GraphQL
This lists all of the available datasets and fields in Cloudflare's GraphQL API.
AccountAccessLoginRequestsAdaptiveGroups
Access login requests
| Field | Description |
|---|---|
| avg | |
| count | Number of access login API events processed |
| dimensions | List of dimensions to group by |
AccountAccessLoginRequestsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval | Average sample interval |
AccountAccessLoginRequestsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| appId | Access application ID |
| approvingPolicyId | Policy ID that approved the user |
| cfRayId | CF ray id |
| country | Country tag |
| date | The date the access login event was emitted |
| datetime | The date and time the access login event was emitted |
| datetimeMinute | The date and time the access login event was emitted truncated to the minute |
| deviceId | Device ID |
| hasExistingJWT | Has existing JWT (0 = false, 1 = true) |
| hasGatewayEnabled | Has Gateway enabled (0 = false, 1 = true) |
| hasWarpEnabled | Has WARP enabled (0 = false, 1 = true) |
| identityProvider | Identity provider |
| ipAddress | User IP address |
| isSuccessfulLogin | If the login was successful (0 = false, 1 = true) |
| mtlsCertSerialId | MTLS certificate serial ID |
| mtlsCommonName | MTLS common name |
| mtlsStatus | MTLS status (may show error message if status is not successful) |
| serviceTokenId | Service token ID |
| userUuid | User UUID |
AccountAccessLoginRequestsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountAccessLoginRequestsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroups
Network analytics data for Advanced DNS Protection
| Field | Description |
|---|---|
| avg | The average of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
| bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
| bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
| bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
| bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
| bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
| bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
| packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
| packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
| packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
| packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
| packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
| packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
| packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| applicationTag | Application tag associated with the packet |
| coloCity | City where the Cloudflare datacenter that received the packet is located |
| coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
| coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
| coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
| coloName | Cloudflare datacenter that received the packet (unique site identifier) |
| date | Date that the packet was received |
| datetime | Date and time that the packet was received |
| datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
| datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
| datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
| datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
| datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
| destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
| destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
| destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
| destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
| destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
| direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
| dnsQueryName | The requested domain name in the DNS query |
| dnsQueryType | The query type in the DNS query |
| ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
| greChecksum | Value of the Checkusm header field in the GRE packet |
| greEthertype | Value of the Ethertype header field in the GRE packet |
| greHeaderLength | Length of the GRE packet header, in bytes |
| greKey | Value of the Key header field in the GRE packet |
| greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
| greVersion | Value of the Version header field in the GRE packet |
| icmpChecksum | Value of the Checkusm header field in the ICMP packet |
| icmpCode | Value of the Code header field in the ICMP packet |
| icmpType | Value of the Type header field in the ICMP packet |
| ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
| ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
| ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
| ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
| ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
| ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
| ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
| ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
| ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
| ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
| ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
| ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
| ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
| ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
| ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
| ipv4Identification | Value of the Identification header field in the IPv4 packet |
| ipv4Options | List of Options numbers included in the IPv4 packet header |
| ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
| ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
| ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
| ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
| ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
| leaseTag | IP lease tag associated with the packet |
| mitigationReason | Reason for applying a mitigation to the packet, if any |
| mitigationScope | Whether the packet matched a local or global mitigation, if any (possible values: local, global) |
| outcome | The action that was taken on the packet (possible values: pass, drop) |
| prefixTag | IP prefix tag associated with the packet |
| sampleInterval | ABR sample interval |
| sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
| sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
| sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
| sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
| sourcePort | Value of the Source Port header field in the TCP or UDP packet |
| tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
| tcpChecksum | Value of the Checkusm header field in the TCP packet |
| tcpDataOffset | Value of the Data Offset header field in the TCP packet |
| tcpFlags | Value of the Flags header field in the TCP packet |
| tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
| tcpMss | Value of the MSS option header field in the TCP packet |
| tcpOptions | List of Options numbers included in the TCP packet header |
| tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
| tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
| tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
| tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
| tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
| tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
| tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
| tcpWindowSize | Value of the Window Size header field in the TCP packet |
| udpChecksum | Value of the Checkusm header field in the UDP packet |
| udpPayloadLength | Value of the Payload Length header field in the UDP packet |
| verdict | The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop) |
AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsSum
| Field | Description |
|---|---|
| bits | Sum of bits received |
| packets | Sum of packets received |
AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroups
Network analytics data for Advanced TCP Protection
| Field | Description |
|---|---|
| avg | The average of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
| bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
| bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
| bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
| bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
| bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
| bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
| packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
| packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
| packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
| packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
| packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
| packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
| packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| applicationTag | Application tag associated with the packet |
| coloCity | City where the Cloudflare datacenter that received the packet is located |
| coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
| coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
| coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
| coloName | Cloudflare datacenter that received the packet (unique site identifier) |
| date | Date that the packet was received |
| datetime | Date and time that the packet was received |
| datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
| datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
| datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
| datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
| datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
| destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
| destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
| destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
| destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
| destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
| direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
| ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
| greChecksum | Value of the Checkusm header field in the GRE packet |
| greEthertype | Value of the Ethertype header field in the GRE packet |
| greHeaderLength | Length of the GRE packet header, in bytes |
| greKey | Value of the Key header field in the GRE packet |
| greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
| greVersion | Value of the Version header field in the GRE packet |
| icmpChecksum | Value of the Checkusm header field in the ICMP packet |
| icmpCode | Value of the Code header field in the ICMP packet |
| icmpType | Value of the Type header field in the ICMP packet |
| ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
| ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
| ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
| ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
| ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
| ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
| ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
| ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
| ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
| ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
| ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
| ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
| ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
| ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
| ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
| ipv4Identification | Value of the Identification header field in the IPv4 packet |
| ipv4Options | List of Options numbers included in the IPv4 packet header |
| ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
| ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
| ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
| ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
| ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
| leaseTag | IP lease tag associated with the packet |
| mitigationReason | Reason for applying a mitigation to the packet, if any |
| mitigationScope | Whether the packet matched a local or global mitigation, if any (possible values: local, global) |
| outcome | The action that was taken on the packet (possible values: pass, drop) |
| prefixTag | IP prefix tag associated with the packet |
| protocolState | State of the packet in the context of the protocol, if available |
| sampleInterval | ABR sample interval |
| sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
| sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
| sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
| sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
| sourcePort | Value of the Source Port header field in the TCP or UDP packet |
| tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
| tcpChecksum | Value of the Checkusm header field in the TCP packet |
| tcpDataOffset | Value of the Data Offset header field in the TCP packet |
| tcpFlags | Value of the Flags header field in the TCP packet |
| tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
| tcpMss | Value of the MSS option header field in the TCP packet |
| tcpOptions | List of Options numbers included in the TCP packet header |
| tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
| tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
| tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
| tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
| tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
| tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
| tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
| tcpWindowSize | Value of the Window Size header field in the TCP packet |
| udpChecksum | Value of the Checkusm header field in the UDP packet |
| udpPayloadLength | Value of the Payload Length header field in the UDP packet |
| verdict | The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop) |
AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsSum
| Field | Description |
|---|---|
| bits | Sum of bits received |
| packets | Sum of packets received |
AccountAiGatewayCacheAdaptiveGroups
AI Gateway Cache
| Field | Description |
|---|---|
| count | Total number of requests for an account with caching enabled: including hits and misses |
| dimensions | List of dimensions to group by |
AccountAiGatewayCacheAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| cacheOp | Cache Hit or Miss: 1 = cache hit, 0 = cache miss |
| date | The date when trigger was triggerd |
| datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
| datetimeFiveMinutes | The date and time truncated to five minutes |
| datetimeHour | The date and time truncated to the hour |
| datetimeMinute | The date and time truncated to the minute |
| gateway | Gateway name |
| model | Which model was the request sent to |
| provider | Which provider was the request sent to |
| tokensIn | Number of tokens in the request |
| tokensOut | Number of tokens in the response |
AccountAiGatewayCacheAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountAiGatewayCacheAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountAiGatewayErrorsAdaptiveGroups
AI Gateway Errors
| Field | Description |
|---|---|
| count | Number of errors |
| dimensions | List of dimensions to group by |
AccountAiGatewayErrorsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | The date when trigger was triggerd |
| datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
| datetimeFiveMinutes | The date and time truncated to five minutes |
| datetimeHour | The date and time truncated to the hour |
| datetimeMinute | The date and time truncated to the minute |
| gateway | Gateway name |
| model | Which models was the request sent to |
| provider | Which provider was the request sent to |
AccountAiGatewayErrorsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountAiGatewayErrorsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountAiGatewayRequestsAdaptiveGroups
AI Gateway Requests
| Field | Description |
|---|---|
| count | Number of processed requests |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountAiGatewayRequestsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| cached | Was the response served from cache?: 1 = cache hit, 0 = cache misss |
| date | The date when trigger was triggered |
| datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
| datetimeFiveMinutes | The date and time truncated to five minutes |
| datetimeHour | The date and time truncated to the hour |
| datetimeMinute | The date and time truncated to the minute |
| error | Was the response an error: 1 , 0 for no error |
| gateway | Gateway name |
| model | Which models was the request sent to |
| provider | Which provider was the request sent to |
| rateLimited | Was the request rate limited?: 1 = rate limit applied, 0 = rate limit not applied |
| tokensIn | Number of tokens in the request |
| tokensOut | Number of tokens in the response |
AccountAiGatewayRequestsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountAiGatewayRequestsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountAiGatewayRequestsAdaptiveGroupsSum
| Field | Description |
|---|---|
| cachedTokensIn | Sum of cached tokens in |
| cachedTokensOut | Sum of cached tokens out |
| uncachedTokensIn | Sum of uncached tokens in |
| uncachedTokensOut | Sum of uncached tokens out |
AccountAiGatewaySizeAdaptiveGroups
AI Gateway Stored Rows
| Field | Description |
|---|---|
| dimensions | List of dimensions to group by |
| max | The max of values for a metric per dimension |
AccountAiGatewaySizeAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | The date when trigger was triggerd |
| datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
| datetimeFiveMinutes | The date and time truncated to five minutes |
| datetimeHour | The date and time truncated to the hour |
| datetimeMinute | The date and time truncated to the minute |
| gateway | Gateway name |
| logManagement | Log Management active or not: 1 = active, 0 = not active |
| rows | Number of rows stored in a gateway |
AccountAiGatewaySizeAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountAiGatewaySizeAdaptiveGroupsMax
| Field | Description |
|---|---|
| rows | Max of stored rows |
AccountAiGatewaySizeAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountAiInferenceAdaptive
AI Inference logs with adaptive sampling
| Field | Description |
|---|---|
| costMetricName1 | Name for cost metric 1 |
| costMetricName2 | Name for cost metric 2 |
| costMetricValue1 | Value for cost metric 1 |
| costMetricValue2 | Value for cost metric 2 |
| datetime | The date when inferance was triggered |
| errorCode | Error code |
| inferenceTimeMs | Inference time ms |
| modelId | ModelId that was trigger to inference |
| modelIsBeta | Model that was trigger to inference is Beta |
| neurons | Monetization unit |
| requestBytesIn | Request size in bytes |
| requestBytesOut | Request size out bytes |
| requestSource | Source who triggered (worker binding, pages binding, rest api) |
| sampleInterval | ABR sample interval |
AccountAiInferenceAdaptiveFilter_InputObject
| Field | Description |
|---|---|
AccountAiInferenceAdaptiveGroups
Aggregated AI Inference logs with adaptive sampling
| Field | Description |
|---|---|
| count | Total number of inferences for an account |
| dimensions | List of dimensions to group by |
| sum |
AccountAiInferenceAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| costMetricName1 | Name for cost metric 1 |
| costMetricName2 | Name for cost metric 2 |
| costMetricValue1 | Value for cost metric 1 |
| costMetricValue2 | Value for cost metric 2 |
| date | The date when starts the inference |
| datetimeFifteenMinutes | The date and time truncated to fifteen minutes |
| datetimeFiveMinutes | The date and time truncated to five minutes |
| datetimeHour | The date and time truncated to the hour |
| datetimeMinute | The date and time truncated to the minute |
| errorCode | Error code |
| inferenceTimeMs | Inference time ms |
| modelId | ModelId that was trigger to inference |
| modelIsBeta | Model that was trigger to inference is Beta |
| neurons | Monetization unit |
| requestBytesIn | Request size in bytes |
| requestBytesOut | Request size out bytes |
