObjectPath | Path of the largest object |
| largestContentfulPaintObjectScheme | Scheme of the largest object (http or https) |
| largestContentfulPaintPath | Observed path of the Largest Contentful Paint (Core Web Vitals) |
| lcpFetchPriority | Fetch priority of the LCP element. |
| lcpInitiatorType | Initiator type of the LCP element. |
| refererHost | Host of the HTTP request referer |
| refererPath | Path of the HTTP request referer |
| refererScheme | Scheme of the HTTP request referer (http or https) |
| requestHost | HTTP Host of the web page URL |
| requestPath | Path of the web page URL |
| requestScheme | Scheme of the web page URL (http or https) |
| siteTag | The key value to identify a site |
| userAgentBrowser | Browser parsed from the user agent |
| userAgentOS | OS parsed from the user agent |
AccountRumWebVitalsEventsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountRumWebVitalsEventsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountRumWebVitalsEventsAdaptiveGroupsQuantiles
| Field | Description |
|---|---|
| cumulativeLayoutShiftP50 | Cumulative Layout Shift (Core Web Vitals) (negative value indicates N/A) |
| cumulativeLayoutShiftP75 | Cumulative Layout Shift (Core Web Vitals) (negative value indicates N/A) |
| cumulativeLayoutShiftP90 | Cumulative Layout Shift (Core Web Vitals) (negative value indicates N/A) |
| cumulativeLayoutShiftP99 | Cumulative Layout Shift (Core Web Vitals) (negative value indicates N/A) |
| firstContentfulPaintP50 | First Contentful Paint in microseconds (negative value indicates N/A) |
| firstContentfulPaintP75 | First Contentful Paint in microseconds (negative value indicates N/A) |
| firstContentfulPaintP90 | First Contentful Paint in microseconds (negative value indicates N/A) |
| firstContentfulPaintP99 | First Contentful Paint in microseconds (negative value indicates N/A) |
| firstInputDelayP50 | First Input Delay (Core Web Vitals) in microseconds (negative value indicates N/A) |
| firstInputDelayP75 | First Input Delay (Core Web Vitals) in microseconds (negative value indicates N/A) |
| firstInputDelayP90 | First Input Delay (Core Web Vitals) in microseconds (negative value indicates N/A) |
| firstInputDelayP99 | First Input Delay (Core Web Vitals) in microseconds (negative value indicates N/A) |
| interactionToNextPaintP50 | Interaction to Next Paint in microseconds (negative value indicates N/A) |
| interactionToNextPaintP75 | Interaction to Next Paint in microseconds (negative value indicates N/A) |
| interactionToNextPaintP90 | Interaction to Next Paint in microseconds (negative value indicates N/A) |
| interactionToNextPaintP99 | Interaction to Next Paint in microseconds (negative value indicates N/A) |
| largestContentfulPaintP50 | Largest Contentful Paint (Core Web Vitals) in microseconds (negative value indicates N/A) |
| largestContentfulPaintP75 | Largest Contentful Paint (Core Web Vitals) in microseconds (negative value indicates N/A) |
| largestContentfulPaintP90 | Largest Contentful Paint (Core Web Vitals) in microseconds (negative value indicates N/A) |
| largestContentfulPaintP99 | Largest Contentful Paint (Core Web Vitals) in microseconds (negative value indicates N/A) |
| lcpElementRenderDelayP50 | Largest Contentful Paint Attributions Element Render Delay in microseconds (negative value indicates N/A) |
| lcpElementRenderDelayP75 | Largest Contentful Paint Attributions Element Render Delay in microseconds (negative value indicates N/A) |
| lcpElementRenderDelayP90 | Largest Contentful Paint Attributions Element Render Delay in microseconds (negative value indicates N/A) |
| lcpElementRenderDelayP99 | Largest Contentful Paint Attributions Element Render Delay in microseconds (negative value indicates N/A) |
| lcpResourceLoadDelayP50 | Largest Contentful Paint Attributions Resource Load Delay in microseconds (negative value indicates N/A) |
| lcpResourceLoadDelayP75 | Largest Contentful Paint Attributions Resource Load Delay in microseconds (negative value indicates N/A) |
| lcpResourceLoadDelayP90 | Largest Contentful Paint Attributions Resource Load Delay in microseconds (negative value indicates N/A) |
| lcpResourceLoadDelayP99 | Largest Contentful Paint Attributions Resource Load Delay in microseconds (negative value indicates N/A) |
| lcpResourceLoadTimeP50 | Largest Contentful Paint Attributions Resource Load Time in microseconds (negative value indicates N/A) |
| lcpResourceLoadTimeP75 | Largest Contentful Paint Attributions Resource Load Time in microseconds (negative value indicates N/A) |
| lcpResourceLoadTimeP90 | Largest Contentful Paint Attributions Resource Load Time in microseconds (negative value indicates N/A) |
| lcpResourceLoadTimeP99 | Largest Contentful Paint Attributions Resource Load Time in microseconds (negative value indicates N/A) |
| timeToFirstByteP50 | Time to First Byte in microseconds (negative value indicates N/A) |
| timeToFirstByteP75 | Time to First Byte in microseconds (negative value indicates N/A) |
| timeToFirstByteP90 | Time to First Byte in microseconds (negative value indicates N/A) |
| timeToFirstByteP99 | Time to First Byte in microseconds (negative value indicates N/A) |
AccountRumWebVitalsEventsAdaptiveGroupsSum
| Field | Description |
|---|---|
| clsGood | Cumulative Layout Shift (Core Web Vitals), count of Good occurrences (under 0.1) |
| clsNeedsImprovement | Cumulative Layout Shift (Core Web Vitals), count of Needs Improvement occurrences (between 0.1 and 0.25) |
| clsPoor | Cumulative Layout Shift (Core Web Vitals), count of Poor occurrences (over 0.25) |
| clsTotal | Cumulative Layout Shift (Core Web Vitals), total count |
| fcpGood | First Contentful Paint, count of Good occurrences (under 1.8 s) |
| fcpNeedsImprovement | First Contentful Paint, count of Needs Improvement occurrences (between 1.8 s and 3 s) |
| fcpPoor | First Contentful Paint, count of Poor occurrences (over 3 s) |
| fcpTotal | First Contentful Paint, total count |
| fidGood | First Input Delay (Core Web Vitals), count of Good occurrences (under 100 ms) |
| fidNeedsImprovement | First Input Delay (Core Web Vitals), count of Needs Improvement occurrences (between 100 ms and 300ms) |
| fidPoor | First Input Delay (Core Web Vitals), count of Poor occurrences (over 300 ms) |
| fidTotal | First Input Delay (Core Web Vitals), total count |
| inpGood | Interaction to Next Paint, count of Good occurrences (under 200 ms) |
| inpNeedsImprovement | Interaction to Next Paint, count of Needs Improvement occurrences (between 200 ms and 500ms) |
| inpPoor | Interaction to Next Paint, count of Poor occurrences (over 500 ms) |
| inpTotal | Interaction to Next Paint, total count |
| lcpGood | Largest Contentful Paint (Core Web Vitals), count of Good occurrences (under 2.5 sec) |
| lcpNeedsImprovement | Largest Contentful Paint (Core Web Vitals), count of Needs Improvement occurrences (between 2.5 sec and 4.0 sec) |
| lcpPoor | Largest Contentful Paint (Core Web Vitals), count of Poor occurrences (over 4.0 sec) |
| lcpTotal | Largest Contentful Paint (Core Web Vitals), total count |
| ttfbGood | Time to First Byte, count of Good occurrences (under 800 ms) |
| ttfbNeedsImprovement | Time to First Byte, count of Needs Improvement occurrences (between 800 ms and 1800ms) |
| ttfbPoor | Time to First Byte, count of Poor occurrences (over 500 ms) |
| ttfbTotal | Time to First Byte, total count |
| visits | The number of pages viewed by end-users that were initiated from a different website (i.e. where the Document.referrer does not match the hostname) |
AccountRumWebVitalsEventsAdaptiveOrderBy
| Field | Description |
|---|---|
AccountSettings
Access and limitations for an account
| Field | Description |
|---|---|
| MagicWANConnectorMetricsAdaptiveGroups | |
| accessLoginRequestsAdaptiveGroups | |
| advancedDnsProtectionNetworkAnalyticsAdaptiveGroups | |
| advancedTcpProtectionNetworkAnalyticsAdaptiveGroups | |
| aiGatewayCacheAdaptiveGroups | |
| aiGatewayErrorsAdaptiveGroups | |
| aiGatewayRequestsAdaptiveGroups | |
| aiInferenceAdaptive | |
| aiInferenceAdaptiveGroups | |
| browserRenderingEventsAdaptive | |
| browserRenderingEventsAdaptiveGroups | |
| callsStatusAdaptive | |
| callsUsageAdaptiveGroups | |
| cdnNetworkAnalyticsAdaptiveGroups | |
| d1AnalyticsAdaptiveGroups | |
| d1QueriesAdaptiveGroups | |
| d1StorageAdaptiveGroups | |
| dosdAttackAnalyticsGroups | |
| dosdNetworkAnalyticsAdaptiveGroups | |
| durableObjectsInvocationsAdaptiveGroups | |
| durableObjectsPeriodicGroups | |
| durableObjectsStorageGroups | |
| durableObjectsSubrequestsAdaptiveGroups | |
| fbmAttackAnalyticsGroups | |
| firewallEventsAdaptive | |
| firewallEventsAdaptiveGroups | |
| flowtrackdNetworkAnalyticsAdaptiveGroups | |
| gatewayL4DownstreamSessionsAdaptiveGroups | |
| gatewayL4SessionsAdaptiveGroups | |
| gatewayL4UpstreamSessionsAdaptiveGroups | |
| gatewayL7RequestsAdaptiveGroups | |
| gatewayResolverByCategoryAdaptiveGroups | |
| gatewayResolverByCustomResolverGroups | |
| gatewayResolverByRuleExecutionPerformanceAdaptiveGroups | |
| gatewayResolverQueriesAdaptiveGroups | |
| httpRequests1dGroups | |
| httpRequests1hGroups | |
| httpRequests1mGroups | |
| httpRequestsAdaptive | |
| httpRequestsAdaptiveGroups | |
| httpRequestsOverviewAdaptiveGroups | |
| hyperdriveQueriesAdaptiveGroups | |
| imagesRequestsAdaptiveGroups | |
| imagesUniqueTransformations | |
| kvOperationsAdaptiveGroups | |
| kvStorageAdaptiveGroups | |
| logpushHealthAdaptiveGroups | |
| magicFirewallNetworkAnalyticsAdaptiveGroups | |
| magicFirewallSamplesAdaptiveGroups | |
| magicIDPSNetworkAnalyticsAdaptiveGroups | |
| magicTransitNetworkAnalyticsAdaptiveGroups | |
| magicTransitTunnelHealthChecksAdaptiveGroups | |
| magicTransitTunnelTrafficAdaptiveGroups | |
| mnmFlowDataAdaptiveGroups | |
| nelReportsAdaptiveGroups | |
| ohttpMetricsAdaptive | |
| ohttpMetricsAdaptiveGroups | |
| pagesFunctionsInvocationsAdaptiveGroups | |
| queueBacklogAdaptiveGroups | |
| queueConsumerMetricsAdaptiveGroups | |
| queueDelayedBacklogAdaptiveGroups | |
| queueMessageOperationsAdaptiveGroups | |
| r2OperationsAdaptiveGroups | |
| r2StorageAdaptiveGroups | |
| rumPageloadEventsAdaptiveGroups | |
| rumPerformanceEventsAdaptiveGroups | |
| rumWebVitalsEventsAdaptive | |
| rumWebVitalsEventsAdaptiveGroups | |
| sinkholeRequestLogsAdaptive | |
| sinkholeRequestLogsAdaptiveGroups | |
| spectrumNetworkAnalyticsAdaptiveGroups | |
| storageTraces | |
| streamMinutesViewedAdaptiveGroups | |
| turnstileAdaptiveGroups | |
| vectorizeQueriesAdaptiveGroups | |
| vectorizeStorageAdaptiveGroups | |
| videoBufferEventsAdaptiveGroups | |
| videoPlaybackEventsAdaptiveGroups | |
| videoQualityEventsAdaptiveGroups | |
| warpDeviceAdaptiveGroups | |
| workerPlacementAdaptiveGroups | |
| workersAnalyticsEngineAdaptiveGroups | |
| workersInvocationsAdaptive | |
| workersInvocationsScheduled | |
| workersOverviewDataAdaptiveGroups | |
| workersOverviewRequestsAdaptiveGroups | |
| workersSubrequestsAdaptiveGroups | |
| zarazTrackAdaptiveGroups | |
| zarazTriggersAdaptiveGroups | |
| zeroTrustPrivateNetworkDiscoveryGroups |
AccountSinkholeRequestLogsAdaptive
Sinkhole Request Logs
| Field | Description |
|---|---|
| body | The request body |
| datetime | The date and time the event was recorded |
| destinationAddress | The destination IP address of the request |
| headers | The request headers. If a header has multiple values, the values are comma separated. Each header is newline separated. |
| host | The host the request was sent to |
| method | The request method |
| r2Path | The path to the object within the R2 bucket linked to this sinkhole that stores overflow body and header data. Blank if neither headers nor body was larger than 256 bytes. |
| referrer | The referrer of the request |
| sampleInterval | ABR sample interval |
| sinkholeId | The ID of the sinkhole that logged the request |
| sourceAddress | The sender's IP address |
| uri | The request uri |
| url | The request url |
| userAgent | The request user agent |
AccountSinkholeRequestLogsAdaptiveFilter_InputObject
| Field | Description |
|---|---|
AccountSinkholeRequestLogsAdaptiveGroups
Sinkhole Request Logs
| Field | Description |
|---|---|
| count | Number of requests logged |
| dimensions | List of dimensions to group by |
AccountSinkholeRequestLogsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| body | The request body |
| datetime | The date and time the event was recorded |
| destinationAddress | The destination IP address of the request |
| headers | The request headers. If a header has multiple values, the values are comma separated. Each header is newline separated. |
| host | The host the request was sent to |
| method | The request method |
| r2Path | The path to the object within the R2 bucket linked to this sinkhole that stores overflow body and header data. Blank if neither headers nor body was larger than 256 bytes. |
| referrer | The referrer of the request |
| sinkholeId | The ID of the sinkhole that logged the request |
| sourceAddress | The sender's IP address |
| uri | The request uri |
| url | The request url |
| userAgent | The request user agent |
AccountSinkholeRequestLogsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountSinkholeRequestLogsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountSinkholeRequestLogsAdaptiveOrderBy
| Field | Description |
|---|---|
AccountSpectrumNetworkAnalyticsAdaptiveGroups
Network analytics data for Spectrum traffic
| Field | Description |
|---|---|
| avg | The average of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountSpectrumNetworkAnalyticsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
| bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
| bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
| bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
| bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
| bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
| bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
| packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
| packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
| packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
| packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
| packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
| packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
| packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountSpectrumNetworkAnalyticsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| applicationTag | Application tag associated with the packet |
| coloCity | City where the Cloudflare datacenter that received the packet is located |
| coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
| coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
| coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
| coloName | Cloudflare datacenter that received the packet (unique site identifier) |
| date | Date that the packet was received |
| datetime | Date and time that the packet was received |
| datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
| datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
| datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
| datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
| datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
| destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
| destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
| destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
| destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
| destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
| direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
| ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
| greChecksum | Value of the Checkusm header field in the GRE packet |
| greEthertype | Value of the Ethertype header field in the GRE packet |
| greHeaderLength | Length of the GRE packet header, in bytes |
| greKey | Value of the Key header field in the GRE packet |
| greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
| greVersion | Value of the Version header field in the GRE packet |
| icmpChecksum | Value of the Checkusm header field in the ICMP packet |
| icmpCode | Value of the Code header field in the ICMP packet |
| icmpType | Value of the Type header field in the ICMP packet |
| ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
| ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
| ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
| ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
| ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
| ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
| ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
| ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
| ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
| ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
| ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
| ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
| ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
| ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
| ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
| ipv4Identification | Value of the Identification header field in the IPv4 packet |
| ipv4Options | List of Options numbers included in the IPv4 packet header |
| ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
| ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
| ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
| ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
| ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
| leaseTag | IP lease tag associated with the packet |
| mitigationSystem | Which system dropped the packet (possible values: dosd, flowtrackd, magic-firewall) |
| outcome | The action that was taken on the packet (possible values: pass, drop) |
| prefixTag | IP prefix tag associated with the packet |
| sampleInterval | ABR sample interval |
| sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
| sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
| sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
| sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
| sourcePort | Value of the Source Port header field in the TCP or UDP packet |
| tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
| tcpChecksum | Value of the Checkusm header field in the TCP packet |
| tcpDataOffset | Value of the Data Offset header field in the TCP packet |
| tcpFlags | Value of the Flags header field in the TCP packet |
| tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
| tcpMss | Value of the MSS option header field in the TCP packet |
| tcpOptions | List of Options numbers included in the TCP packet header |
| tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
| tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
| tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
| tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
| tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
| tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
| tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
| tcpWindowSize | Value of the Window Size header field in the TCP packet |
| udpChecksum | Value of the Checkusm header field in the UDP packet |
| udpPayloadLength | Value of the Payload Length header field in the UDP packet |
AccountSpectrumNetworkAnalyticsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountSpectrumNetworkAnalyticsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountSpectrumNetworkAnalyticsAdaptiveGroupsSum
| Field | Description |
|---|---|
| bits | Sum of bits received |
| packets | Sum of packets received |
AccountStorageTraces
Storage Tracing Information
| Field | Description |
|---|---|
| containerId | The container that this resource is stored under. |
| datetime | Storage trace timestamp |
| resourceId | The identifier to access this resource in the container. |
| serviceId | The identifier of the storage service that houses the resourse. |
| traceId | The ID that this trace entry is under. |
| userAccountId | The AccountID of the user who owns the resource. |
AccountStorageTracesFilter_InputObject
| Field | Description |
|---|---|
AccountStorageTracesOrderBy
| Field | Description |
|---|---|
AccountStreamMinutesViewedAdaptiveGroups
A high-level summary of Cloudflare Stream minutes viewed.