| requestSource | Source who triggered (worker binding, pages binding, rest api) |
AccountAiInferenceAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountAiInferenceAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountAiInferenceAdaptiveGroupsSum
| Field | Description |
|---|---|
| totalCostMetricValue1 | Total value for cost metric 1 |
| totalCostMetricValue2 | Total value for cost metric 2 |
| totalInferenceTimeMs | Total inference time ms |
| totalNeurons | Total neurons |
| totalRequestBytesIn | Total bytes in per request |
| totalRequestBytesOut | Total bytes out per request |
AccountAiInferenceAdaptiveOrderBy
| Field | Description |
|---|---|
AccountBrowserRenderingEventsAdaptive
Browser Rendering events with adaptive sampling
| Field | Description |
|---|---|
| browserCloseReason | Browser session close code. Enum (-1, N/A) (0, Unknown) (1, NormalClosure) (2, BrowserIdle) (3, ClientClosedEarly) (4, ChromiumChrashed) (5, ClientAbnormalClosure) (6, ServerAbnormalClosure) (7, ClientError) (8, ServerError) (9, WorkerError) (10, ClientNeverConnected) (11, BrowserSessionEvicted) |
| browserEndTime | Browser session end time |
| browserStartTime | Browser session start time |
| connectionEndTime | When worker ended devtools connection to browser session |
| connectionId | Worker connection ID, when available |
| connectionStartTime | When worker started devtools connection to browser session |
| datetime | The time of the event |
| sampleInterval | ABR sample interval |
| scriptName | Name of worker who initiated the request |
| sessionId | Browser session ID |
AccountBrowserRenderingEventsAdaptiveFilter_InputObject
| Field | Description |
|---|---|
AccountBrowserRenderingEventsAdaptiveGroups
Aggregated Browser Rendering events with adaptive sampling
| Field | Description |
|---|---|
| count | Total number of events for an account |
| dimensions | List of dimensions to group by |
| max | The maximum value for a metric per dimension |
| min | The minimum value for a metric per dimension |
| uniq |
AccountBrowserRenderingEventsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| browserCloseReason | Browser session close code. Enum (-1, N/A) (0, Unknown) (1, NormalClosure) (2, BrowserIdle) (3, ClientClosedEarly) (4, ChromiumChrashed) (5, ClientAbnormalClosure) (6, ServerAbnormalClosure) (7, ClientError) (8, ServerError) (9, WorkerError) (10, ClientNeverConnected) (11, BrowserSessionEvicted) |
| connectionId | Worker connection ID, when available |
| date | The date of the event |
| datetimeFifteenMinutes | The date and time of the event truncated to fifteen minutes |
| datetimeFiveMinutes | The date and time of the event truncated to five minutes |
| datetimeHour | The date and time of the event truncated to the hour |
| datetimeMinute | The date and time of the event truncated to the minute |
| scriptName | Name of worker who initiated the request |
| sessionId | Browser session ID |
AccountBrowserRenderingEventsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountBrowserRenderingEventsAdaptiveGroupsMax
| Field | Description |
|---|---|
| finalBrowserCloseReason | Browser close reason |
| latestBrowserEndTime | Browser end time |
AccountBrowserRenderingEventsAdaptiveGroupsMin
| Field | Description |
|---|---|
| earliestBrowserStartTime | Browser start time |
AccountBrowserRenderingEventsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountBrowserRenderingEventsAdaptiveGroupsUniq
| Field | Description |
|---|---|
| connectionIdCount | Unique worker connections |
| sessionIdCount | Unique browser sessions |
AccountBrowserRenderingEventsAdaptiveOrderBy
| Field | Description |
|---|---|
AccountCallsStatusAdaptive
(TESTING ONLY, NOT FOR PRODUCTION) Raw Calls events with adaptive sampling
| Field | Description |
|---|---|
| appId | The appId that generated traffic |
| datetime | The date and time the event was recorded |
| event | The description of the event related to a session or a track |
| sessionId | The generated string that identifies a PeerConnection |
| trackId | The track identifier provided to us within a PeerConnection |
AccountCallsStatusAdaptiveFilter_InputObject
| Field | Description |
|---|---|
AccountCallsStatusAdaptiveOrderBy
| Field | Description |
|---|---|
AccountCallsTurnUsageAdaptiveGroups
Aggregated Calls TURN bandwidth usage with adaptive sampling"
| Field | Description |
|---|---|
| avg | |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountCallsTurnUsageAdaptiveGroupsAvg
| Field | Description |
|---|---|
| concurrentConnectionsFifteenMinutes | Average concurrent connections when grouped by datetimeFifteenMinutes |
| concurrentConnectionsFiveMinutes | Average concurrent connections when grouped by datetimeFiveMinutes |
| concurrentConnectionsHour | Average concurrent connections when grouped by datetimeHour |
| concurrentConnectionsMinute | Average concurrent connections when grouped by datetimeMinute |
AccountCallsTurnUsageAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| customIdentifier | The customIdentifier (provided when credential was generated) that generated traffic |
| datacenterCity | City of the Cloudflare datacenter |
| datacenterCode | IATA airport code of the Cloudflare datacenter |
| datacenterCountry | Country of the Cloudflare datacenter |
| datacenterRegion | Region of the Cloudflare datacenter |
| date | Calls TURN bandwidth metrics date |
| datetimeFifteenMinutes | Calls TURN bandwidth metrics timestamp, truncated to fifteen minutes |
| datetimeFiveMinutes | Calls TURN bandwidth metrics timestamp, truncated to five minutes |
| datetimeHour | Calls TURN bandwidth metrics timestamp, truncated to the hour |
| datetimeMinute | Calls TURN bandwidth metrics timestamp, truncated to the minute |
| keyId | The credentials created by this keyId that generated traffic |
| username | The username from credential that generated traffic |
AccountCallsTurnUsageAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountCallsTurnUsageAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountCallsTurnUsageAdaptiveGroupsSum
| Field | Description |
|---|---|
| egressBytes | The total bytes sent by Calls TURN, observed over the queried time period |
| ingressBytes | The total bytes received by Calls TURN, observed over the queried time period |
AccountCallsUsageAdaptiveGroups
Beta. Aggregated Calls SFU bandwidth usage with adaptive sampling
| Field | Description |
|---|---|
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountCallsUsageAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| appId | The appId that generated traffic |
| date | Calls bandwidth metrics date |
| datetimeFifteenMinutes | Calls bandwidth metrics timestamp, truncated to fifteen minutes |
| datetimeFiveMinutes | Calls bandwidth metrics timestamp, truncated to five minutes |
| datetimeHour | Calls bandwidth metrics timestamp, truncated to the hour |
| datetimeMinute | Calls bandwidth metrics timestamp, truncated to the minute |
| sessionId | The generated string that identifies a PeerConnection |
| trackId | The track identifier provided to us within a PeerConnection |
| trackType | Describes if the track contains video, audio, or data |
AccountCallsUsageAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountCallsUsageAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountCallsUsageAdaptiveGroupsSum
| Field | Description |
|---|---|
| egressBytes | The total bytes sent by Calls, observed over the queried time period |
| ingressBytes | The total bytes received by Calls, observed over the queried time period |
AccountCdnNetworkAnalyticsAdaptiveGroups
Network analytics data for Cloudflare CDN traffic
| Field | Description |
|---|---|
| avg | The average of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountCdnNetworkAnalyticsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
| bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
| bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
| bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
| bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
| bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
| bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
| packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
| packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
| packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
| packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
| packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
| packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
| packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountCdnNetworkAnalyticsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| applicationTag | Application tag associated with the packet |
| coloCity | City where the Cloudflare datacenter that received the packet is located |
| coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
| coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
| coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
| coloName | Cloudflare datacenter that received the packet (unique site identifier) |
| date | Date that the packet was received |
| datetime | Date and time that the packet was received |
| datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
| datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
| datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
| datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
| datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
| destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
| destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
| destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
| destinationDeviceTag | Device tag associated with the destination IP of the packet |
| destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
| destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
| direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
| ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
| greChecksum | Value of the Checkusm header field in the GRE packet |
| greEthertype | Value of the Ethertype header field in the GRE packet |
| greHeaderLength | Length of the GRE packet header, in bytes |
| greKey | Value of the Key header field in the GRE packet |
| greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
| greVersion | Value of the Version header field in the GRE packet |
| icmpChecksum | Value of the Checkusm header field in the ICMP packet |
| icmpCode | Value of the Code header field in the ICMP packet |
| icmpType | Value of the Type header field in the ICMP packet |
| ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
| ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
| ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
| ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
| ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
| ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
| ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
| ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
| ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
| ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
| ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
| ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
| ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
| ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
| ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
| ipv4Identification | Value of the Identification header field in the IPv4 packet |
| ipv4Options | List of Options numbers included in the IPv4 packet header |
| ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
| ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
| ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
| ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
| ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
| leaseTag | IP lease tag associated with the packet |
| mitigationSystem | Which system dropped the packet (possible values: dosd, flowtrackd, magic-firewall) |
| outcome | The action that was taken on the packet (possible values: pass, drop) |
| popName | Cloudflare PoP that received the packet (unique site identifier) |
| prefixTag | IP prefix tag associated with the packet |
| sampleInterval | ABR sample interval |
| sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
| sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
| sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
| sourceDeviceTag | Device tag associated with the source IP of the packet |
| sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
| sourcePort | Value of the Source Port header field in the TCP or UDP packet |
| tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
| tcpChecksum | Value of the Checkusm header field in the TCP packet |
| tcpDataOffset | Value of the Data Offset header field in the TCP packet |
| tcpFlags | Value of the Flags header field in the TCP packet |
| tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
| tcpMss | Value of the MSS option header field in the TCP packet |
| tcpOptions | List of Options numbers included in the TCP packet header |
| tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
| tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
| tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
| tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
| tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
| tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
| tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
| tcpWindowSize | Value of the Window Size header field in the TCP packet |
| udpChecksum | Value of the Checkusm header field in the UDP packet |
| udpPayloadLength | Value of the Payload Length header field in the UDP packet |
AccountCdnNetworkAnalyticsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountCdnNetworkAnalyticsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountCdnNetworkAnalyticsAdaptiveGroupsSum
| Field | Description |
|---|---|
| bits | Sum of bits received |
| packets | Sum of packets received |
AccountD1AnalyticsAdaptiveGroups
Beta. Aggregated D1 analytics with adaptive sampling
| Field | Description |
|---|---|
| avg | The average value for a metric per dimension |
| count | Number of requests to D1 processed |
| dimensions | List of dimensions to group by |
| quantiles | Quantiles of a metric per dimension |
| sum | The sum of values for a metric per dimension |
AccountD1AnalyticsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| queryBatchResponseBytes | The total number of bytes in the response, including all returned rows and metadata (average/mean). |
| queryBatchTimeMs | Query batch response time in milliseconds (average/mean). |
| sampleInterval | The average value used for sample interval |
AccountD1AnalyticsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| databaseId | The UUID of a D1 database |
| date | The date the D1 request was received |
| datetimeFifteenMinutes | The date and time the D1 request was received truncated to fifteen minutes |
| datetimeFiveMinutes | The date and time the D1 request was received truncated to five minutes |
| datetimeHour | The date and time the D1 request was received truncated to the hour |
| datetimeMinute | The date and time the D1 request was received truncated to the minute |
AccountD1AnalyticsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountD1AnalyticsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountD1AnalyticsAdaptiveGroupsQuantiles
| Field | Description |
|---|---|
| queryBatchResponseBytesP50 | The total number of bytes in the response, including all returned rows and metadata (50th percentile). |
| queryBatchResponseBytesP90 | The total number of bytes in the response, including all returned rows and metadata (90th percentile). |
| queryBatchTimeMsP50 | Query batch response time in milliseconds (50th percentile). |
| queryBatchTimeMsP90 | Query batch response time in milliseconds (90th percentile). |
AccountD1AnalyticsAdaptiveGroupsSum
| Field | Description |
|---|---|
| queryBatchResponseBytes | The total number of bytes in the response, including all returned rows and metadata. |
| readQueries | The number of read queries. |
| rowsRead | The number of rows your queries read. |
| rowsWritten | The number of rows your queries wrote. |
| writeQueries | The number of write queries. |
AccountD1QueriesAdaptiveGroups
Beta. D1 query metrics with adaptive sampling
| Field | Description |
|---|---|
| avg | The average value for a metric per dimension |
| count | Number of D1 queries processed |
| dimensions | List of dimensions to group by |
| quantiles | Quantiles of a metric per dimension |
| sum | The sum of values for a metric per dimension |
AccountD1QueriesAdaptiveGroupsAvg
| Field | Description |
|---|---|
| queryDurationMs | The average duration queries in D1 took, observed over the queried time period. |
| rowsRead | The average number of rows scanned, observed over the queried time period. |
| rowsReturned | The average number of rows returned, observed over the queried time period. |
| rowsWritten | The average number of rows written, observed over the queried time period. |
| sampleInterval | The average value used for sample interval |
AccountD1QueriesAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| databaseId | The UUID of a D1 database |
| date | D1 query sample timestamp |
| datetimeFifteenMinutes | D1 query sample timestamp, truncated to fifteen minutes |
| datetimeFiveMinutes | D1 query sample timestamp, truncated to five minutes |
| datetimeHour | D1 query sample timestamp, truncated to the hour |
| datetimeMinute | D1 query sample timestamp, truncated to the minute |
| query | The SQL query that ran on a D1 database, with parameterized values replaced with placeholders. |
AccountD1QueriesAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountD1QueriesAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountD1QueriesAdaptiveGroupsQuantiles
| Field | Description |
|---|---|
| queryDurationMsP50 | 50th percentile Query Duration (milliseconds) |
| queryDurationMsP95 | 95th percentile Query Duration (milliseconds) |
| queryDurationMsP99 | 99th percentile Query Duration (milliseconds) |
AccountD1QueriesAdaptiveGroupsSum
| Field | Description |
|---|---|
| queryDurationMs | The total duration queries in D1 took, observed over the queried time period. |
| rowsRead | The total number of rows scanned, observed over the queried time period. |
| rowsReturned | The total number of rows returned, observed over the queried time period. |
| rowsWritten | The total number of rows written, observed over the queried time period. |
AccountD1StorageAdaptiveGroups
Beta. D1 storage with adaptive sampling
| Field | Description |
|---|---|
| dimensions | List of dimensions to group by |
| max | The max of values for a metric per dimension |
AccountD1StorageAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| databaseId | The UUID of a D1 database |
| date | D1 storage sample timestamp |
| datetimeFifteenMinutes | D1 storage sample timestamp, truncated to fifteen minutes |
| datetimeFiveMinutes | D1 storage sample timestamp, truncated to five minutes |
| datetimeHour | D1 storage sample timestamp, truncated to the hour |
| datetimeMinute | D1 storage sample timestamp, truncated to the minute |
AccountD1StorageAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountD1StorageAdaptiveGroupsMax
| Field | Description |
|---|---|
| databaseSizeBytes | The maximum size of the database (measured in bytes) observed over the queried time period. |
AccountD1StorageAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountDosdAttackAnalyticsGroups
Attack analytics metadata for attacks detected by dosd
| Field | Description |
|---|---|
| attackId | Unique identifier of the mitigation that matched the packet, if any |
| attackType | DEPRECATED (Use attackVector for a richer description of the attack): Type of attack traffic |
| attackVector | Description of attack vector |
| bits | Sum of bits received during the attack |
| commonTcpFlags | Common TCP flags used by attack traffic, if any |
| commonTcpFlagsNames | Names of common TCP flags used by attack traffic, if any |