| Field | Description |
|---|---|
| count | The number of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountStreamMinutesViewedAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| clientCountryName | ISO 3166 alpha2 country code from the client |
| creator | Customer-provided creator ID of a video |
| date | The date the event occurred at the edge |
| datetime | The date and time the event occurred at the edge |
| datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
| datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
| datetimeHour | The date and time the event occurred at the edge truncated to hours |
| datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
| mediaType | The source of the minutes viewed |
| uid | Unique ID of a video |
AccountStreamMinutesViewedAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountStreamMinutesViewedAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountStreamMinutesViewedAdaptiveGroupsSum
| Field | Description |
|---|---|
| minutesViewed |
AccountTurnstileAdaptiveGroups
Beta. Cloudflare Turnstile aggregated events with adaptive sampling
| Field | Description |
|---|---|
| avg | |
| count | Number of Cloudflare Turnstile events processed |
| dimensions | List of dimensions to group by |
AccountTurnstileAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval | Average sample interval |
AccountTurnstileAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| action | The action tag of the challenge event |
| date | The date the challenge event was emitted |
| datetime | The date and time the challenge event was emitted |
| datetimeDay | The date and time the challenge event was emitted truncated to the day |
| datetimeFifteenMinutes | The date and time the challenge event was emitted truncated to a multiple of 15 minutes |
| datetimeFiveMinutes | The date and time the challenge event was emitted truncated to a multiple of 5 minutes |
| datetimeHalfOfHour | The date and time the challenge event was emitted truncated to a multiple of 30 minutes |
| datetimeHour | The date and time the challenge event was emitted truncated to the hour |
| datetimeMinute | The date and time the challenge event was emitted truncated to the minute |
| eventType | The type of the Cloudflare Turnstile event |
| siteKey | The sitekey of the widget associated with the event |
AccountTurnstileAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountTurnstileAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountVectorizeQueriesAdaptiveGroups
Beta. Vectorize usage with adaptive sampling
| Field | Description |
|---|---|
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountVectorizeQueriesAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | Vectorize storage sample timestamp |
| datetimeHour | Vectorize storage sample timestamp, truncated to the hour |
| vectorizeIndexId | Identifier for a Vectorize index |
AccountVectorizeQueriesAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountVectorizeQueriesAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountVectorizeQueriesAdaptiveGroupsSum
| Field | Description |
|---|---|
| queriedVectorDimensions | The number of queried vector dimensions in Vectorize over the queried time period. |
AccountVectorizeStorageAdaptiveGroups
Beta. Vectorize storage with adaptive sampling
| Field | Description |
|---|---|
| dimensions | List of dimensions to group by |
| max | The max of values for a metric per dimension |
AccountVectorizeStorageAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | Vectorize storage sample timestamp |
| datetimeHour | Vectorize storage sample timestamp, truncated to the hour |
| vectorizeIndexId | Identifier for a Vectorize index |
AccountVectorizeStorageAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountVectorizeStorageAdaptiveGroupsMax
| Field | Description |
|---|---|
| storedVectorDimensions | The maximum number of stored vector dimensions in Vectorize over the queried time period. |
AccountVectorizeStorageAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountVideoBufferEventsAdaptiveGroups
Beta. Aggregated video streaming buffer event metrics with adaptive sampling
| Field | Description |
|---|---|
| avg | |
| count | Total number of buffer events |
| dimensions | List of dimensions to group by |
AccountVideoBufferEventsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval | Average sample interval |
AccountVideoBufferEventsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| clientCountryName | ISO 3166 alpha2 country code from the client |
| date | Request date of the event |
| datetime | Request datetime of the event |
| datetimeFifteenMinutes | Request datetime of the event, truncated to multiple of 15 minutes |
| datetimeFiveMinutes | Request datetime of the event, truncated to multiple of 5 minutes |
| datetimeHalfOfHour | Request datetime of the event, truncated to multiple of 30 minutes |
| datetimeHour | Request datetime of the event, truncated to the hour |
| datetimeMinute | Request datetime of the event, truncated to the minute |
| deviceBrowser | Browser of the device used in playback |
| deviceOs | OS of the device used in playback |
| deviceType | Device type used in playback |
| uid | unique id for a video |
AccountVideoBufferEventsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountVideoBufferEventsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountVideoPlaybackEventsAdaptiveGroups
Beta. Aggregated video streaming playback event metrics with adaptive sampling
| Field | Description |
|---|---|
| avg | |
| count | Total number of playback starts |
| dimensions | List of dimensions to group by |
| sum |
AccountVideoPlaybackEventsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval | Average sample interval |
AccountVideoPlaybackEventsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| clientCountryName | ISO 3166 alpha2 country code from the client |
| date | Request date of the event |
| datetime | Request datetime of the event |
| datetimeFifteenMinutes | Request datetime of the event, truncated to multiple of 15 minutes |
| datetimeFiveMinutes | Request datetime of the event, truncated to multiple of 5 minutes |
| datetimeHalfOfHour | Request datetime of the event, truncated to multiple of 30 minutes |
| datetimeHour | Request datetime of the event, truncated to the hour |
| datetimeMinute | Request datetime of the event, truncated to the minute |
| deviceBrowser | Browser of the device used in playback |
| deviceOs | OS of the device used in playback |
| deviceType | Device type used in playback |
| uid | unique id for a video |
AccountVideoPlaybackEventsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountVideoPlaybackEventsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountVideoPlaybackEventsAdaptiveGroupsSum
| Field | Description |
|---|---|
| timeViewedMinutes | Total time viewed in minutes |
AccountVideoQualityEventsAdaptiveGroups
Beta. Aggregated video streaming quality change event metrics with adaptive sampling
| Field | Description |
|---|---|
| avg | |
| count | Total number of quality change events |
| dimensions | List of dimensions to group by |
AccountVideoQualityEventsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval | Average sample interval |
AccountVideoQualityEventsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| clientCountryName | ISO 3166 alpha2 country code from the client |
| date | Request date of the event |
| datetime | Request datetime of the event |
| datetimeFifteenMinutes | Request datetime of the event, truncated to multiple of 15 minutes |
| datetimeFiveMinutes | Request datetime of the event, truncated to multiple of 5 minutes |
| datetimeHalfOfHour | Request datetime of the event, truncated to multiple of 30 minutes |
| datetimeHour | Request datetime of the event, truncated to the hour |
| datetimeMinute | Request datetime of the event, truncated to the minute |
| deviceBrowser | Browser of the device used in playback |
| deviceOs | OS of the device used in playback |
| deviceType | Device type used in playback |
| qualityResolution | Video playback vertical resolution |
| uid | unique id for a video |
AccountVideoQualityEventsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountVideoQualityEventsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountWarpDeviceAdaptiveGroups
Beta. Warp device health events with adaptive sampling
| Field | Description |
|---|---|
| count | Number of device health events, which usually occur at 2m intervals per device |
| dimensions | List of dimensions to group by |
| uniq |
AccountWarpDeviceAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| clientPlatform | Device's OS |
| clientVersion | Device's Warp version |
| colo | Device's connected colo |
| date | The date of the device log |
| datetime | The date and time of the device log |
| datetimeFiveMinute | The date and time of the device log truncated to every five minutes |
| datetimeHour | The date and time of the device log truncated to the hour |
| datetimeTenMinute | The date and time of the device log truncated to every ten minutes |
| deviceId | Device ID |
| mode | Device's Warp mode |
| status | Device connection status |
AccountWarpDeviceAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountWarpDeviceAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountWarpDeviceAdaptiveGroupsUniq
| Field | Description |
|---|---|
| deviceIds | Approximate count of unique deviceIds |
AccountWorkerPlacementAdaptiveGroups
Worker placement metrics
| Field | Description |
|---|---|
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountWorkerPlacementAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | Request timestamp, truncated to start of a day |
| datetime | Request timestamp |
| datetimeHour | Request timestamp, truncated to start of an hour |
| datetimeMinute | Request timestamp, truncated to start of an minute |
| httpStatus | Response status of worker |
| isSample | 1 if the request was sampled to bypass Smart Placement, 0 otherwise |
| placementUsed | 1 if the request was processed using Smart Placement, 0 if it was processed in default mode |
| requestDurationBucketMin | Bucket of request duration rounded down to nearest 10*2^n |
| requestDurationBucketMin100ms | Bucket of request duration rounded down to nearest 100ms |
| scriptName | The script name |
| scriptTag | The unique tag of the script |
AccountWorkerPlacementAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountWorkerPlacementAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountWorkerPlacementAdaptiveGroupsSum
| Field | Description |
|---|---|
| requestDuration | Sum of duration ms of requests measured at the data centers that receive the requests |
| requests | Total number of requests |
AccountWorkersAnalyticsEngineAdaptiveGroups
Beta. Custom Events with adaptive sampling
| Field | Description |
|---|---|
| count | The number of values for a metric per dimension |
| dimensions | List of dimensions to group by |
AccountWorkersAnalyticsEngineAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| dataset | The dataset name |
| date | The date the event occurred |
| datetime | The date and time the event occurred |
| datetimeFifteenMinutes | The date and time the event occurred truncated to a multiple of 15 minutes |
| datetimeFiveMinutes | The date and time the event occurred truncated to a multiple of 5 minutes |
| datetimeHour | The date and time the event occurred truncated to the start of an hour |
| datetimeMinute | The date and time the event occurred truncated to the start of a minute |
AccountWorkersAnalyticsEngineAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountWorkersAnalyticsEngineAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountWorkersInvocationsAdaptive
Beta. Workers invocations with adaptive sampling
| Field | Description |
|---|---|
| avg | The average value used for sample interval |
| dimensions | List of dimensions to group by |
| max | The max value for a metric |
| min | The min value for a metric |
| quantiles | Quantiles of a metric per dimension |
| sum | The sum of values for a metric per dimension |
AccountWorkersInvocationsAdaptiveAvg
| Field | Description |
|---|---|
| sampleInterval |
AccountWorkersInvocationsAdaptiveDimensions
| Field | Description |
|---|---|
| date | Request datetime, truncated to start of a day |
| datetime | Request datetime |
| datetimeFifteenMinutes | The date and time of the event truncated to fifteen minutes |
| datetimeFiveMinutes | The date and time of the event truncated to five minutes |
| datetimeHour | Request datetime, truncated to start of an hour |
| datetimeMinute | Request datetime, truncated to start of an minute |
| dispatchNamespaceName | The name of the script's dispatch namespace |
| environmentName | The name of the script environment |
| isDispatcher | Whether the request is from a Dispatch Worker. Non-zero if true |
| scriptName | The name of the script |
| scriptTag | The unique tag of the script |
| scriptVersion | The version of the Worker |
| status | Status of the worker invocation |
| usageModel | Usage model of the worker invocation |
AccountWorkersInvocationsAdaptiveFilter_InputObject
| Field | Description |
|---|---|
AccountWorkersInvocationsAdaptiveMax
| Field | Description |
|---|---|
| cpuTime | Maximum CPU time for one request - microseconds |
| duration | Maximum duration of one request - GB*s |
| responseBodySize | Maximum response body size for one request - bytes |
| wallTime | Maximum wall time for one request - microseconds |
AccountWorkersInvocationsAdaptiveMin
| Field | Description |
|---|---|
| cpuTime | Minimum CPU time for one request - microseconds |
| duration | Minimum duration of one request - GB*s |
| responseBodySize | Minimum response body size for one request - bytes |
| wallTime | Minimum wall time for one request - microseconds |
AccountWorkersInvocationsAdaptiveOrderBy
| Field | Description |
|---|---|
AccountWorkersInvocationsAdaptiveQuantiles
| Field | Description |
|---|---|
| cpuTimeP25 | CPU time 25th percentile - microseconds |
| cpuTimeP50 | CPU time 50th percentile - microseconds |
| cpuTimeP75 | CPU time 75th percentile - microseconds |
| cpuTimeP90 | CPU time 90th percentile - microseconds |
| cpuTimeP95 | CPU time 95th percentile - microseconds |
| cpuTimeP99 | CPU time 99th percentile - microseconds |
| cpuTimeP999 | CPU time 99.9th percentile - microseconds |
| durationP25 | Duration 25th percentile - GB*s |
| durationP50 | Duration 50th percentile - GB*s |
| durationP75 | Duration 75th percentile - GB*s |
| durationP90 | Duration 90th percentile - GB*s |
| durationP95 | Duration 95th percentile - GB*s |
| durationP99 | Duration 99th percentile - GB*s |
| durationP999 | Duration 99.9th percentile - GB*s |
| responseBodySizeP25 | Response body size 25th percentile - bytes |
| responseBodySizeP50 | Response body size 50th percentile - bytes |
| responseBodySizeP75 | Response body size 75th percentile - bytes |
| responseBodySizeP90 | Response body size 90th percentile - bytes |
| responseBodySizeP95 | Response body size 95th percentile - bytes |
| responseBodySizeP99 | Response body size 99th percentile - bytes |
| responseBodySizeP999 | Response body size 99.9th percentile - bytes |
| wallTimeP25 | Wall time 25th percentile - microseconds |
| wallTimeP50 | Wall time 50th percentile - microseconds |
| wallTimeP75 | Wall time 75th percentile - microseconds |
| wallTimeP90 | Wall time 90th percentile - microseconds |
| wallTimeP95 | Wall time 95th percentile - microseconds |
| wallTimeP99 | Wall time 99th percentile - microseconds |
| wallTimeP999 | Wall time 99.9th percentile - microseconds |
AccountWorkersInvocationsAdaptiveSum
| Field | Description |
|---|---|
| cpuTimeUs | Sum of cpu time in us |
| duration | Sum of Duration - GB*s |
| errors | Sum of Errors |
| requests | Sum of Requests |
| responseBodySize | Sum of Response Body Sizes |
| subrequests | Sum of Subrequests |
| wallTime | Sum of Wall Time |
AccountWorkersInvocationsScheduled
Workers scheduled invocations
| Field | Description |
|---|---|
| cpuTimeUs | CPU time - microseconds |
| cron | The cron string of the schedule |
| datetime | Request datetime |
| environmentName | The name of the script environment |
| scheduledDatetime | Scheduled datetime |
| scriptName | The name of the script |
| status | Status of the worker invocation |
AccountWorkersInvocationsScheduledFilter_InputObject
| Field | Description |
|---|---|
AccountWorkersInvocationsScheduledOrderBy
| Field | Description |
|---|---|
AccountWorkersOverviewDataAdaptiveGroups
Beta. Workers account overview invocation data with adaptive sampling
| Field | Description |
|---|---|
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountWorkersOverviewDataAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| datetime | Request datetime |
| usageModel | Usage model of the worker invocation |
AccountWorkersOverviewDataAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountWorkersOverviewDataAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountWorkersOverviewDataAdaptiveGroupsSum
| Field | Description |
|---|---|
| standardCpuTimeUs | Standard usage model cpu time in us |
| unboundDurationUs | Unbound usage model duration in us |
AccountWorkersOverviewRequestsAdaptiveGroups
Beta. Workers account overview invocation count with adaptive sampling
| Field | Description |
|---|---|
| count | The number of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountWorkersOverviewRequestsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| datetime | Request datetime |
| status | Status of the worker invocation |
| usageModel | Usage model of the worker invocation |
AccountWorkersOverviewRequestsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountWorkersOverviewRequestsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountWorkersOverviewRequestsAdaptiveGroupsSum
| Field | Description |
|---|---|
| cpuTimeUs | Cpu time in us |
AccountWorkersSubrequestsAdaptiveGroups
Beta. Workers subrequests with adaptive sampling
| Field | Description |
|---|---|
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountWorkersSubrequestsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| cacheStatus | Cache status |
| date | Request datetime, truncated to start of a day |
| datetime | Request datetime |
| datetimeHour | Request datetime, truncated to start of an hour |
| datetimeMinute | Request datetime, truncated to start of an minute |
| environmentName | The name of the script environment |
| scriptName | The name of the script |
| scriptVersion | The version of the Worker |
| usageModel | Usage model of the worker invocation |
AccountWorkersSubrequestsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountWorkersSubrequestsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountWorkersSubrequestsAdaptiveGroupsSum
| Field | Description |
|---|---|
| requestBodySizeUncached | Workers fetch request body size in bytes where the request was not cached |
| subrequests | Number of subrequests |
AccountZarazTrackAdaptiveGroups
Zaraz Track Analytics - counts zaraz.track calls
| Field | Description |
|---|---|
| count | Number of processed Zaraz Track requests |
| dimensions | List of dimensions to group by |
AccountZarazTrackAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | Date when track was called |
| datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
| datetimeFiveMinutes | The date and time truncated to five minutes |