| destinationIp | Fixed destination IP used by attack traffic, if any |
| destinationPort | Fixed destination port used by attack traffic, if any |
| droppedBits | Sum of bits dropped during the attack |
| droppedPackets | Sum of packets dropped during the attack |
| endDatetime | Date and time that the attack ended; not available for ongoing attacks |
| ipProtocol | Fixed protocol used by attack traffic, if any |
| ipProtocolName | Fixed protocol used by attack traffic, if any |
| mitigationReason | Type of mitigation applied to attack traffic |
| mitigationScope | Whether mitigation was applied in only some locations or globally |
| mitigationType | Type of mitigation applied to attack traffic |
| packets | Sum of packets received during the attack |
| ruleId | Unique identifier of the rule that matched the packet, if any |
| ruleName | Human-readable name of the rule that matched the packet, if any |
| rulesetId | Unique identifier of the ruleset containing the rule that matched the packet, if any |
| rulesetOverrideId | Unique identifier of the ruleset override containing the rule that matched the packet, if any |
| sourceIp | Fixed source IP used by attack traffic, if any |
| sourcePort | Fixed source port used by attack traffic, if any |
| startDatetime | Date and time that the attack started |
| tcpFlags | Fixed TCP flags used by attack traffic, if any |
| tcpFlagsNames | Names of fixed TCP flags used by attack traffic, if any |
AccountDosdAttackAnalyticsGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountDosdAttackAnalyticsGroupsOrderBy
| Field | Description |
|---|---|
AccountDosdNetworkAnalyticsAdaptiveGroups
Network analytics data for dosd
| Field | Description |
|---|---|
| avg | The average of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountDosdNetworkAnalyticsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
| bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
| bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
| bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
| bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
| bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
| bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
| packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
| packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
| packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
| packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
| packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
| packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
| packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountDosdNetworkAnalyticsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| applicationTag | Application tag associated with the packet |
| attackId | Unique identifier of the mitigation that matched the packet, if any |
| attackVector | Attack vector of the rule that matched the packet, if any |
| coloCity | City where the Cloudflare datacenter that received the packet is located |
| coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
| coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
| coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
| coloName | Cloudflare datacenter that received the packet (unique site identifier) |
| date | Date that the packet was received |
| datetime | Date and time that the packet was received |
| datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
| datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
| datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
| datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
| datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
| destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
| destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
| destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
| destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
| destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
| direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
| ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
| greChecksum | Value of the Checkusm header field in the GRE packet |
| greEthertype | Value of the Ethertype header field in the GRE packet |
| greHeaderLength | Length of the GRE packet header, in bytes |
| greKey | Value of the Key header field in the GRE packet |
| greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
| greVersion | Value of the Version header field in the GRE packet |
| icmpChecksum | Value of the Checkusm header field in the ICMP packet |
| icmpCode | Value of the Code header field in the ICMP packet |
| icmpType | Value of the Type header field in the ICMP packet |
| ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
| ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
| ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
| ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
| ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
| ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
| ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
| ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
| ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
| ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
| ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
| ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
| ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
| ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
| ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
| ipv4Identification | Value of the Identification header field in the IPv4 packet |
| ipv4Options | List of Options numbers included in the IPv4 packet header |
| ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
| ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
| ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
| ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
| ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
| leaseTag | IP lease tag associated with the packet |
| mitigationReason | Reason for applying a mitigation to the packet, if any |
| mitigationScope | Whether the packet matched a local or global mitigation, if any (possible values: local, global) |
| outcome | The action that was taken on the packet (possible values: pass, drop) |
| prefixTag | IP prefix tag associated with the packet |
| protocolState | State of the packet in the context of the protocol, if available |
| ruleId | Unique identifier of the rule that matched the packet, if any |
| ruleName | Human-readable name of the rule that matched the packet, if any |
| rulesetId | Unique identifier of the ruleset containing the rule that matched the packet, if any |
| rulesetOverrideId | Unique identifier of the ruleset override containing the rule that matched the packet, if any |