| datetimeHour | The date and time truncated to the hour |
| datetimeMinute | The date and time truncated to the minute |
| trackName | Track Name |
| urlPath | The URL from where Track was called |
AccountZarazTrackAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountZarazTrackAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountZarazTriggersAdaptiveGroups
Zaraz Triggers Analytics (a trigger is a set of rules that can trigger a zaraz action)
| Field | Description |
|---|---|
| count | Number of processed Zaraz Triggers |
| dimensions | List of dimensions to group by |
AccountZarazTriggersAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | The date when trigger was triggerd |
| datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
| datetimeFiveMinutes | The date and time truncated to five minutes |
| datetimeHour | The date and time truncated to the hour |
| datetimeMinute | The date and time truncated to the minute |
| triggerName | Trigger Name |
AccountZarazTriggersAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountZarazTriggersAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountZeroTrustPrivateNetworkDiscoveryGroups
Beta - Unique origins, applications, and users discovered for Zero Trust private networks
| Field | Description |
|---|---|
| count | Sum of network access during the select range |
| dimensions | List of dimensions to group by |
| max | |
| uniq |
AccountZeroTrustPrivateNetworkDiscoveryGroupsDimensions
| Field | Description |
|---|---|
| date | Request date |
| datetimeHour | Request datetime and start of the hour |
| destinationIP | Destination IPv4 or IPv6 |
| destinationPort | Destination port |
| The email address of the user who accessed the resource | |
| hostname | SNI hostname of the origin if TLS intercept is enabled |
| originId | UUID of the origin if it has been identified before |
| status | status of the origin, one of unreviewed, in_review, approved, unapproved |
| transport | The transport protocol used in the session, one of (0, tcp) (1, quic) (2, udp) |
| userId | The ID of the user who accessed the resource |
AccountZeroTrustPrivateNetworkDiscoveryGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountZeroTrustPrivateNetworkDiscoveryGroupsMax
| Field | Description |
|---|---|
| dateTime | Latest access time of a user |
AccountZeroTrustPrivateNetworkDiscoveryGroupsOrderBy
| Field | Description |
|---|---|
AccountZeroTrustPrivateNetworkDiscoveryGroupsUniq
| Field | Description |
|---|---|
| emails | Approximate count of unique emails |
| origins | Approximate count of unique origins. An origin is a (transport, destinationIP, destinationPort) |
| userIds | Approximate count of unique users |
Confidence
| Field | Description |
|---|---|
| estimate | Estimated value of this metric |
| isValid | True if the confidence interval is valid, i.e. there is enough samples at low enough sample interval |
| lower | Lower bound of confidence interval |
| sampleSize | Number of samples that contributed to the estimate |
| upper | Upper bound of confidence interval |
OrganizationFilter_InputObject
| Field | Description |
|---|---|
OrganizationHttpRequestsAdaptiveGroups
Aggregated HTTP requests data with adaptive sampling
| Field | Description |
|---|---|
| avg | The average value used for sample interval |
| confidence | ALPHA - DO NOT USE |
| count | The number of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| quantiles | Quantiles of a metric per dimension |
| ratio | The ratio of a range of status codes, between 0 and 1 |
| sum | The sum of values for a metric per dimension |
OrganizationHttpRequestsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| crossZoneSubrequests | The proportion of requests that were inititiated by a Cloudflare Worker on another zone |
| edgeDnsResponseTimeMs | |
| edgeTimeToFirstByteMs | |
| originResponseDurationMs | The average originResponseDuration, in milliseconds, excluding 0 values (i.e. cached ones) |
| sampleInterval |
OrganizationHttpRequestsAdaptiveGroupsConfidence
| Field | Description |
|---|---|
| count | The number of values for a metric per dimension, with confidence intervals |
| level | Confidence level that was requested |
| sum | The sum of values for a metric per dimension, with confidence intervals |
OrganizationHttpRequestsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| accountTag | Associated account |
| apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
| apiGatewayMatchedHost | API Gateway host matched at the edge |
| botManagementDecision | Judgement of the bot management system |
| botScore | The final score originated from bot management detections. |
| botScoreBucketBy10 | Range of the bot management score |
| botScoreSrcName | Name of the source detection which generated the bot management score. |
| cacheReserveUsed | Used Cache Reserve to serve the response |
| cacheStatus | |
| clientASNDescription | The ASN of the visitor as string |
| clientAsn | |
| clientCountryName | Country from which request originated |
| clientDeviceType | |
| clientIP | |
| clientRefererHost | The referrer host |
| clientRequestHTTPHost | Host requested by the client |
| clientRequestHTTPMethodName | HTTP method of client request |
| clientRequestHTTPProtocol | HTTP protocol version |
| clientRequestPath | Path of client request |
| clientRequestQuery | Query parameters of client request |
| clientRequestReferer | HTTP request referrer |
| clientRequestScheme | HTTP request URI scheme (http/https) |
| clientSSLProtocol | SSL protocol version |
| coloCode | |
| contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
| contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
| contentScanNumObj | Number of scannable content objects |
| contentScanObjResults | Array of scan results in order of detection |
| contentScanObjSizes | Array of scan sizes in order of detection |
| contentScanObjTypes | Array of content types in order of detection |
| date | The date the event occurred at the edge |
| datetime | The date and time the event occurred at the edge |
| datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
| datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
| datetimeHour | The date and time the event occurred at the edge truncated to hours |
| datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
| edgeDnsResponseTimeMs | The time elapsed resolving a CNAME if it was required to reach your origin |
| edgeResponseContentTypeName | |
| edgeResponseStatus | |
| edgeTimeToFirstByteMs | The time elapsed between processing the first byte of the request until when we started sending a response |
| httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application |
| isCrossZoneSubrequest | '1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise. |
| ja3Hash | MD5 hash of the JA3 TLS fingerprint |
| ja4 | JA4 TLS fingerprint |
| leakedCredentialCheckResult | The distinct result of checking for leaked credentials |
| originASN | |
| originASNDescription | ASN associated with origin |
| originIP | |
| originResponseDurationMs | |
| originResponseStatus | HTTP response status code returned by the origin |
| requestSource | |
| sampleInterval | ABR sample interval |
| securityAction | The code of the first-class action the Cloudflare Firewall took on this request |
| securitySource | The Cloudflare security product triggered by this request |
| upperTierColoName | |
| userAgent | |
| userAgentBrowser | Browser parsed from the user agent |
| userAgentOS | OS parsed from the user agent |
| wafAttackScore | Beta. Overall request score generated by the WAF detection module |
| wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
| wafRceAttackScore | Beta. WAF score for a RCE attack |
| wafSqliAttackScore | Beta. WAF score for a SQLi attack |
| wafXssAttackScore | Beta. WAF score for a XSS attack |
| xRequestedWith | The X-Requested-With header of the client request |
| zoneTag | Associated zone |
| zoneVersion | The version of a zone |
OrganizationHttpRequestsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
OrganizationHttpRequestsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
OrganizationHttpRequestsAdaptiveGroupsQuantiles
| Field | Description |
|---|---|
| edgeDnsResponseTimeMsP50 | 50th percentile DNS Response Time (milliseconds) |
| edgeDnsResponseTimeMsP95 | 95th percentile DNS Response Time (milliseconds) |
| edgeDnsResponseTimeMsP99 | 99th percentile DNS Response Time (milliseconds) |
| edgeTimeToFirstByteMsP50 | 50th percentile Time To First Byte (milliseconds) |
| edgeTimeToFirstByteMsP95 | 95th percentile Time To First Byte (milliseconds) |
| edgeTimeToFirstByteMsP99 | 99th percentile Time To First Byte (milliseconds) |
| originResponseDurationMsP50 | 50th percentile Origin Response Duration (milliseconds) |
| originResponseDurationMsP95 | 95th percentile Origin Response Duration (milliseconds) |
| originResponseDurationMsP99 | 99th percentile Origin Response Duration (milliseconds) |
OrganizationHttpRequestsAdaptiveGroupsRatio
| Field | Description |
|---|---|
| status4xx | |
| status5xx |
OrganizationHttpRequestsAdaptiveGroupsSum
| Field | Description |
|---|---|
| crossZoneSubrequests | The number of requests that were inititiated by a Cloudflare Worker on another zone |
| edgeDnsResponseTimeMs | |
| edgeResponseBytes | |
| edgeTimeToFirstByteMs | |
| originResponseDurationMs | |
| visits | The number of requests by end-users that were initiated from a different website (i.e. where the request HTTP Referer header does not match the host in the HTTP Host header) |
OrganizationHttpRequestsAdaptiveGroupsSumConfidence
| Field | Description |
|---|---|
| edgeResponseBytes | Confidence interval for the corresponding point estimate |
OrganizationSettings
Access and limitations for an organization
| Field | Description |
|---|---|
| httpRequestsAdaptiveGroups |
Query
| Field | Description |
|---|---|
| cost | |
| viewer |
Settings
Access and limitations
| Field | Description |
|---|---|
| availableFields | The list of available fields to query |
| enabled | |
| maxDuration | Requested time range should not be wider than this (seconds) |
| maxNumberOfFields | Maximum number of fields to request at once |
| maxPageSize | Maximum allowed value for 'limit' |
| notOlderThan | Cannot reach for data beyond this distance in the past (seconds) |
ZoneApiGatewayGraphqlQueryAnalyticsGroups
GraphQL query attributes and trends
| Field | Description |
|---|---|
| avg | |
| count | Number of events with GraphQL query attributes computed |
| dimensions | List of dimensions to group by |
ZoneApiGatewayGraphqlQueryAnalyticsGroupsAvg
| Field | Description |
|---|---|
| sampleInterval | Average sample interval |
ZoneApiGatewayGraphqlQueryAnalyticsGroupsDimensions
| Field | Description |
|---|---|
| apiGatewayGraphqlQueryDepth | Maximum depth level of a terminal (leaf) field in the query |
| apiGatewayGraphqlQuerySize | Number of terminal (leaf) fields in the query |
| date | |
| datetime | |
| datetimeDay | |
| datetimeFifteenMinutes | |
| datetimeFiveMinutes | |
| datetimeHalfOfHour | |
| datetimeHour | |
| datetimeMinute |
ZoneApiGatewayGraphqlQueryAnalyticsGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneApiGatewayGraphqlQueryAnalyticsGroupsOrderBy
| Field | Description |
|---|---|
ZoneApiGatewayMatchedSessionIDsAdaptiveGroups
Beta. Aggregated count of Session Identifier matches
| Field | Description |
|---|---|
| avg | |
| count | Number of events with Session Identifiers |
| dimensions | List of dimensions to group by |
ZoneApiGatewayMatchedSessionIDsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval | Average sample interval |
ZoneApiGatewayMatchedSessionIDsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| apiGatewayMatchedSessionIdentifierName | Name of session identifier |
| apiGatewayMatchedSessionIdentifierType | Type of session identifier. Possible values are header | cookie |
| date | |
| datetime | |
| datetimeDay | |
| datetimeFifteenMinutes | |
| datetimeFiveMinutes | |
| datetimeHalfOfHour | |
| datetimeHour | |
| datetimeMinute |
ZoneApiGatewayMatchedSessionIDsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneApiGatewayMatchedSessionIDsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneApiRequestSequencesGroups
Sequences of API endpoint operations. Sequences are learned by grouping requests by AuthID. Correlation scores are estimated over a 24 hour window and are current to within 10 minutes
| Field | Description |
|---|---|
| aggArgMax | |
| aggMax | |
| dimensions | List of dimensions to group by |
| uniq |
ZoneApiRequestSequencesGroupsAggArgMax
| Field | Description |
|---|---|
| correlation | Correlation score estimated over a 24 hour window. The correlation score is the probability that the last operation in the sequence is preceded by the remaining operations in the sequence, assuming that the last operation in the sequence occurred |
| numOccurrences | Estimated number of occurrences of this sequence of endpoint operations |
| numOccurrencesLast | Estimated number of occurrences of the last operation in this sequence of endpoint operations |
| numOccurrencesPrefix | Estimated number of occurrences of this sequence of endpoint operations, disregarding the last operation |
| numOccurrencesSuffix | DEPRECATED (Field is not guaranteed to be always populated for sequences of length greater than 2. Use numOccurrencesLast instead): Estimated number of occurrences of this sequence of endpoint operations, disregarding the first operation |
| operationsApiEndpoints | API endpoints in the sequence of operations. Individual endpoints are delimited by # symbols |
| operationsClientRequestHTTPMethods | HTTP request methods in the sequence of operations. Individual request method names are delimited by # symbols |
| samplingFraction | Fraction of requests sampled |
ZoneApiRequestSequencesGroupsAggMax
| Field | Description |
|---|---|
| timeLastSeen | Time of the most recent occurrence of this sequence of endpoint operations (based on the timestamp of the first request in the sequence) |
| timeLastUpdated | The time at which Cloudflare last refreshed this data |
ZoneApiRequestSequencesGroupsDimensions
| Field | Description |
|---|---|
| apiHost | The host associated with this sequence of endpoint operations |
| clientRequestHTTPHost | DEPRECATED (Field is replaced with apiHost): The host associated with this sequence of endpoint operations |
| datetime | Sequence generation timeslot, truncated to 10 minutes |
| operationsFirstApiEndpoint | First API endpoint in the sequence of operations |
| operationsFirstClientRequestHTTPMethod | First HTTP request method in the sequence of operations |
| operationsLastApiEndpoint | Last API endpoint in the sequence of operations |
| operationsLastClientRequestHTTPMethod | Last HTTP request method in the sequence of operations |
| operationsLength | Length of the sequence of operations |
| operationsPrefixApiEndpoints | API endpoints in the sequence of operations, disregarding the last operation. Individual endpoints are delimited by # symbols |
| operationsPrefixClientRequestHTTPMethods | HTTP request methods in the sequence of operations, disregarding the last operation. Individual request method names are delimited by # symbols |
| rank | DEPRECATED (Field is replaced with sequenceHash serving as unique sequence identifier): Sequence rank based on ordering sequences by correlation |
| sequenceHash | Unique sequence identifier obtained by hashing operationsApiEndpoints and operationsClientRequestHTTPMethods |
ZoneApiRequestSequencesGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneApiRequestSequencesGroupsOrderBy
| Field | Description |
|---|---|
ZoneApiRequestSequencesGroupsUniq
| Field | Description |
|---|---|
| rankCount | Number of unique rank values |
| sequenceHashCount | Number of unique sequenceHash values |
ZoneCacheReserveOperationsAdaptiveGroups
Beta. Cache Reserve operations with adaptive sampling
| Field | Description |
|---|---|
| avg | The average value used for sample interval |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
ZoneCacheReserveOperationsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval |
ZoneCacheReserveOperationsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| actionStatus | Status of the R2 operation |
| bucketName | Name of bucket containing stored objects |
| date | Request timestamp, truncated to start of a day |
| datetime | Request timestamp |
| datetimeFifteenMinutes | Request timestamp, truncated to multiple of 15 minutes |
| datetimeFiveMinutes | Request timestamp, truncated to multiple of 5 minutes |
| datetimeHour | Request timestamp, truncated to start of an hour |
| datetimeMinute | Request timestamp, truncated to start of an minute |
| jurisdiction | Jurisdiction of the R2 bucket, or 'default' if unrestricted |
| operationClass | Billable class of storage operation |
ZoneCacheReserveOperationsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneCacheReserveOperationsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneCacheReserveOperationsAdaptiveGroupsSum
| Field | Description |
|---|---|
| requests | Sum of Requests |
ZoneCacheReserveRequestsAdaptiveGroups
Cache Reserve HTTP requests data with adaptive sampling
| Field | Description |
|---|---|
| avg | The average value used for sample interval |
| count | |
| dimensions | List of dimensions to group by |
| sum | Sum of bytes returned to client |
ZoneCacheReserveRequestsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval |
ZoneCacheReserveRequestsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| cacheStatus | Cache status |
| date | The date the event occurred at the edge |
| datetime | The date and time the event occurred at the edge |
| datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
| datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
| datetimeHour | The date and time the event occurred at the edge truncated to hours |
| datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
| edgeResponseContentTypeName | Content type returned to client |
| edgeResponseStatus | HTTP response status code returned to browser |
ZoneCacheReserveRequestsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneCacheReserveRequestsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneCacheReserveRequestsAdaptiveGroupsSum
| Field | Description |
|---|---|
| edgeResponseBytes |
ZoneCacheReserveStorageAdaptiveGroups
Beta. Cache Reserve storage with adaptive sampling
| Field | Description |
|---|---|
| avg | The average value used for sample interval |
| dimensions | List of dimensions to group by |
| max | The max of values for a metric per dimension |
ZoneCacheReserveStorageAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval |
ZoneCacheReserveStorageAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| bucketHash | Hash of bucket containing stored objects |
| bucketName | Name of bucket containing stored objects |
| date | Storage sample timestamp, truncated to start of a day |
| datetime | Storage sample timestamp |
| datetimeFifteenMinutes | Storage sample timestamp, truncated to multiple of 15 minutes |
| datetimeFiveMinutes | Storage sample timestamp, truncated to multiple of 5 minutes |
| datetimeHour | Storage sample timestamp, truncated to start of an hour |
| datetimeMinute | Storage sample timestamp, truncated to start of an minute |
| jurisdiction | Jurisdiction of the R2 bucket, or 'default' if unrestricted |
ZoneCacheReserveStorageAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneCacheReserveStorageAdaptiveGroupsMax
| Field | Description |
|---|---|
| objectCount | Max of object count |
| storedBytes | Payload and metadata size of objects in bucket |
ZoneCacheReserveStorageAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneDmarcReportsAdaptive
Dmarc report records with adaptive sampling
| Field | Description |
|---|---|
| datetime | The date and time the source email was received |
| disposition | DMARC policy disposition |
| dkim | DKIM result |
| domain | Domain to which this report refers to |
| envelopeFrom | Envelope From of emails |
| envelopeTo | Envelope To of emails |
| evaluatedReason | Reason (if any) why the record was evaluated |
| headerFrom | Header From of emails |
| matchingMessages | Number of messages that matched |
| orgName | Organization that generated report |
| policyDKIMAlignmentMode | DKIM alignment mode specified in the policy |
| policyDomain | DMARC policy of the domain |
| policyPercentage | Percentage of emails that should be checked |
| policySPFAlignmentMode | SPF alignment mode specified in the policy |
| policySubDomain | DMARC policy of subdomains |
| recordId | Unique identifier of this record |
| recordIndex | Index of this record within the report |
| reportBegin | Start of the reporting period |
| reportEnd | End of the reporting period |
| reportError | Error message (if any) |
| reportId | Unique identifier of the report to which this record belongs |
| sampleInterval | ABR sample interval |
| sourceIP | Source IP address of the email |
| sourceLocationName | Country name from source IP |
| sourceOrgName | Source IP address organisation name |
| sourceOrgSlug | Source IP address organisation slug |
| sourcePTR | Source Domain from IP address |
| spf | SPF result |
| spfMFromDomain | Checked domain from scope mfrom |
ZoneDmarcReportsAdaptiveFilter_InputObject
| Field | Description |
|---|---|
ZoneDmarcReportsAdaptiveOrderBy
| Field | Description |
|---|---|
ZoneDmarcReportsSourcesAdaptiveGroups
Aggregated dmarc reports by sources logs with adaptive sampling
| Field | Description |
|---|---|
| avg | Beta. The avg of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | |
| uniq |
ZoneDmarcReportsSourcesAdaptiveGroupsAvg
| Field | Description |
|---|---|
| dkimPass | Percentage of dkim messages pass |
| dmarc | Percentage of dmarc messages pass |
| spfPass | Percentage of spf messages pass |
ZoneDmarcReportsSourcesAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | The date the source email was received |
| datetimeDay | The date and time the source email was received truncated to the day |
| datetimeHour | The date and time the source email was received truncated to the hour |
| datetimeLast31Days | The date and time the source email was received truncated to the last 31 days |
| datetimeMonth | The date and time the source email was received truncated to the month |
| datetimeWeek | The date and time the source email was received truncated to the week |
| disposition | DMARC policy disposition |
| dkim | DKIM result |
| domain | Domain to which this report refers to |
| envelopeFrom | Envelope From of emails |
| envelopeTo | Envelope To of emails |
| evaluatedReason | Reason (if any) why the record was evaluated |
| headerFrom | Header From of emails |
| orgName | Organization that generated report |
| sampleInterval | ABR sample interval |
| sourceIP | Source IP address of the email |
| sourceLocationName | Country name from source IP |
| sourceOrgName | Source IP address organisation name |
| sourceOrgSlug | Source IP address organisation slug |
| sourcePTR | Source Domain from IP address |
| spf | SPF result |
| spfMFromDomain | Checked domain from scope mfrom |
ZoneDmarcReportsSourcesAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneDmarcReportsSourcesAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneDmarcReportsSourcesAdaptiveGroupsSum
| Field | Description |
|---|---|
| dkimPass | Total of dkim messages pass |
| dmarc | Total of dmarc messages pass |
| spfPass | Total of spf messages pass |
| totalMatchingMessages | Total matching messages |
ZoneDmarcReportsSourcesAdaptiveGroupsUniq
| Field | Description |
|---|---|
| ipCount | Number of distinct IPs |
ZoneDnsAnalyticsAdaptive
Analytics data for DNS queries (currently, only Foundation DNS zones are supported)
| Field | Description |
|---|---|
| coloName | IATA airport code of the data center that processed the query |
| date | Date on which the query was received |
| datetime | Time at which the query was received |
| destinationIP | Cloudflare edge IP address that the query was received at |
| ipVersion | Internet Protocol version over which the query was received |
| protocol | Transport protocol over which the query was received |
| queryName | DNS query name without trailing dot |
| querySize | Size of the DNS query in bytes |
| queryType | DNS query type |
| responseCached | Whether the DNS response was served from cache |
| responseCode | DNS response code |
| responseSize | Size of the DNS response in bytes |
| responseStale | Whether a stale DNS response was served from cache |
| sampleInterval | ABR sample interval |
| sourceIP | IP address of the client that sent the query (usually this is the resolver's IP address) |
| upstreamIP | Upstream server that the query was forwarded to |
ZoneDnsAnalyticsAdaptiveFilter_InputObject
| Field | Description |
|---|---|
ZoneDnsAnalyticsAdaptiveGroups
Analytics data for DNS queries (currently, only Foundation DNS zones are supported)
| Field | Description |
|---|---|
| avg | Average of a metric per dimension |
| count | Number of queries per dimension |
| dimensions | List of dimensions to group by |
| quantiles | Quantiles of a metric per dimension |
ZoneDnsAnalyticsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| processingTimeUs | Average processing time in microseconds |
| sampleInterval | Average sample interval |
ZoneDnsAnalyticsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| coloName | IATA airport code of the data center that processed the query |
| date | Date on which the query was received |
| datetime | Time at which the query was received |
| datetimeFifteenMinutes | Time at which the query was received, truncated to multiple of 15 minutes |
| datetimeFiveMinutes | Time at which the query was received, truncated to multiple of 5 minutes |
| datetimeHalfOfHour | Time at which the query was received, truncated to multiple of 30 minutes |
| datetimeHour | Time at which the query was received, truncated to the hour |
| datetimeMinute | Time at which the query was received, truncated to the minute |
| destinationIP | Cloudflare edge IP address that the query was received at |
| ipVersion | Internet Protocol version over which the query was received |
| protocol | Transport protocol over which the query was received |
| queryName | DNS query name without trailing dot |
| querySizeBucket | Size of the DNS query in bytes (in multiples of 16) |
| queryType | DNS query type |
| responseCached | Whether the DNS response was served from cache |
| responseCode | DNS response code |
| responseSizeBucket | Size of the DNS response in bytes (in multiples of 16) |
| responseStale | Whether a stale DNS response was served from cache |
| sourceIP | IP address of the client that sent the query (usually this is the resolver's IP address) |
| upstreamIP | Upstream server that the query was forwarded to |
ZoneDnsAnalyticsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneDnsAnalyticsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneDnsAnalyticsAdaptiveGroupsQuantiles
| Field | Description |
|---|---|
| processingTimeUsP50 | 50th percentile processing time in microseconds (median) |
| processingTimeUsP90 | 90th percentile processing time in microseconds |
| processingTimeUsP99 | 99th percentile processing time in microseconds |
ZoneDnsAnalyticsAdaptiveOrderBy
| Field | Description |
|---|---|
ZoneEmailRoutingAdaptive
Beta. Raw email routing logs with adaptive sampling
| Field | Description |
|---|---|
| datetime | The date and time the source email was received |
| dkim | DKIM check status of the source email |
| dmarc | DMARC check status of the source email |
| errorDetail | Detailed error message (if any) |
| from | The sender email address of the source email |
| isNDR | Is this event related to a NDR (bounce) email? |
| messageId | The Message-ID header of the source email (if present) |
| ruleMatched | The UUID of the routing rule matched by the source email |
| sampleInterval | ABR sample interval |
| sessionId | Unique identifier for the email log entry (note: retries for the same email may result in multiple log entries) |
| spf | SPF check status of the source email |
| status | The resulting outcome (action) for the email |
| subject | The subject of the source email |
| to | The recipient email address of the source email |
ZoneEmailRoutingAdaptiveFilter_InputObject
| Field | Description |
|---|---|
ZoneEmailRoutingAdaptiveGroups
Beta. Aggregated email routing logs with adaptive sampling
| Field | Description |
|---|---|
| count | Number of emails processed |
| dimensions | List of dimensions to group by |
ZoneEmailRoutingAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | The date the source email was received |
| datetimeFifteenMinutes | The date and time the source email was received truncated to fifteen minutes |
| datetimeFiveMinutes | The date and time the source email was received truncated to five minutes |
| datetimeHour | The date and time the source email was received truncated to the hour |
| datetimeMinute | The date and time the source email was received truncated to the minute |
| dkim | DKIM check status of the source email |
| dmarc | DMARC check status of the source email |
| isNDR | Is this event related to a NDR (bounce) email? |
| ruleMatched | The UUID of the routing rule matched by the source email |
| sampleInterval | ABR sample interval |
| spf | SPF check status of the source email |
| status | The resulting outcome (action) for the email |
ZoneEmailRoutingAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneEmailRoutingAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneEmailRoutingAdaptiveOrderBy
| Field | Description |
|---|---|
ZoneFilter_InputObject
| Field | Description |
|---|---|
ZoneFirewallEventsAdaptive
Raw Firewall events with adaptive sampling
| Field | Description |
|---|---|
| action | The code of the first-class action the Cloudflare Firewall took on this request |
| apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
| apiGatewayMatchedHost | API Gateway host matched at the edge |
| botDetectionIds | Array of detections ids that matched this request |
| botDetectionTags | Array of detections tags that matched this request |
| botScore | The final score originated from bot management detections. |
| botScoreSrcName | Name of the source detection which generated the bot management score. |
| clientASNDescription | The ASN of the visitor as string |
| clientAsn | The ASN number of the visitor |
| clientCountryName | Country from which request originated |
| clientIP | The visitor's IP address (IPv4 or IPv6) |
| clientIPClass | The classification of the visitor's IP address, possible values are: unknown | clean | badHost | searchEngine | allowlist | greylist | monitoringService | securityScanner | noRecord | scan | backupService | mobilePlatform | tor |
| clientRefererHost | The referer host |
| clientRefererPath | The referer path requested by visitor |
| clientRefererQuery | The referer query-string was requested by the visitor |
| clientRefererScheme | The referer url scheme requested by the visitor |
| clientRequestHTTPHost | The HTTP hostname requested by the visitor |
| clientRequestHTTPMethodName | The HTTP method used by the visitor |
| clientRequestHTTPProtocol | The version of HTTP protocol requested by the visitor |
| clientRequestPath | The path requested by visitor |
| clientRequestQuery | The query-string was requested by the visitor |
| clientRequestScheme | The url scheme requested by the visitor |
| contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
| contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
| contentScanNumObj | Number of scannable content objects |
| contentScanObjResults | Array of scan results in order of detection |
| contentScanObjSizes | Array of scan sizes in order of detection |
| contentScanObjTypes | Array of content types in order of detection |
| date | The date the event occurred at the edge |
| datetime | The date and time the event occurred at the edge |
| datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
| datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
| datetimeHour | The date and time the event occurred at the edge truncated to hours |
| datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
| description | The description of the rule triggered by this request |
| edgeColoName | The airport code of the Cloudflare datacenter that served this request |
| edgeResponseStatus | HTTP response status code returned to browser |
| httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application |
| ja3Hash | MD5 hash of the JA3 TLS fingerprint |
| ja4 | JA4 TLS fingerprint |
| ja4Signals | Inter-request statistics computed for this JA4 across Cloudflare's entire global edge network |
| kind | The kind of event, currently only possible values are: firewall |
| leakedCredentialCheckResult | The distinct result of checking for leaked credentials |
| matchIndex | Rules match index in the chain |
| metadata | Additional product-specific information. Metadata is organized in key:value pairs |
| originResponseStatus | HTTP origin response status code returned to browser |
| originatorRayName | The RayId of the request that issued the challenge/jschallenge |
| rayName | The RayId of the request |
| ref | The ref-field is a user-defined rule identifier that can be set via the API for some firewall products and allows users to label their rules individually alongside cloudflare provided identifiers (only available to entitled customers) |
| ruleId | The Cloudflare security product-specific RuleId triggered by this request |
| rulesetId | The Cloudflare security product-specific RulesetId triggered by this request |
| sampleInterval | ABR sample interval |
| source | The Cloudflare security product triggered by this request |
| userAgent | visitor's user-agent string |
| wafAttackScore | Beta. Overall request score generated by the WAF detection module |
| wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
| wafMlAttackScore | DEPRECATED (Field is replaced with wafAttackScore): Beta. Overall request score generated by the WAF detection module |
| wafMlSqliAttackScore | DEPRECATED (Field is replaced with wafSqliAttackScore): Beta. WAF ML score for an SQLi attack |
| wafMlXssAttackScore | DEPRECATED (Field is replaced with wafXssAttackScore): Beta. WAF ML score for an XSS attack |
| wafRceAttackScore | Beta. WAF score for a RCE attack |
| wafSqliAttackScore | Beta. WAF score for a SQLi attack |
| wafXssAttackScore | Beta. WAF score for a XSS attack |
| zoneVersion | The version of a zone |
ZoneFirewallEventsAdaptiveByTimeGroups
Aggregated Firewall events with adaptive sampling grouped by time
| Field | Description |
|---|---|
| avg | The average value used for sample interval |
| count | The sum of sample interval values |
| dimensions | List of dimensions to group by |
ZoneFirewallEventsAdaptiveByTimeGroupsAvg
| Field | Description |
|---|---|
| sampleInterval |
ZoneFirewallEventsAdaptiveByTimeGroupsDimensions
| Field | Description |
|---|---|
| apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
| apiGatewayMatchedHost | API Gateway host matched at the edge |
| botScore | The final score originated from bot management detections. |
| botScoreSrcName | Name of the source detection which generated the bot management score. |
| date | The date the event occurred at the edge |
| datetime | The date and time the event occurred at the edge |
| datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
| datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
| datetimeHour | The date and time the event occurred at the edge truncated to hours |
| datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
| description | The description of the rule triggered by this request |
| httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application |
| ja3Hash | MD5 hash of the JA3 TLS fingerprint |
| ja4 | JA4 TLS fingerprint |
| wafAttackScore | Beta. Overall request score generated by the WAF detection module |
| wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
| wafMlAttackScore | DEPRECATED (Field is replaced with wafAttackScore): Beta. Overall request score generated by the WAF ML detection module |
| wafMlSqliAttackScore | DEPRECATED (Field is replaced with wafSqliAttackScore): Beta. WAF ML score for an SQLi attack |
| wafMlXssAttackScore | DEPRECATED (Field is replaced with wafXssAttackScore): Beta. WAF ML score for an XSS attack |
| wafRceAttackScore | Beta. WAF score for a RCE attack |
| wafSqliAttackScore | Beta. WAF score for a SQLi attack |
| wafXssAttackScore | Beta. WAF score for a XSS attack |
| zoneVersion | The version of a zone |
ZoneFirewallEventsAdaptiveByTimeGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneFirewallEventsAdaptiveByTimeGroupsOrderBy
| Field | Description |
|---|---|
ZoneFirewallEventsAdaptiveFilter_InputObject
| Field | Description |
|---|---|
ZoneFirewallEventsAdaptiveGroups
Aggregated Firewall events with adaptive sampling
| Field | Description |
|---|---|
| avg | The average value used for sample interval |
| count | The sum of sample interval values |
| dimensions | List of dimensions to group by |
ZoneFirewallEventsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval |
ZoneFirewallEventsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| action | The code of the first-class action the Cloudflare Firewall took on this request |
| apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
| apiGatewayMatchedHost | API Gateway host matched at the edge |
| botScore | The final score originated from bot management detections. |
| botScoreSrcName | Name of the source detection which generated the bot management score. |
| clientASNDescription | The ASN of the visitor as string |
| clientAsn | The ASN number of the visitor |
| clientCountryName | Country from which request originated |
| clientIP | The visitor's IP address (IPv4 or IPv6) |
| clientIPClass | The classification of the visitor's IP address, possible values are: unknown | clean | badHost | searchEngine | allowlist | greylist | monitoringService | securityScanner | noRecord | scan | backupService | mobilePlatform | tor |
| clientRefererHost | The referer host |
| clientRefererPath | The referer path requested by visitor |
| clientRefererQuery | The referer query-string was requested by the visitor |
| clientRefererScheme | The referer url scheme requested by the visitor |
| clientRequestHTTPHost | The HTTP hostname requested by the visitor |
| clientRequestHTTPMethodName | The HTTP method used by the visitor |
| clientRequestHTTPProtocol | The version of HTTP protocol requested by the visitor |
| clientRequestPath | The path requested by visitor |
| clientRequestQuery | The query-string was requested by the visitor |
| clientRequestScheme | The url scheme requested by the visitor |
| contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
| contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
| contentScanNumObj | Number of scannable content objects |
| contentScanObjResults | Array of scan results in order of detection |
| contentScanObjSizes | Array of scan sizes in order of detection |
| contentScanObjTypes | Array of content types in order of detection |
| date | The date the event occurred at the edge |
| datetime | The date and time the event occurred at the edge |
| datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
| datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
| datetimeHour | The date and time the event occurred at the edge truncated to hours |
| datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
| description | The description of the rule triggered by this request |
| edgeColoName | The airport code of the Cloudflare datacenter that served this request |
| edgeResponseStatus | HTTP response status code returned to browser |
| httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application |
| ja3Hash | MD5 hash of the JA3 TLS fingerprint |
| ja4 | JA4 TLS fingerprint |
| kind | The kind of event, currently only possible values are: firewall |
| matchIndex | Rules match index in the chain |
| originResponseStatus | HTTP origin response status code returned to browser |
| originatorRayName | The RayId of the request that issued the challenge/jschallenge |
| rayName | The RayId of the request |
| ref | The ref-field is a user-defined rule identifier that can be set via the API for some firewall products and allows users to label their rules individually alongside cloudflare provided identifiers (only available to entitled customers) |
| ruleId | The Cloudflare security product-specific RuleId triggered by this request |
| rulesetId | The Cloudflare security product-specific RulesetId triggered by this request |
| sampleInterval | ABR sample interval |
| source | The Cloudflare security product triggered by this request |
| userAgent | visitor's user-agent string |
| wafAttackScore | Beta. Overall request score generated by the WAF detection module |
| wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
| wafMlAttackScore | DEPRECATED (Field is replaced with wafAttackScore): Beta. Overall request score generated by the WAF ML detection module |
| wafMlSqliAttackScore | DEPRECATED (Field is replaced with wafSqliAttackScore): Beta. WAF ML score for an SQLi attack |
| wafMlXssAttackScore | DEPRECATED (Field is replaced with wafXssAttackScore): Beta. WAF ML score for an XSS attack |
| wafRceAttackScore | Beta. WAF score for a RCE attack |
| wafSqliAttackScore | Beta. WAF score for a SQLi attack |
| wafXssAttackScore | Beta. WAF score for a XSS attack |
| zoneVersion | The version of a zone |
ZoneFirewallEventsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneFirewallEventsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneFirewallEventsAdaptiveJa4SignalsElem
| Field | Description |
|---|---|
| signalName | Signal name |
| signalValue | Signal value |
ZoneFirewallEventsAdaptiveMetadataElem
| Field | Description |
|---|---|
| key | The key of the metadata. Key format can vary by Cloudflare security product and can change over time. |
| value | The value of the metadata. Value format can vary by Cloudflare security product and can change over time. |
ZoneFirewallEventsAdaptiveOrderBy
| Field | Description |
|---|---|
ZoneHealthCheckEventsAdaptive
Raw Health Check events with adaptive sampling
| Field | Description |
|---|---|
| date | The date the event was written to the database |
| datetime | The date and time the event was written to the database |
| eventId | The event id that created this healthcheck event |
| expectedResponseCodes | The expected response codes for the health check |
| failureReason | Reason why the health check failed |
| fqdn | Fully qualified domain name of the origin (if available) |
| healthChanged | 1 if the origin health status has changed since the last health check, 0 otherwise |
| healthCheckId | A unique identifier for the health check |
| healthCheckName | Human-identifiable health check name |
| healthStatus | Origin health status |
| originIP | IP address of the origin |
| originResponseStatus | HTTP status code returned by the origin |
| region | Region where the health check occurred |
| rttMs | RTT (milliseconds) to reach the origin |
| sampleInterval | ABR sample interval |
| scope | Geographic aggregation level of the health status |
| tcpConnMs | Time taken for the tcp connection to be established |
| timeToFirstByteMs | Time taken for the first byte to be received once connection is available |
| tlsHandshakeMs | Time taken for the tls handshake to be completed |
ZoneHealthCheckEventsAdaptiveFilter_InputObject
| Field | Description |
|---|---|
ZoneHealthCheckEventsAdaptiveGroups
Aggregated Health Check events with adaptive sampling
| Field | Description |
|---|---|
| avg | The average value for a metric |
| count | The number of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
ZoneHealthCheckEventsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| rttMs | Average RTT (milliseconds) |
| sampleInterval | Average sample interval |
| tcpConnMs | Average TCP Connection time (milliseconds) |
| timeToFirstByteMs | Average Time To First Byte (milliseconds) |
| tlsHandshakeMs | Average TLS Handshake time (milliseconds) |
ZoneHealthCheckEventsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | The date the event was written to the database |
| datetime | Datetime the event was written to the database |
| datetimeFifteenMinutes | Datetime the event was written to the database truncated to a multiple of 15 minutes |
| datetimeFiveMinutes | Datetime the event was written to the database truncated to a multiple of 5 minutes |
| datetimeHour | Datetime the event was written to the database truncated to the hour |
| datetimeMinute | Datetime the event was written to the database truncated to the minute |
| failureReason | Reason why the health check failed |
| fqdn | Fully qualified domain name of the origin (if available) |
| healthChanged | 1 if the origin health status has changed since the last health check, 0 otherwise |
| healthCheckId | A unique identifier for the health check |
| healthCheckName | Human-identifiable health check name |
| healthStatus | Origin health status |
| originIP | IP address of the origin |
| originResponseStatus | HTTP status code returned by the origin |
| region | Region where the health check occurred |
| rttMs | RTT (milliseconds) to reach the origin |
| sampleInterval | ABR sample interval |
| scope | Geographic aggregation level of the health status |
| tcpConnMs | Time taken for the tcp connection to be established |
| timeToFirstByteMs | Time taken for the first byte to be received once connection is available |
| tlsHandshakeMs | Time taken for the tls handshake to be completed |
ZoneHealthCheckEventsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneHealthCheckEventsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneHealthCheckEventsAdaptiveGroupsSum
| Field | Description |
|---|---|
| healthStatus |
ZoneHealthCheckEventsAdaptiveOrderBy
| Field | Description |
|---|---|
ZoneHttpRequests1dByColoGroups
Daily rollups of request data by colo
| Field | Description |
|---|---|
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
ZoneHttpRequests1dByColoGroupsCountryMapElem
| Field | Description |
|---|---|
| clientCountryName | Country from which request originated |
| requests | |
| threats | Requests classified as threats |
ZoneHttpRequests1dByColoGroupsDimensions
| Field | Description |
|---|---|
| coloCode | Code of edge server |
| date | Request date |
ZoneHttpRequests1dByColoGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneHttpRequests1dByColoGroupsOrderBy
| Field | Description |
|---|---|
ZoneHttpRequests1dByColoGroupsResponseStatusMapElem
| Field | Description |
|---|---|
| edgeResponseStatus | HTTP response status code returned to client |
| requests |
ZoneHttpRequests1dByColoGroupsSum
| Field | Description |
|---|---|
| bytes | Bytes returned to client |
| cachedBytes | Bytes returned to client from cache |
| cachedRequests | Requests served from cache |
| countryMap | |
| requests | |
| responseStatusMap | |
| threatPathingMap |
ZoneHttpRequests1dByColoGroupsThreatPathingMapElem
| Field | Description |
|---|---|
| requests | |
| threatPathingName | Threat type |
ZoneHttpRequests1dGroups
Daily rollups of request data
| Field | Description |
|---|---|
| avg | The average value for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
| uniq | The number of unique values for a metric per dimension |
ZoneHttpRequests1dGroupsAvg
| Field | Description |
|---|---|
| bytes | |
| sampleInterval | Average sample interval |
ZoneHttpRequests1dGroupsBrowserMapElem
| Field | Description |
|---|---|
| pageViews | Successful requests for HTML content |
| uaBrowserFamily | Browser type |
ZoneHttpRequests1dGroupsClientHTTPVersionMapElem
| Field | Description |
|---|---|
| clientHTTPProtocol | HTTP version |
| requests |
ZoneHttpRequests1dGroupsClientSSLMapElem
| Field | Description |
|---|---|
| clientSSLProtocol | Protocol version |
| requests |
ZoneHttpRequests1dGroupsContentTypeMapElem
| Field | Description |
|---|---|
| bytes | Bytes returned to client |
| edgeResponseContentTypeName | Content type returned to client |
| requests |
ZoneHttpRequests1dGroupsCountryMapElem
| Field | Description |
|---|---|
| bytes | Bytes returned to client |
| clientCountryName | Country from which request originated |
| requests | |
| threats | Requests classified as threats |
ZoneHttpRequests1dGroupsDimensions
| Field | Description |
|---|---|
| date | Request date |
ZoneHttpRequests1dGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneHttpRequests1dGroupsIpClassMapElem
| Field | Description |
|---|---|
| ipType | IP class |
| requests |
ZoneHttpRequests1dGroupsOrderBy
| Field | Description |
|---|---|
ZoneHttpRequests1dGroupsResponseStatusMapElem
| Field | Description |
|---|---|
| edgeResponseStatus | HTTP response status code returned to client |
| requests |
ZoneHttpRequests1dGroupsSum
| Field | Description |
|---|---|
| browserMap | |
| bytes | Bytes returned to client |
| cachedBytes | Bytes returned to client from cache |
| cachedRequests | Requests served from cache |
| clientHTTPVersionMap | |
| clientSSLMap | |
| contentTypeMap | |
| countryMap | |
| encryptedBytes | Bytes returned to client using SSL/TLS protocol |
| encryptedRequests | Requests served using SSL/TLS protocol |
| ipClassMap | |
| pageViews | Successful requests for HTML content |
| requests | |
| responseStatusMap | |
| threatPathingMap | |
| threats | Requests classified as threats |
ZoneHttpRequests1dGroupsThreatPathingMapElem
| Field | Description |
|---|---|
| requests | |
| threatPathingName | Threat type |
ZoneHttpRequests1dGroupsUniq
| Field | Description |
|---|---|
| uniques | A number of unique IPs |
ZoneHttpRequests1hGroups
Hourly rollups of request data
| Field | Description |
|---|---|
| avg | The average value for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
| uniq | The number of unique values for a metric per dimension |
ZoneHttpRequests1hGroupsAvg
| Field | Description |
|---|---|
| bytes | |
| sampleInterval | Average sample interval |
ZoneHttpRequests1hGroupsBrowserMapElem
| Field | Description |
|---|---|
| pageViews | Successful requests for HTML content |
| uaBrowserFamily | Browser type |
ZoneHttpRequests1hGroupsClientHTTPVersionMapElem
| Field | Description |
|---|---|
| clientHTTPProtocol | HTTP version |
| requests |
ZoneHttpRequests1hGroupsClientSSLMapElem
| Field | Description |
|---|---|
| clientSSLProtocol | Protocol version |
| requests |
ZoneHttpRequests1hGroupsContentTypeMapElem
| Field | Description |
|---|---|
| bytes | Bytes returned to client |
| edgeResponseContentTypeName | Content type returned to client |
| requests |
ZoneHttpRequests1hGroupsCountryMapElem
| Field | Description |
|---|---|
| bytes | Bytes returned to client |
| clientCountryName | Country from which request originated |
| requests | |
| threats | Requests classified as threats |
ZoneHttpRequests1hGroupsDimensions
| Field | Description |
|---|---|
| date | Request date |
| datetime | Request datetime truncated to the hour |
ZoneHttpRequests1hGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneHttpRequests1hGroupsIpClassMapElem
| Field | Description |
|---|---|
| ipType | IP class |
| requests |
ZoneHttpRequests1hGroupsOrderBy
| Field | Description |
|---|---|
ZoneHttpRequests1hGroupsResponseStatusMapElem
| Field | Description |
|---|---|
| edgeResponseStatus | HTTP response status code returned to client |
| requests |
ZoneHttpRequests1hGroupsSum
| Field | Description |
|---|---|
| browserMap | |
| bytes | Bytes returned to client |
| cachedBytes | Bytes returned to client from cache |
| cachedRequests | Requests served from cache |
| clientHTTPVersionMap | |
| clientSSLMap | |
| contentTypeMap | |
| countryMap | |
| encryptedBytes | Bytes returned to client using SSL/TLS protocol |
| encryptedRequests | Requests served using SSL/TLS protocol |
| ipClassMap | |
| pageViews | Successful requests for HTML content |
| requests | |
| responseStatusMap | |
| threatPathingMap | |
| threats | Requests classified as threats |
ZoneHttpRequests1hGroupsThreatPathingMapElem
| Field | Description |
|---|---|
| requests | |
| threatPathingName | Threat type |
ZoneHttpRequests1hGroupsUniq
| Field | Description |
|---|---|
| uniques | A number of unique IPs |
ZoneHttpRequests1mByColoGroups
Minutely rollups of request data by colo
| Field | Description |
|---|---|
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
ZoneHttpRequests1mByColoGroupsCountryMapElem
| Field | Description |
|---|---|
| clientCountryName | Country from which request originated |
| requests | |
| threats | Requests classified as threats |
ZoneHttpRequests1mByColoGroupsDimensions
| Field | Description |
|---|---|
| coloCode | Code of edge server |
| date | Request date |
| datetime | Request datetime |
| datetimeFifteenMinutes | Request datetime truncated to multiple of 15 minutes |
| datetimeHalfOfHour | Request datetime truncated to multiple of 30 minutes |
| datetimeHour | Request datetime truncated to the hour |
ZoneHttpRequests1mByColoGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneHttpRequests1mByColoGroupsOrderBy
| Field | Description |
|---|---|
ZoneHttpRequests1mByColoGroupsResponseStatusMapElem
| Field | Description |
|---|---|
| edgeResponseStatus | HTTP response status code returned to client |
| requests |
ZoneHttpRequests1mByColoGroupsSum
| Field | Description |
|---|---|
| bytes | Bytes returned to client |
| cachedBytes | Bytes returned to client from cache |
| cachedRequests | Requests served from cache |
| countryMap | |
| requests | |
| responseStatusMap | |
| threatPathingMap |
ZoneHttpRequests1mByColoGroupsThreatPathingMapElem
| Field | Description |
|---|---|
| requests | |
| threatPathingName | Threat type |
ZoneHttpRequests1mGroups
Minutely rollups of request data
| Field | Description |
|---|---|
| avg | The average value for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
| uniq | The number of unique values for a metric per dimension |
ZoneHttpRequests1mGroupsAvg
| Field | Description |
|---|---|
| bytes | |
| sampleInterval | Average sample interval |
ZoneHttpRequests1mGroupsBrowserMapElem
| Field | Description |
|---|---|
| pageViews | Successful requests for HTML content |
| uaBrowserFamily | Browser type |
ZoneHttpRequests1mGroupsClientHTTPVersionMapElem
| Field | Description |
|---|---|
| clientHTTPProtocol | HTTP version |
| requests |
ZoneHttpRequests1mGroupsClientSSLMapElem
| Field | Description |
|---|---|
| clientSSLProtocol | Protocol version |
| requests |
ZoneHttpRequests1mGroupsContentTypeMapElem
| Field | Description |
|---|---|
| bytes | Bytes returned to client |
| edgeResponseContentTypeName | Content type returned to client |
| requests |
ZoneHttpRequests1mGroupsCountryMapElem
| Field | Description |
|---|---|
| bytes | Bytes returned to client |
| clientCountryName | Country from which request originated |
| requests | |
| threats | Requests classified as threats |
ZoneHttpRequests1mGroupsDimensions
| Field | Description |
|---|---|
| date | Request date |
| datetime | Request datetime, truncated to the minute |
| datetimeDay | Request datetime truncated to the day |
| datetimeFifteenMinutes | Request datetime truncated to multiple of 15 minutes |
| datetimeFiveMinutes | Request datetime truncated to multiple of 5 minutes |
| datetimeHalfOfHour | Request datetime truncated to multiple of 30 minutes |
| datetimeHour | Request datetime truncated to the hour |
| datetimeMinute | DEPRECATED (Field is replaced with datetime): Request datetime truncated to the minute |
ZoneHttpRequests1mGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneHttpRequests1mGroupsIpClassMapElem
| Field | Description |
|---|---|
| ipType | IP class |
| requests |
ZoneHttpRequests1mGroupsOrderBy
| Field | Description |
|---|---|
ZoneHttpRequests1mGroupsResponseStatusMapElem
| Field | Description |
|---|---|
| edgeResponseStatus | HTTP response status code returned to client |
| requests |
ZoneHttpRequests1mGroupsSum
| Field | Description |
|---|---|
| browserMap | |
| bytes | Bytes returned to client |
| cachedBytes | Bytes returned to client from cache |
| cachedRequests | Requests served from cache |
| clientHTTPVersionMap | |
| clientSSLMap | |
| contentTypeMap | |
| countryMap | |
| encryptedBytes | Bytes returned to client using SSL/TLS protocol |
| encryptedRequests | Requests served using SSL/TLS protocol |
| ipClassMap | |
| pageViews | Successful requests for HTML content |
| requests | |
| responseStatusMap | |
| threatPathingMap | |
| threats | Requests classified as threats |
ZoneHttpRequests1mGroupsThreatPathingMapElem
| Field | Description |
|---|---|
| requests | |
| threatPathingName | Threat type |
ZoneHttpRequests1mGroupsUniq
| Field | Description |
|---|---|
| uniques | A number of unique IPs |
ZoneHttpRequestsAdaptive
Raw HTTP requests with adaptive sampling
| Field | Description |
|---|---|
| apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
| apiGatewayMatchedHost | API Gateway host matched at the edge |
| botDetectionIds | Array of detections ids that matched this request |
| botDetectionTags | Array of detections tags that matched this request |
| botManagementDecision | Judgement of the bot management system |
| botScore | The final score originated from bot management detections. |
| botScoreBucketBy10 | Range of the bot management score |
| botScoreSrcName | Name of the source detection which generated the bot management score. |
| cacheReserveUsed | Used Cache Reserve to serve the response |
| cacheStatus | Cache status |
| clientASNDescription | The ASN of the visitor as string |
| clientAsn | The ASN number of the visitor |
| clientCountryName | Country from which request originated |
| clientDeviceType | |
| clientIP | The visitor's IP address (IPv4 or IPv6) |
| clientRefererHost | The referrer host |
| clientRequestHTTPHost | The HTTP hostname requested by the visitor |
| clientRequestHTTPMethodName | HTTP method of client request |
| clientRequestHTTPProtocol | The version of HTTP protocol requested by the visitor |
| clientRequestPath | The path requested by visitor |
| clientRequestQuery | Query parameters of client request |
| clientRequestReferer | HTTP request referrer |
| clientRequestScheme | The url scheme requested by the visitor |
| clientSSLProtocol | SSL protocol version |
| coloCode | |
| contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
| contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
| contentScanNumObj | Number of scannable content objects |
| contentScanObjResults | Array of scan results in order of detection |
| contentScanObjSizes | Array of scan sizes in order of detection |
| contentScanObjTypes | Array of content types in order of detection |
| date | The date the event occurred at the edge |
| datetime | The date and time the event occurred at the edge |
| datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
| datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
| datetimeHour | The date and time the event occurred at the edge truncated to hours |
| datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
| edgeDnsResponseTimeMs | The time elapsed resolving a CNAME if it was required to reach your origin |
| edgeResponseContentTypeName | |
| edgeResponseStatus | HTTP response status code returned to browser |
| edgeTimeToFirstByteMs | The time elapsed between processing the first byte of the request until when we started sending a response |
| httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application |
| isCrossZoneSubrequest | '1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise. |
| ja3Hash | MD5 hash of the JA3 TLS fingerprint |
| ja4 | JA4 TLS fingerprint |
| ja4Signals | Inter-request statistics computed for this JA4 across Cloudflare's entire global edge network |
| leakedCredentialCheckResult | The distinct result of checking for leaked credentials |
| originASN | |
| originASNDescription | ASN associated with origin |
| originIP | |
| originResponseDurationMs | |
| originResponseStatus | HTTP origin response status code returned to browser |
| rayName | The RayId of the request |
| requestSource | |
| securityAction | The code of the first-class action the Cloudflare Firewall took on this request |
| securitySource | The Cloudflare security product triggered by this request |
| upperTierColoName | |
| userAgent | visitor's user-agent string |
| userAgentBrowser | Browser parsed from the user agent |
| userAgentOS | OS parsed from the user agent |
| wafAttackScore | Beta. Overall request score generated by the WAF detection module |
| wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
| wafRceAttackScore | Beta. WAF score for a RCE attack |
| wafSqliAttackScore | Beta. WAF score for a SQLi attack |
| wafXssAttackScore | Beta. WAF score for a XSS attack |
| xRequestedWith | The X-Requested-With header of the client request |
| zoneVersion | The version of a zone |
ZoneHttpRequestsAdaptiveFilter_InputObject
| Field | Description |
|---|---|
ZoneHttpRequestsAdaptiveGroups
Aggregated HTTP requests data with adaptive sampling
| Field | Description |
|---|---|
| avg | The average value used for sample interval |
| confidence | ALPHA - DO NOT USE |
| count | The number of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| quantiles | Quantiles of a metric per dimension |
| ratio | The ratio of a range of status codes, between 0 and 1 |
| sum | The sum of values for a metric per dimension |
ZoneHttpRequestsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| crossZoneSubrequests | The proportion of requests that were inititiated by a Cloudflare Worker on another zone |
| edgeDnsResponseTimeMs | |
| edgeTimeToFirstByteMs | |
| originResponseDurationMs | The average originResponseDuration, in milliseconds, excluding 0 values (i.e. cached ones) |
| sampleInterval |
ZoneHttpRequestsAdaptiveGroupsConfidence
| Field | Description |
|---|---|
| count | The number of values for a metric per dimension, with confidence intervals |
| level | Confidence level that was requested |
| sum | The sum of values for a metric per dimension, with confidence intervals |
ZoneHttpRequestsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
| apiGatewayMatchedHost | API Gateway host matched at the edge |
| botManagementDecision | Judgement of the bot management system |
| botScore | The final score originated from bot management detections. |
| botScoreBucketBy10 | Range of the bot management score |
| botScoreSrcName | Name of the source detection which generated the bot management score. |
| cacheReserveUsed | Used Cache Reserve to serve the response |
| cacheStatus | |
| clientASNDescription | The ASN of the visitor as string |
| clientAsn | |
| clientCountryName | Country from which request originated |
| clientDeviceType | |
| clientIP | |
| clientRefererHost | The referrer host |
| clientRequestHTTPHost | Host requested by the client |
| clientRequestHTTPMethodName | HTTP method of client request |
| clientRequestHTTPProtocol | HTTP protocol version |
| clientRequestPath | Path of client request |
| clientRequestQuery | Query parameters of client request |
| clientRequestReferer | HTTP request referrer |
| clientRequestScheme | HTTP request URI scheme (http/https) |
| clientSSLProtocol | SSL protocol version |
| coloCode | |
| contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
| contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
| contentScanNumObj | Number of scannable content objects |
| contentScanObjResults | Array of scan results in order of detection |
| contentScanObjSizes | Array of scan sizes in order of detection |
| contentScanObjTypes | Array of content types in order of detection |
| date | The date the event occurred at the edge |
| datetime | The date and time the event occurred at the edge |
| datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
| datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
| datetimeHour | The date and time the event occurred at the edge truncated to hours |
| datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
| edgeDnsResponseTimeMs | The time elapsed resolving a CNAME if it was required to reach your origin |
| edgeResponseContentTypeName | |
| edgeResponseStatus | |
| edgeTimeToFirstByteMs | The time elapsed between processing the first byte of the request until when we started sending a response |
| httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application |
| isCrossZoneSubrequest | '1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise. |
| ja3Hash | MD5 hash of the JA3 TLS fingerprint |
| ja4 | JA4 TLS fingerprint |
| leakedCredentialCheckResult | The distinct result of checking for leaked credentials |
| originASN | |
| originASNDescription | ASN associated with origin |
| originIP | |
| originResponseDurationMs | |
| originResponseStatus | HTTP response status code returned by the origin |
| requestSource | |
| sampleInterval | ABR sample interval |
| securityAction | The code of the first-class action the Cloudflare Firewall took on this request |
| securitySource | The Cloudflare security product triggered by this request |
| upperTierColoName | |
| userAgent | |
| userAgentBrowser | Browser parsed from the user agent |
| userAgentOS | OS parsed from the user agent |
| wafAttackScore | Beta. Overall request score generated by the WAF detection module |
| wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
| wafRceAttackScore | Beta. WAF score for a RCE attack |
| wafSqliAttackScore | Beta. WAF score for a SQLi attack |
| wafXssAttackScore | Beta. WAF score for a XSS attack |
| xRequestedWith | The X-Requested-With header of the client request |
| zoneVersion | The version of a zone |
ZoneHttpRequestsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneHttpRequestsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneHttpRequestsAdaptiveGroupsQuantiles
| Field | Description |
|---|---|
| edgeDnsResponseTimeMsP50 | 50th percentile DNS Response Time (milliseconds) |
| edgeDnsResponseTimeMsP95 | 95th percentile DNS Response Time (milliseconds) |
| edgeDnsResponseTimeMsP99 | 99th percentile DNS Response Time (milliseconds) |
| edgeTimeToFirstByteMsP50 | 50th percentile Time To First Byte (milliseconds) |
| edgeTimeToFirstByteMsP95 | 95th percentile Time To First Byte (milliseconds) |
| edgeTimeToFirstByteMsP99 | 99th percentile Time To First Byte (milliseconds) |
| originResponseDurationMsP50 | 50th percentile Origin Response Duration (milliseconds) |
| originResponseDurationMsP95 | 95th percentile Origin Response Duration (milliseconds) |
| originResponseDurationMsP99 | 99th percentile Origin Response Duration (milliseconds) |
ZoneHttpRequestsAdaptiveGroupsRatio
| Field | Description |
|---|---|
| status4xx | |
| status5xx |
ZoneHttpRequestsAdaptiveGroupsSum
| Field | Description |
|---|---|
| crossZoneSubrequests | The number of requests that were inititiated by a Cloudflare Worker on another zone |
| edgeDnsResponseTimeMs | |
| edgeResponseBytes | |
| edgeTimeToFirstByteMs | |
| originResponseDurationMs | |
| visits | The number of requests by end-users that were initiated from a different website (i.e. where the request HTTP Referer header does not match the host in the HTTP Host header) |
ZoneHttpRequestsAdaptiveGroupsSumConfidence
| Field | Description |
|---|---|
| edgeResponseBytes | Confidence interval for the corresponding point estimate |
ZoneHttpRequestsAdaptiveJa4SignalsElem
| Field | Description |
|---|---|
| signalName | Signal name |
| signalValue | Signal value |
ZoneHttpRequestsAdaptiveOrderBy
| Field | Description |
|---|---|
ZoneHttpRequestsOverviewAdaptiveGroups
A high-level summary of HTTP requests made by end users.
| Field | Description |
|---|---|
| avg | The average value for a metric per dimension |
| dimensions | List of dimensions to group by |
| ratio | The ratio of a metric in comparison to the rest of the traffic, between 0 and 1 |
| sum | The sum of values for a metric per dimension |
ZoneHttpRequestsOverviewAdaptiveGroupsAvg
| Field | Description |
|---|---|
| originResponseDurationMs | The average originResponseDuration, in milliseconds, excluding 0 values (i.e. cached ones) |
| sampleInterval | Average sample interval |
ZoneHttpRequestsOverviewAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| clientCountryName | Country from which request originated |
| clientRequestHTTPProtocol | HTTP protocol version |
| clientSSLProtocol | SSL protocol version |
| date | The date the event occurred at the edge |
| datetime | The date and time the event occurred at the edge |
| datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
| datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
| datetimeHour | The date and time the event occurred at the edge truncated to hours |
| datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
| edgeResponseContentTypeName | Content type returned to client |
| edgeResponseStatus | HTTP response status code returned to client |
| httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application |
| userAgentBrowser | Browser parsed from the user agent |
| zoneVersion | The version of a zone |
ZoneHttpRequestsOverviewAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneHttpRequestsOverviewAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneHttpRequestsOverviewAdaptiveGroupsRatio
| Field | Description |
|---|---|
| cachedBytes | |
| cachedRequests | |
| encryptedBytes | |
| encryptedRequests | |
| status4xx | |
| status5xx |
ZoneHttpRequestsOverviewAdaptiveGroupsSum
| Field | Description |
|---|---|
| bytes | |
| cachedBytes | Bytes returned to client from cache |
| cachedRequests | Requests served from cache |
| pageViews | Successful requests for HTML content |
| requests | |
| visits | The number of requests by end-users that were initiated from a different website (i.e. where the request HTTP Referer header does not match the host in the HTTP Host header) |
ZoneImageResizingRequests1mGroups
Minutely rollups of Image Resizing requests
| Field | Description |
|---|---|
| count | Counts a number of rows per specific dimensions |
| dimensions | List of dimensions to group by |
| sum | Calculates a sum of each field per speicific dimensions |
ZoneImageResizingRequests1mGroupsDimensions
| Field | Description |
|---|---|
| contentType | |
| date | |
| datetime | |
| datetimeFifteenMinutes | |
| datetimeFiveMinutes | |
| datetimeHour | |
| datetimeMinute | |
| resizeError | Error description when a resized image was requested but could not be served |
ZoneImageResizingRequests1mGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneImageResizingRequests1mGroupsOrderBy
| Field | Description |
|---|---|
ZoneImageResizingRequests1mGroupsSum
| Field | Description |
|---|---|
| originalBytes | The size of the image before resizing |
| originalPixels | The area of the image before resizing |
| requests | Count of image resizing requests |
| resizedBytes | The size of the image after resizing |
| resizedPixels | The area of the image after resizing |
ZoneLoadBalancingRequestsAdaptive
Raw Load Balancing origin requests with adaptive sampling
| Field | Description |
|---|---|
| coloCode | IATA airport code of data center that received the request |
| datetime | Request datetime |
| errorType | Error generated when selecting an origin |
| lbName | Load balancer name |
| numberOriginsSelected | Number of origins that were selected and returned to the client |
| origins | All origins in the pool that was selected based on steering policy |
| pools | List of pools from which a pool will be selected based on steering policy |
| proxied | Whether traffic is proxied through the Cloudflare network (orange-clouded) |
| region | Load balancing region where request originated |
| sampleInterval | ABR sample interval |
| selectedOriginIndex | Index of the selected origin from the list of all origins. If multiple origins were selected, this is the index of the first origin in that list |
| selectedPoolAvgRttMs | Average RTT (milliseconds) to reach the origins within the selected pool |
| selectedPoolHealthChecksEnabled | Health checks active status for the selected pool |
| selectedPoolHealthy | Health status for the selected pool |
| selectedPoolId | A unique identifier for the selected pool |
| selectedPoolIndex | Index of the selected pool from the list of all pools |
| selectedPoolName | Name for the selected pool |
| sessionAffinity | Type of session affinity enabled |
| sessionAffinityStatus | Current status of session affinity |
| steeringPolicy | Policy by which the load balancer will route traffic |
ZoneLoadBalancingRequestsAdaptiveFilter_InputObject
| Field | Description |
|---|---|
ZoneLoadBalancingRequestsAdaptiveGroups
Aggregated Load Balancing origin requests with adaptive sampling
| Field | Description |
|---|---|
| avg | |
| count | The number of values for a metric per dimension |
| dimensions | List of dimensions to group by |
ZoneLoadBalancingRequestsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval | Average sample interval |
ZoneLoadBalancingRequestsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| coloCode | IATA airport code of data center that received the request |
| datetime | Request datetime |
| datetimeFifteenMinutes | Request datetime truncated to multiple of 15 minutes |
| datetimeFiveMinutes | Request datetime truncated to multiple of 5 minutes |
| datetimeHalfOfHour | Request datetime truncated to multiple of 30 minutes |
| datetimeHour | Request datetime truncated to the hour |
| datetimeMinute | Request datetime truncated to multiple of 1 minute |
| errorType | Error generated when selecting an origin |
| lbName | Load balancer name |
| multipleOriginsSelected | Indicates whether multiple origins were returned to the client |
| numberOriginsSelected | Number of origins that were selected and returned to the client |
| proxied | Whether traffic is proxied through the Cloudflare network (orange-clouded) |
| region | Load balancing region where request originated |
| sampleInterval | ABR sample interval |
| selectedOriginIndex | Index of the selected origin from the list of all origins. If multiple origins were selected, this is the index of the first origin in that list |
| selectedOriginName | Name of the selected origin |
| selectedOriginNames | Names of each selected origin |
| selectedPoolAvgRttMs | Dynamic Latency: RTT (milliseconds) to reach the origin pool |
| selectedPoolHealthChecksEnabled | Health checks status for the selected pool |
| selectedPoolHealthy | Health status for the selected pool |
| selectedPoolId | A unique identifier for the selected pool |
| selectedPoolIndex | Index of the selected pool from the list of all pools |
| selectedPoolName | Name for the selected pool |
| sessionAffinityEnabled | Type of session affinity enabled |
| sessionAffinityStatus | Current status of session affinity |
| steeringPolicy | Policy by which the load balancer will route traffic |
ZoneLoadBalancingRequestsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneLoadBalancingRequestsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneLoadBalancingRequestsAdaptiveOrderBy
| Field | Description |
|---|---|
ZoneLoadBalancingRequestsAdaptiveOriginsElem
| Field | Description |
|---|---|
| fqdn | Fully qualified domain name of the origin (if available) |
| health | Origin health status |
| ipv4 | IPv4 Address of the origin |
| ipv6 | IPv6 address of the origin |
| originName | Origin name |
| selected | All the origins that were returned to the client |
| weight | Ratio of traffic that will be distributed to this origin among all origins in the pool |
ZoneLoadBalancingRequestsAdaptivePoolsElem
| Field | Description |
|---|---|
| avgRttMs | Dynamic Latency: RTT (milliseconds) to reach the origin pool |
| distance | Distance to Pool KM |
| healthCheckEnabled | Health checks status |
| healthy | Pool health status |
| id | A unique identifier for the pool |
| poolName | Pool name |
ZoneLogpushHealthAdaptiveGroups
Beta. Logpush job health metrics
| Field | Description |
|---|---|
| avg | |
| count | The number of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
ZoneLogpushHealthAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval | Average sample interval |
ZoneLogpushHealthAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | Date that we completed pushing the log batch |
| datetime | Datetime that we completed pushing the log batch |
| datetimeFifteenMinutes | Datetime that we completed pushing the log batch, truncated to multiple of 15 minutes |
| datetimeFiveMinutes | Datetime that we completed pushing the log batch, truncated to multiple of 5 minutes |
| datetimeHour | Datetime that we completed pushing the log batch, truncated to the hour |
| datetimeMinute | Datetime that we completed pushing the log batch, truncated to the minute |
| destinationType | Destination type, e.g. 'S3' or 'GCS' |
| final | Cloudflare may attempt to push a batch of logs multiple times if we encounter a failure. This field will be set to 'true' if this was the last push attempt for this batch of logs. If this field is set to false, it means the push failed but another retry was attempted. If this field is set to true and status >= 300, then the batch of logs failed to push and log data was lost. If you want to count the total number of logs that succeeded or failed, you should always set final = true. |
| jobId | The Logpush Job ID |
| status | HTTP response status code of the log destination |
ZoneLogpushHealthAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneLogpushHealthAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneLogpushHealthAdaptiveGroupsSum
| Field | Description |
|---|---|
| bytes | Bytes of uncompressed log data pushed |
| bytesCompressed | Bytes of compressed log data pushed |
| records | A count of the total number of records pushed. |
ZoneNelReportsAdaptiveGroups
Data to visualize network error logs
| Field | Description |
|---|---|
| avg | |
| count | The number of NEL Reports |
| dimensions | List of dimensions to group by |
ZoneNelReportsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval | Average sample interval |
ZoneNelReportsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| clientIPASN | Client ASN |
| clientIPASNDescription | Client ASN Description |
| clientIPCountry | Client Country |
| clientIPCountryCode | 2 letter client country code using ISO 3166-1 alpha-2 syntax |
| clientIPVersion | IP Version the client used to connect |
| date | Request date from browser |
| datetime | Request datetime from browser |
| datetimeFifteenMinutes | Request datetime from browser, truncated to multiple of 15 minutes |
| datetimeFiveMinutes | Request datetime from browser, truncated to multiple of 5 minutes |
| datetimeHalfOfHour | Request datetime from browser, truncated to multiple of 30 minutes |
| datetimeHour | Request datetime from browser, truncated to the hour |
| datetimeMinute | Request datetime from browser, truncated to the minute |
| lastKnownGoodColoCode | IATA airport code of colo the client connected to |
| phase | The phase of connection the error occurred in |
| protocol | HTTP Protocol used when the error occured |
| type | The type of error in the phase |
ZoneNelReportsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneNelReportsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZonePageShieldReportsAdaptiveGroups
Page Shield CSP reports
| Field | Description |
|---|---|
| avg | |
| count | Number of Page Shield CSP reports |
| dimensions | List of dimensions to group by |
ZonePageShieldReportsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval | Average sample interval |
ZonePageShieldReportsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| action | policy action, log | allow |
| cspDirective | csp directive e.g 'script-src' |
| date | |
| datetime | The date and time the event occurred at the edge |
| datetimeFifteenMinutes | Report datetime from edge, truncated to multiple of 15 minutes |
| datetimeFiveMinutes | Report datetime from edge, truncated to multiple of 5 minutes |
| datetimeHalfOfHour | Report datetime from edge, truncated to multiple of 30 minutes |
| datetimeHour | Report datetime from edge, truncated to the hour |
| datetimeMinute | Report datetime from edge, truncated to the minute |
| host | hostname of the zone |
| pageURL | page on which the resource was found |
| policyID | The ID of the Policy |
| resourceType | resource type e.g script |
| url | URL of the CSP reported resource |
| urlHost | hostname of the resource URL |
ZonePageShieldReportsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZonePageShieldReportsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneSettings
Access and limitations for a zone
| Field | Description |
|---|---|
| apiGatewayGraphqlQueryAnalyticsGroups | |
| apiGatewayMatchedSessionIDsAdaptiveGroups | |
| apiRequestSequencesGroups | |
| cacheReserveOperationsAdaptiveGroups | |
| cacheReserveRequestsAdaptiveGroups | |
| cacheReserveStorageAdaptiveGroups | |
| dmarcReportsAdaptive | |
| dmarcReportsSourcesAdaptiveGroups | |
| dnsAnalyticsAdaptive | |
| dnsAnalyticsAdaptiveGroups | |
| emailRoutingAdaptive | |
| emailRoutingAdaptiveGroups | |
| firewallEventsAdaptive | |
| firewallEventsAdaptiveByTimeGroups | |
| firewallEventsAdaptiveGroups | |
| healthCheckEventsAdaptive | |
| healthCheckEventsAdaptiveGroups | |
| httpRequests1dByColoGroups | |
| httpRequests1dGroups | |
| httpRequests1hGroups | |
| httpRequests1mByColoGroups | |
| httpRequests1mGroups | |
| httpRequestsAdaptive | |
| httpRequestsAdaptiveGroups | |
| httpRequestsOverviewAdaptiveGroups | |
| imageResizingRequests1mGroups | |
| loadBalancingRequestsAdaptive | |
| loadBalancingRequestsAdaptiveGroups | |
| logpushHealthAdaptiveGroups | |
| nelReportsAdaptiveGroups | |
| pageShieldReportsAdaptiveGroups | |
| waitingRoomAnalyticsAdaptive | |
| waitingRoomAnalyticsAdaptiveGroups | |
| workersZoneInvocationsAdaptiveGroups | |
| workersZoneSubrequestsAdaptiveGroups | |
| zarazActionsAdaptiveGroups | |
| zarazAnalyticsIdentitiesAdaptiveGroups | |
| zarazAnalyticsOrderedTrackAdaptiveGroups | |
| zarazAnalyticsTrackAdaptiveGroups | |
| zarazAnalyticsTrackTrafficSourcesAdaptiveGroups | |
| zarazAnalyticsTriggersAdaptiveGroups | |
| zarazAnalyticsTriggersTrafficSourcesAdaptiveGroups | |
| zarazTrackAdaptiveGroups | |
| zarazTriggersAdaptiveGroups |
ZoneWaitingRoomAnalyticsAdaptive
Raw Waiting Room analytics logs
| Field | Description |
|---|---|
| datetime | The date and time of the state of analytics for the waiting room |
| maxEstimatedTimeMinutes | Maximum value of estimated time in minutes |
| newUsersPerMinute | Actual value of new users per minute |
| newUsersPerMinuteConfig | Configured value of new users per minute |
| sampleInterval | ABR sample interval |
| sessionDuration | Configured value of session duration |
| timeBetweenRefreshesP50 | 50th percentile of the time between session refreshes in seconds |
| timeBetweenRefreshesP75 | 75th percentile of the time between session refreshes in seconds |
| timeBetweenRefreshesP90 | 90th percentile of the time between session refreshes in seconds |
| timeBetweenRefreshesP95 | 95th percentile of the time between session refreshes in seconds |
| timeInQueueP50 | 50th percentile of the time spent waiting in queue in seconds |
| timeInQueueP75 | 75th percentile of the time spent waiting in queue in seconds |
| timeInQueueP90 | 90th percentile of the time spent waiting in queue in seconds |
| timeInQueueP95 | 95th percentile of the time spent waiting in queue in seconds |
| timeOnOriginP50 | 50th percentile of the time spent on the origin in seconds |
| timeOnOriginP75 | 75th percentile of the time spent on the origin in seconds |
| timeOnOriginP90 | 90th percentile of the time spent on the origin in seconds |
| timeOnOriginP95 | 95th percentile of the time spent on the origin in seconds |
| totalActiveUsers | Actual value of total active users |
| totalActiveUsersConfig | Configured value of total active users |
| totalQueuedUsers | Total number of users that are queued |
| totalTimeWaitedP50 | 50th percentile of the total time (in seconds) spent waiting in queue by users who were queued and then gained access to the origin |
| totalTimeWaitedP75 | 75th percentile of the total time (in seconds) spent waiting in queue by users who were queued and then gained access to the origin |
| totalTimeWaitedP90 | 90th percentile of the total time (in seconds) spent waiting in queue by users who were queued and then gained access to the origin |
| totalTimeWaitedP95 | 95th percentile of the total time (in seconds) spent waiting in queue by users who were queued and then gained access to the origin |
| waitingRoomId | Unique Identifier for the waiting room |
| waitingRoomName | Name of the waiting room |
ZoneWaitingRoomAnalyticsAdaptiveFilter_InputObject
| Field | Description |
|---|---|
ZoneWaitingRoomAnalyticsAdaptiveGroups
Aggregated Waiting Room analytics logs with adaptive sampling
| Field | Description |
|---|---|
| avg | Beta. The avg of values for a metric per dimension |
| avgWeighted | Beta. The avgWeighted values for a metric per dimension |
| dimensions | List of dimensions to group by |
| max | Beta. The max value for a metric per dimenstion |
| min | Beta. The minimum value for a metric per dimenstion |
| sum | The sum for a metric per dimension. Use for shorter queries since data gets sampled after 7 days. |
ZoneWaitingRoomAnalyticsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| maxEstimatedTimeMinutes | Average of the maximum estimated wait time per minute. A negative number means no data |
| newUsersPerMinute | Average rate of new users per minute. A negative number means no data |
| newUsersPerMinuteConfig | Configured value of new users per minute. A negative number means no data |
| sampleInterval | Average sample interval |
| sessionDuration | Configured value of session duration. A negative number means no data |
| totalActiveUsers | Average rate of total active users. A negative number means no data |
| totalActiveUsersConfig | Configured value of total active users. A negative number means no data |
| totalQueuedUsers | Average of total queued users |
ZoneWaitingRoomAnalyticsAdaptiveGroupsAvgWeighted
| Field | Description |
|---|---|
| timeBetweenRefreshesP50 | Weighted average of 50th percentile of time spent between session refreshes in seconds. A negative number means no data |
| timeBetweenRefreshesP75 | Weighted average of 75th percentile of time spent between session refreshes in seconds. A negative number means no data |
| timeBetweenRefreshesP90 | Weighted average of 90th percentile of time spent between session refreshes in seconds. A negative number means no data |
| timeBetweenRefreshesP95 | Weighted average of 95th percentile of time spent between session refreshes in seconds. A negative number means no data |
| timeInQueueP50 | Weighted average of 50th percentile of time spent in queue in seconds. A negative number means no data |
| timeInQueueP75 | Weighted average of 75th percentile of time spent in queue in seconds. A negative number means no data |
| timeInQueueP90 | Weighted average of 90th percentile of time spent in queue in seconds. A negative number means no data |
| timeInQueueP95 | Weighted average of 95th percentile of time spent in queue in seconds. A negative number means no data |
| timeOnOriginP50 | Weighted average of 50th percentile of time spent on origin in seconds. A negative number means no data |
| timeOnOriginP75 | Weighted average of 75th percentile of time spent on origin in seconds. A negative number means no data |
| timeOnOriginP90 | Weighted average of 90th percentile of time spent on origin in seconds. A negative number means no data |
| timeOnOriginP95 | Weighted average of 95th percentile of time spent on origin in seconds. A negative number means no data |
| totalTimeWaitedP50 | Weighted average of 50th percentile of the total time spent waiting in queue by users who have gained access to the origin in seconds. A negative number means no data |
| totalTimeWaitedP75 | Weighted average of 75th percentile of the total time spent waiting in queue by users who have gained access to the origin in seconds. A negative number means no data |
| totalTimeWaitedP90 | Weighted average of 90th percentile of the total time spent waiting in queue by users who have gained access to the origin in seconds. A negative number means no data |
| totalTimeWaitedP95 | Weighted average of 95th percentile of the total time spent waiting in queue by users who have gained access to the origin in seconds. A negative number means no data |
ZoneWaitingRoomAnalyticsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | The date the event was written to the database |
| datetime | The date and time the event was written to the database |
| datetimeFifteenMinutes | The date and time the event was written to the database, truncated to a multiple of 15 minutes |
| datetimeFiveMinutes | The date and time the event was written to the database, truncated to a multiple of 5 minutes |
| datetimeHour | The date and time the event was written to the database, truncated to the hour |
| datetimeMinute | The date and time the event was written to the database, truncated to the minute |
| sampleInterval | ABR sample interval |
| waitingRoomId | Unique Identifier for the waiting room |
ZoneWaitingRoomAnalyticsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneWaitingRoomAnalyticsAdaptiveGroupsMax
| Field | Description |
|---|---|
| maxEstimatedTimeMinutes | The maximum value of estimated time in minutes. A negative number means no data |
| newUsersPerMinute | The maximum value of the actual new users per minute. A negative number means no data |
| newUsersPerMinuteConfig | The maximum value of the configured new users per minute. A negative number means no data |
| sessionDuration | The maximum value of the configured session duration configuration. A negative number means no data |
| totalActiveUsers | The maximum value of the actual total active users. A negative number means no data |
| totalActiveUsersConfig | The maximum value of the configured total active users. A negative number means no data |
| totalQueuedUsers | The maximum value of total number of queued users. A negative number means no data |
ZoneWaitingRoomAnalyticsAdaptiveGroupsMin
| Field | Description |
|---|---|
| maxEstimatedTimeMinutes | The minimum value of estimated time in minutes. A negative number means no data |
| newUsersPerMinute | The minimum value of the actual new users per minute. A negative number means no data |
| newUsersPerMinuteConfig | The minimum value of the configured new users per minute. A negative number means either Waiting Room is in passthrough or no data |
| sessionDuration | The minimum value of the configured session duration configuration. A negative number means no data |
| totalActiveUsers | The minimum value of the actual total active users. A negative number means no data |
| totalActiveUsersConfig | The minimum value of the configured total active users. A negative number means either Waiting Room is in passthrough or no data |
| totalQueuedUsers | The minimum value of total number of queued users. A negative number means no data |
ZoneWaitingRoomAnalyticsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneWaitingRoomAnalyticsAdaptiveGroupsSum
| Field | Description |
|---|---|
| newUsersPerMinute | Sum of new users per minute. A negative number means no data |
ZoneWaitingRoomAnalyticsAdaptiveOrderBy
| Field | Description |
|---|---|
ZoneWorkersZoneInvocationsAdaptiveGroups
Workers invocations with adaptive sampling
| Field | Description |
|---|---|
| avg | The average of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
ZoneWorkersZoneInvocationsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| avgCpuTime | Average CPU time used per request (in microseconds) |
ZoneWorkersZoneInvocationsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| constantScriptId | Worker script Id |
| date | Request datetime, truncated to start of a day |
| datetime | Request datetime |
| datetimeHour | Request datetime, truncated to start of an hour |
| datetimeMinute | Request datetime, truncated to start of an minute |
| httpResponseStatus | Origin HTTP response code |
| status | Status of the worker invocation |
ZoneWorkersZoneInvocationsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneWorkersZoneInvocationsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneWorkersZoneInvocationsAdaptiveGroupsSum
| Field | Description |
|---|---|
| requests | Sum of Requests |
| responseBodySize | Bandwidth (in bytes) returned to eyeball |
| subrequests | Number of sub-requests issued by the edge worker |
| totalCpuTime | Total CPU time used (in microseconds) |
ZoneWorkersZoneSubrequestsAdaptiveGroups
Workers subrequests with adaptive sampling
| Field | Description |
|---|---|
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
ZoneWorkersZoneSubrequestsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| cacheStatus | Cache status |
| date | Request datetime, truncated to start of a day |
| datetime | Request datetime |
| datetimeHour | Request datetime, truncated to start of an hour |
| datetimeMinute | Request datetime, truncated to start of an minute |
| httpResponseStatus | Origin HTTP response code |
ZoneWorkersZoneSubrequestsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneWorkersZoneSubrequestsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneWorkersZoneSubrequestsAdaptiveGroupsSum
| Field | Description |
|---|---|
| responseBodySize | Bandwidth (in bytes) received via subrequests |
| subrequests | Number of subrequests issued by a worker |
ZoneZarazActionsAdaptiveGroups
Zaraz Actions Analytics
| Field | Description |
|---|---|
| count | Number of processed Zaraz Actions |
| dimensions | List of dimensions to group by |
ZoneZarazActionsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| actionName | Action Name |
| date | The date the Action was triggered |
| datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
| datetimeFiveMinutes | The date and time truncated to five minutes |
| datetimeHour | The date and time truncated to the hour |
| datetimeMinute | The date and time truncated to the minute |
| toolName | Tool Name |
ZoneZarazActionsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneZarazActionsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneZarazAnalyticsIdentitiesAdaptiveGroups
Zaraz Analytics Identities - zaraz.identify calls
| Field | Description |
|---|---|
| count | Number of processed Zaraz identify requests |
| dimensions | List of dimensions to group by |
ZoneZarazAnalyticsIdentitiesAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| clientId | Client ID |
| date | Date when track was called |
| datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
| datetimeFiveMinutes | The date and time truncated to five minutes |
| datetimeHour | The date and time truncated to the hour |
| datetimeMinute | The date and time truncated to the minute |
| identity | Identity |
ZoneZarazAnalyticsIdentitiesAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneZarazAnalyticsIdentitiesAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneZarazAnalyticsOrderedTrackAdaptiveGroups
Zaraz Analytics Tracks ordered per session
| Field | Description |
|---|---|
| count | Number of processed Zaraz Track requests |
| dimensions | List of dimensions to group by |
ZoneZarazAnalyticsOrderedTrackAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| clientId | Client ID |
| colors | Colors |
| country | Country |
| date | Date when track was called |
| datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
| datetimeFiveMinutes | The date and time truncated to five minutes |
| datetimeHour | The date and time truncated to the hour |
| datetimeMinute | The date and time truncated to the minute |
| ip | IP |
| language | Language |
| orderInClient | Track order number for its clientId |
| orderInSession | Track reverse order number within its session (last track having orderInSession 1) |
| pageTitle | Page Title |
| resolution | Screen Resolution |
| sessionId | Session ID |
| timezoneOffset | Timezone Offset |
| trackData | Track Data |
| trackName | Track Name |
| trafficSrc | Traffic source |
| ua | User Agent |
| urlPath | URL Path |
| viewport | Viewport |
ZoneZarazAnalyticsOrderedTrackAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneZarazAnalyticsOrderedTrackAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneZarazAnalyticsTrackAdaptiveGroups
Zaraz Analytics Track - counts zaraz.track calls
| Field | Description |
|---|---|
| count | Number of processed Zaraz Track requests |
| dimensions | List of dimensions to group by |
| uniq |
ZoneZarazAnalyticsTrackAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| clientId | Client ID |
| colors | Colors |
| country | Country |
| date | Date when track was called |
| datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
| datetimeFiveMinutes | The date and time truncated to five minutes |
| datetimeHour | The date and time truncated to the hour |
| datetimeMinute | The date and time truncated to the minute |
| ip | IP |
| language | Language |
| pageTitle | Page Title |
| resolution | Screen Resolution |
| sessionId | Session ID |
| timezoneOffset | Timezone Offset |
| trackData | Track Data |
| trackName | Track Name |
| trafficSrc | Traffic source |
| ua | User Agent |
| urlPath | URL Path |
| viewport | Viewport |
ZoneZarazAnalyticsTrackAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneZarazAnalyticsTrackAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneZarazAnalyticsTrackAdaptiveGroupsUniq
| Field | Description |
|---|---|
| clientIdCount | Number of distinct client IDs |
| sessionIdCount | Number of distinct session IDs |
ZoneZarazAnalyticsTrackTrafficSourcesAdaptiveGroups
Zaraz Analytics Track Traffic Sources
| Field | Description |
|---|---|
| count | Number of unique sessions |
| dimensions | List of dimensions to group by |
| uniq |
ZoneZarazAnalyticsTrackTrafficSourcesAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| clientId | Client ID |
| exitPage | URL Path at session end |
| firstTrafficSrc | Referrer at session start |
| landingPage | URL Path at session start |
| sessionEnd | Date when the session ended |
| sessionEndFifteenMinutes | The date and time truncated to fifteen minutes |
| sessionEndFiveMinutes | The date and time truncated to five minutes |
| sessionEndHour | The date and time truncated to the hour |
| sessionEndMinute | The date and time truncated to the minute |
| sessionId | Session ID |
| sessionStart | Date when the session started |
| sessionStartFifteenMinutes | The date and time truncated to fifteen minutes |
| sessionStartFiveMinutes | The date and time truncated to five minutes |
| sessionStartHour | The date and time truncated to the hour |
| sessionStartMinute | The date and time truncated to the minute |
| tracks | Unique track names within a session |
ZoneZarazAnalyticsTrackTrafficSourcesAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneZarazAnalyticsTrackTrafficSourcesAdaptiveGroupsUniq
| Field | Description |
|---|---|
| clientIdCount | Number of distinct client IDs |
ZoneZarazAnalyticsTriggersAdaptiveGroups
Zaraz Analytics Triggers (a trigger is a set of rules that can trigger a zaraz action)
| Field | Description |
|---|---|
| count | Number of processed Zaraz Triggers |
| dimensions | List of dimensions to group by |
| uniq |
ZoneZarazAnalyticsTriggersAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| clientId | Client ID |
| colors | Colors |
| country | Country |
| date | The date when trigger was triggerd |
| datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
| datetimeFiveMinutes | The date and time truncated to five minutes |
| datetimeHour | The date and time truncated to the hour |
| datetimeMinute | The date and time truncated to the minute |
| ip | IP |
| language | Language |
| pageTitle | Page Title |
| resolution | Screen Resolution |
| sessionId | Session ID |
| timezoneOffset | Timezone Offset |
| trafficSrc | Traffic Source |
| triggerName | Trigger Name |
| ua | User Agent |
| urlPath | URL Path |
| viewport | Viewport |
ZoneZarazAnalyticsTriggersAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneZarazAnalyticsTriggersAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneZarazAnalyticsTriggersAdaptiveGroupsUniq
| Field | Description |
|---|---|
| clientIdCount | Number of distinct client IDs |
| sessionIdCount | Number of distinct session IDs |
ZoneZarazAnalyticsTriggersTrafficSourcesAdaptiveGroups
Zaraz Analytics Triggers Traffic Sources
| Field | Description |
|---|---|
| count | Number of unique sessions |
| dimensions | List of dimensions to group by |
| uniq |
ZoneZarazAnalyticsTriggersTrafficSourcesAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| clientId | Client ID |
| firstTrafficSrc | Referrer at session start |
| sessionEnd | Date when the session ended |
| sessionEndFifteenMinutes | The date and time truncated to fifteen minutes |
| sessionEndFiveMinutes | The date and time truncated to five minutes |
| sessionEndHour | The date and time truncated to the hour |
| sessionEndMinute | The date and time truncated to the minute |
| sessionId | Session ID |
| sessionStart | Date when the session started |
| sessionStartFifteenMinutes | The date and time truncated to fifteen minutes |
| sessionStartFiveMinutes | The date and time truncated to five minutes |
| sessionStartHour | The date and time truncated to the hour |
| sessionStartMinute | The date and time truncated to the minute |
| triggers | Unique trigger names within a session |
ZoneZarazAnalyticsTriggersTrafficSourcesAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneZarazAnalyticsTriggersTrafficSourcesAdaptiveGroupsUniq
| Field | Description |
|---|---|
| clientIdCount | Number of distinct client IDs |
ZoneZarazTrackAdaptiveGroups
Zaraz Track Analytics - counts zaraz.track calls
| Field | Description |
|---|---|
| count | Number of processed Zaraz Track requests |
| dimensions | List of dimensions to group by |
ZoneZarazTrackAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | Date when track was called |
| datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
| datetimeFiveMinutes | The date and time truncated to five minutes |
| datetimeHour | The date and time truncated to the hour |
| datetimeMinute | The date and time truncated to the minute |
| trackName | Track Name |
| urlPath | The URL from where Track was called |
ZoneZarazTrackAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneZarazTrackAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
ZoneZarazTriggersAdaptiveGroups
Zaraz Triggers Analytics (a trigger is a set of rules that can trigger a zaraz action)
| Field | Description |
|---|---|
| count | Number of processed Zaraz Triggers |
| dimensions | List of dimensions to group by |
ZoneZarazTriggersAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | The date when trigger was triggerd |
| datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
| datetimeFiveMinutes | The date and time truncated to five minutes |
| datetimeHour | The date and time truncated to the hour |
| datetimeMinute | The date and time truncated to the minute |
| triggerName | Trigger Name |
ZoneZarazTriggersAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
ZoneZarazTriggersAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
account
| Field | Description |
|---|---|
| MagicWANConnectorMetricsAdaptiveGroups | Beta. Magic WAN Connector Metrics |
| accessLoginRequestsAdaptiveGroups | Access login requests |
| accountTag | |
| advancedDnsProtectionNetworkAnalyticsAdaptiveGroups | Network analytics data for Advanced DNS Protection |
| advancedTcpProtectionNetworkAnalyticsAdaptiveGroups | DEPRECATED (This node is an alias for advancedTcpProtectionNetworkAnalyticsAdaptiveGroups; prefer using the new name instead): Network analytics data for Advanced TCP Protection |
| aiGatewayCacheAdaptiveGroups | AI Gateway Cache |
| aiGatewayErrorsAdaptiveGroups | AI Gateway Errors |
| aiGatewayRequestsAdaptiveGroups | AI Gateway Requests |
| aiInferenceAdaptive | AI Inference logs with adaptive sampling |
| aiInferenceAdaptiveGroups | Aggregated AI Inference logs with adaptive sampling |
| browserRenderingEventsAdaptive | Browser Rendering events with adaptive sampling |
| browserRenderingEventsAdaptiveGroups | Aggregated Browser Rendering events with adaptive sampling |
| callsStatusAdaptive | (TESTING ONLY, NOT FOR PRODUCTION) Raw Calls events with adaptive sampling |
| callsUsageAdaptiveGroups | Beta. Aggregated Calls bandwidth usage with adaptive sampling |
| cdnNetworkAnalyticsAdaptiveGroups | Network analytics data for Cloudflare CDN traffic |
| d1AnalyticsAdaptiveGroups | Beta. Aggregated D1 analytics with adaptive sampling |
| d1QueriesAdaptiveGroups | Beta. D1 query metrics with adaptive sampling |
| d1StorageAdaptiveGroups | Beta. D1 storage with adaptive sampling |
| dosdAttackAnalyticsGroups | Attack analytics metadata for attacks detected by dosd |
| dosdNetworkAnalyticsAdaptiveGroups | Network analytics data for dosd |
| durableObjectsInvocationsAdaptiveGroups | Durable Objects invocations with adaptive sampling |
| durableObjectsPeriodicGroups | Durable Objects periodic metrics |
| durableObjectsStorageGroups | Durable Objects storage metrics |
| durableObjectsSubrequestsAdaptiveGroups | Durable Objects subrequests with adaptive sampling |
| fbmAttackAnalyticsGroups | FBM analytics metadata for attacks detected by dosd |
| firewallEventsAdaptive | Raw Firewall events with adaptive sampling |
| firewallEventsAdaptiveGroups | Aggregated Firewall events with adaptive sampling |
| flowtrackdNetworkAnalyticsAdaptiveGroups | DEPRECATED (This node is an alias for advancedTcpProtectionNetworkAnalyticsAdaptiveGroups; prefer using the new name instead): Network analytics data for flowtrackd |
| gatewayL4DownstreamSessionsAdaptiveGroups | Aggregated metrics about downstream (client to edge) L4 Gateway Sessions. Metrics are reported on TCP or UDP session close |
| gatewayL4SessionsAdaptiveGroups | BETA - Aggregate counts of Gateway L4 sessions with adaptive sampling |
| gatewayL4UpstreamSessionsAdaptiveGroups | Aggregated metrics about upstream (edge to client) L4 Gateway Sessions. Metrics are reported on TCP, QUIC or UDP session close |
| gatewayL7RequestsAdaptiveGroups | BETA - Aggregate counts of Gateway L7 requests with adaptive sampling |
| gatewayResolverByCategoryAdaptiveGroups | BETA - Aggregate counts of Gateway Resolver queries by category with adaptive sampling |
| gatewayResolverByCustomResolverGroups | Stats on dns custom resolvers |
| gatewayResolverByRuleExecutionPerformanceAdaptiveGroups | Total time spent on executing firewall rules at the edge |
| gatewayResolverQueriesAdaptiveGroups | BETA - Aggregate counts of Gateway Resolver queries with adaptive sampling |
| httpRequests1dGroups | Daily rollups of request data |
| httpRequests1hGroups | Hourly rollups of request data |
| httpRequests1mGroups | Minutely rollups of request data |
| httpRequestsAdaptive | Raw HTTP requests with adaptive sampling |
| httpRequestsAdaptiveGroups | Aggregated HTTP requests data with adaptive sampling |
| httpRequestsOverviewAdaptiveGroups | A high-level summary of HTTP requests made by end users. |
| hyperdriveQueriesAdaptiveGroups | Hyperdrive query events with adaptive sampling. |
| imagesRequestsAdaptiveGroups | A high-level summary of Cloudflare Images served to end users. |
| imagesUniqueTransformations | Image unique transfromations per day |
| kvOperationsAdaptiveGroups | KV operations data with adaptive sampling |
| kvStorageAdaptiveGroups | KV stored data with adaptive sampling |
| logpushHealthAdaptiveGroups | Beta. Logpush job health metrics |
| magicFirewallNetworkAnalyticsAdaptiveGroups | Network analytics data for Magic Firewall |
| magicFirewallSamplesAdaptiveGroups | Data to visualize traffic allowed and blocked by Magic Firewall rules |
| magicIDPSNetworkAnalyticsAdaptiveGroups | Network analytics data for Magic IDS |
| magicTransitNetworkAnalyticsAdaptiveGroups | Network analytics data for Magic Transit traffic |
| magicTransitTunnelHealthChecksAdaptiveGroups | Beta. Magic Transit Health check results for customer GRE Tunnels with adaptive sampling (ABR). |
| magicTransitTunnelTrafficAdaptiveGroups | Bandwidth usage metric of a Magic Transit tunnel. |
| mnmFlowDataAdaptiveGroups | Flow data collected through Magic Network Monitoring |
| nelReportsAdaptiveGroups | Data to visualize network error logs |
| ohttpMetricsAdaptive | oHTTP request metrics with adaptive sampling |
| ohttpMetricsAdaptiveGroups | Aggregated oHTTP request metrics with adaptive sampling |
| pagesFunctionsInvocationsAdaptiveGroups | Pages Functions invocations with adaptive sampling |
| queueBacklogAdaptiveGroups | Beta. Queue backlog data with adaptive sampling. Queues that are not being written to, or read from, will not return data, even if they have a backlog. |
| queueConsumerMetricsAdaptiveGroups | Beta. Queue consumer metrics with adaptive sampling. Inactive queues will not return data. |
| queueDelayedBacklogAdaptiveGroups | Beta. Queue delayed backlog data with adaptive sampling. Queues that are not being written to, or read from, will not return data, even if they have a backlog. |
| queueMessageOperationsAdaptiveGroups | Beta. Queue message operation data with adaptive sampling |
| r2OperationsAdaptiveGroups | Beta. R2 operations with adaptive sampling |
| r2StorageAdaptiveGroups | Beta. R2 storage with adaptive sampling |
| rumPageloadEventsAdaptiveGroups | Beta. Aggregated RUM pageload event metrics with adaptive sampling |
| rumPerformanceEventsAdaptiveGroups | Beta. Aggregated RUM performance event metrics with adaptive sampling |
| rumWebVitalsEventsAdaptive | Beta. RUM Web Vitals event metrics with adaptive sampling |
| rumWebVitalsEventsAdaptiveGroups | Beta. Aggregated RUM Web Vitals event metrics with adaptive sampling |
| settings | |
| sinkholeRequestLogsAdaptive | Sinkhole Request Logs |
| sinkholeRequestLogsAdaptiveGroups | Sinkhole Request Logs |
| spectrumNetworkAnalyticsAdaptiveGroups | Network analytics data for Spectrum traffic |
| storageTraces | Storage Tracing Information |
| streamMinutesViewedAdaptiveGroups | A high-level summary of Cloudflare Stream minutes viewed. |
| turnstileAdaptiveGroups | Beta. Cloudflare Turnstile aggregated events with adaptive sampling |
| vectorizeQueriesAdaptiveGroups | Beta. Vectorize usage with adaptive sampling |
| vectorizeStorageAdaptiveGroups | Beta. Vectorize storage with adaptive sampling |
| videoBufferEventsAdaptiveGroups | Beta. Aggregated video streaming buffer event metrics with adaptive sampling |
| videoPlaybackEventsAdaptiveGroups | Beta. Aggregated video streaming playback event metrics with adaptive sampling |
| videoQualityEventsAdaptiveGroups | Beta. Aggregated video streaming quality change event metrics with adaptive sampling |
| warpDeviceAdaptiveGroups | Beta. Warp device health events with adaptive sampling |
| workerPlacementAdaptiveGroups | Worker placement metrics |
| workersAnalyticsEngineAdaptiveGroups | Beta. Custom Events with adaptive sampling |
| workersInvocationsAdaptive | Beta. Workers invocations with adaptive sampling |
| workersInvocationsScheduled | Workers scheduled invocations |
| workersOverviewDataAdaptiveGroups | Beta. Workers account overview invocation data with adaptive sampling |
| workersOverviewRequestsAdaptiveGroups | Beta. Workers account overview invocation count with adaptive sampling |
| workersSubrequestsAdaptiveGroups | Beta. Workers subrequests with adaptive sampling |
| zarazTrackAdaptiveGroups | Zaraz Track Analytics - counts zaraz.track calls |
| zarazTriggersAdaptiveGroups | Zaraz Triggers Analytics (a trigger is a set of rules that can trigger a zaraz action) |
| zeroTrustPrivateNetworkDiscoveryGroups | Beta - Unique origins, applications, and users discovered for Zero Trust private networks |
| zones |
organization
| Field | Description |
|---|---|
| httpRequestsAdaptiveGroups | Aggregated HTTP requests data with adaptive sampling |
| organizationTag | |
| settings |
viewer
| Field | Description |
|---|---|
| accounts | |
| budget | |
| organizations | |
| zones |
zone
| Field | Description |
|---|---|
| apiGatewayGraphqlQueryAnalyticsGroups | GraphQL query attributes and trends |
| apiGatewayMatchedSessionIDsAdaptiveGroups | Beta. Aggregated count of Session Identifier matches |
| apiRequestSequencesGroups | Sequences of API endpoint operations. Sequences are learned by grouping requests by AuthID. Correlation scores are estimated over a 24 hour window and are current to within 10 minutes |
| cacheReserveOperationsAdaptiveGroups | Beta. Cache Reserve operations with adaptive sampling |
| cacheReserveRequestsAdaptiveGroups | Cache Reserve HTTP requests data with adaptive sampling |
| cacheReserveStorageAdaptiveGroups | Beta. Cache Reserve storage with adaptive sampling |
| dmarcReportsAdaptive | Dmarc report records with adaptive sampling |
| dmarcReportsSourcesAdaptiveGroups | Aggregated dmarc reports by sources logs with adaptive sampling |
| dnsAnalyticsAdaptive | Analytics data for DNS queries (currently, only Foundation DNS zones are supported) |
| dnsAnalyticsAdaptiveGroups | Analytics data for DNS queries (currently, only Foundation DNS zones are supported) |
| emailRoutingAdaptive | Beta. Raw email routing logs with adaptive sampling |
| emailRoutingAdaptiveGroups | Beta. Aggregated email routing logs with adaptive sampling |
| firewallEventsAdaptive | Raw Firewall events with adaptive sampling |
| firewallEventsAdaptiveByTimeGroups | Aggregated Firewall events with adaptive sampling grouped by time |
| firewallEventsAdaptiveGroups | Aggregated Firewall events with adaptive sampling |
| healthCheckEventsAdaptive | Raw Health Check events with adaptive sampling |
| healthCheckEventsAdaptiveGroups | Aggregated Health Check events with adaptive sampling |
| httpRequests1dByColoGroups | DEPRECATED (Node is replaced with more capable httpRequestsAdaptiveGroups): Daily rollups of request data by colo |
| httpRequests1dGroups | Daily rollups of request data |
| httpRequests1hGroups | Hourly rollups of request data |
| httpRequests1mByColoGroups | DEPRECATED (Node is replaced with more capable httpRequestsAdaptiveGroups): Minutely rollups of request data by colo |
| httpRequests1mGroups | Minutely rollups of request data |
| httpRequestsAdaptive | Raw HTTP requests with adaptive sampling |
| httpRequestsAdaptiveGroups | Aggregated HTTP requests data with adaptive sampling |
| httpRequestsOverviewAdaptiveGroups | A high-level summary of HTTP requests made by end users. |
| imageResizingRequests1mGroups | Minutely rollups of Image Resizing requests |
| loadBalancingRequestsAdaptive | Raw Load Balancing origin requests with adaptive sampling |
| loadBalancingRequestsAdaptiveGroups | Aggregated Load Balancing origin requests with adaptive sampling |
| logpushHealthAdaptiveGroups | Beta. Logpush job health metrics |
| nelReportsAdaptiveGroups | Data to visualize network error logs |
| pageShieldReportsAdaptiveGroups | Page Shield CSP reports |
| settings | |
| waitingRoomAnalyticsAdaptive | Raw Waiting Room analytics logs |
| waitingRoomAnalyticsAdaptiveGroups | Aggregated Waiting Room analytics logs with adaptive sampling |
| workersZoneInvocationsAdaptiveGroups | Workers invocations with adaptive sampling |
| workersZoneSubrequestsAdaptiveGroups | Workers subrequests with adaptive sampling |
| zarazActionsAdaptiveGroups | Zaraz Actions Analytics |
| zarazAnalyticsIdentitiesAdaptiveGroups | Zaraz Analytics Identities - zaraz.identify calls |
| zarazAnalyticsOrderedTrackAdaptiveGroups | Zaraz Analytics Tracks ordered per session |
| zarazAnalyticsTrackAdaptiveGroups | Zaraz Analytics Track - counts zaraz.track calls |
| zarazAnalyticsTrackTrafficSourcesAdaptiveGroups | Zaraz Analytics Track Traffic Sources |
| zarazAnalyticsTriggersAdaptiveGroups | Zaraz Analytics Triggers (a trigger is a set of rules that can trigger a zaraz action) |
| zarazAnalyticsTriggersTrafficSourcesAdaptiveGroups | Zaraz Analytics Triggers Traffic Sources |
| zarazTrackAdaptiveGroups | Zaraz Track Analytics - counts zaraz.track calls |
| zarazTriggersAdaptiveGroups | Zaraz Triggers Analytics (a trigger is a set of rules that can trigger a zaraz action) |
| zoneTag |