| sampleInterval | ABR sample interval |
| sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
| sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
| sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
| sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
| sourcePort | Value of the Source Port header field in the TCP or UDP packet |
| tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
| tcpChecksum | Value of the Checkusm header field in the TCP packet |
| tcpDataOffset | Value of the Data Offset header field in the TCP packet |
| tcpFlags | Value of the Flags header field in the TCP packet |
| tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
| tcpMss | Value of the MSS option header field in the TCP packet |
| tcpOptions | List of Options numbers included in the TCP packet header |
| tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
| tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
| tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
| tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
| tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
| tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
| tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
| tcpWindowSize | Value of the Window Size header field in the TCP packet |
| udpChecksum | Value of the Checkusm header field in the UDP packet |
| udpPayloadLength | Value of the Payload Length header field in the UDP packet |
| verdict | The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop) |
AccountDosdNetworkAnalyticsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountDosdNetworkAnalyticsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountDosdNetworkAnalyticsAdaptiveGroupsSum
| Field | Description |
|---|---|
| bits | Sum of bits received |
| packets | Sum of packets received |
AccountDurableObjectsInvocationsAdaptiveGroups
Durable Objects invocations with adaptive sampling
| Field | Description |
|---|---|
| avg | The average value used for sample interval |
| dimensions | List of dimensions to group by |
| max | The max value for a metric |
| min | The min value for a metric |
| quantiles | Quantiles of a metric per dimension |
| sum | The sum of values for a metric per dimension |
AccountDurableObjectsInvocationsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval |
AccountDurableObjectsInvocationsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | Request datetime, truncated to start of a day |
| datetime | Request datetime |
| datetimeHour | Request datetime, truncated to start of an hour |
| datetimeMinute | Request datetime, truncated to start of a minute |
| environmentName | The name of the script environment |
| namespaceId | Durable Object namespace ID |
| objectId | Durable Object ID as a hex string |
| scriptName | The name of the script |
| status | Status of the worker invocation |
AccountDurableObjectsInvocationsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountDurableObjectsInvocationsAdaptiveGroupsMax
| Field | Description |
|---|---|
| responseBodySize | Maximum response body size for one request - bytes |
| wallTime | Maximum wall time for one request - microseconds |
AccountDurableObjectsInvocationsAdaptiveGroupsMin
| Field | Description |
|---|---|
| responseBodySize | Minimum response body size for one request - bytes |
| wallTime | Minimum wall time for one request - microseconds |
AccountDurableObjectsInvocationsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountDurableObjectsInvocationsAdaptiveGroupsQuantiles
| Field | Description |
|---|---|
| responseBodySizeP25 | Response body size 25th percentile - bytes |
| responseBodySizeP50 | Response body size 50th percentile - bytes |
| responseBodySizeP75 | Response body size 75th percentile - bytes |
| responseBodySizeP90 | Response body size 90th percentile - bytes |
| responseBodySizeP99 | Response body size 99th percentile - bytes |
| responseBodySizeP999 | Response body size 99.9th percentile - bytes |
| wallTimeP25 | Wall time 25th percentile - microseconds |
| wallTimeP50 | Wall time 50th percentile - microseconds |
| wallTimeP75 | Wall time 75th percentile - microseconds |
| wallTimeP90 | Wall time 90th percentile - microseconds |
| wallTimeP99 | Wall time 99th percentile - microseconds |
| wallTimeP999 | Wall time 99.9th percentile - microseconds |
AccountDurableObjectsInvocationsAdaptiveGroupsSum
| Field | Description |
|---|---|
| errors | Sum of errors |
| requests | Sum of requests |
| responseBodySize | Sum of response body sizes |
| wallTime | Sum of wall time |
AccountDurableObjectsPeriodicGroups
Durable Objects periodic metrics
| Field | Description |
|---|---|
| dimensions | List of dimensions to group by |
| max | The max value for a metric |
| sum | The sum of values for a metric per dimension |
AccountDurableObjectsPeriodicGroupsDimensions
| Field | Description |
|---|---|
| date | Datetime the metrics period started, truncated to start of a day |
| datetimeHour | Datetime the metrics period started, truncated to start of an hour |
| datetimeMinute | Datetime the metrics period started, truncated to start of a minute |
| namespaceId | Durable Object namespace ID |
| objectId | Durable Object ID as a hex string |
AccountDurableObjectsPeriodicGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountDurableObjectsPeriodicGroupsMax
| Field | Description |
|---|---|
| activeWebsocketConnections | Maximum active websocket connections in the time window |
AccountDurableObjectsPeriodicGroupsOrderBy
| Field | Description |
|---|---|
AccountDurableObjectsPeriodicGroupsSum
| Field | Description |
|---|---|
| activeTime | Sum of active time - microseconds |
| cpuTime | Sum of CPU time - microseconds |
| duration | Sum of Duration - GB*s |
| exceededCpuErrors | Sum of CPU exceeded errors |
| exceededMemoryErrors | Sum of memory exceeded errors |
| fatalInternalErrors | Sum of fatal internal server errors |
| inboundWebsocketMsgCount | Sum of incoming websocket messages |
| outboundWebsocketMsgCount | Sum of outbound websocket messages |
| rowsRead | Sum of rows read (by sqlite backed DOs) |
| rowsWritten | Sum of rows written (by sqlite backed DOs) |
| storageDeletes | Sum of storage deletes (by non-sqlite backed DOs) |
| storageReadUnits | Sum of storage reads - in 4KB units (by non-sqlite backed DOs) |
| storageWriteUnits | Sum of storage writes - in 4KB units (by non-sqlite backed DOs) |
| subrequests | Sum of subrequests |
AccountDurableObjectsStorageGroups
Durable Objects storage metrics
| Field | Description |
|---|---|
| dimensions | List of dimensions to group by |
| max | The sum of values for a metric per dimension |
AccountDurableObjectsStorageGroupsDimensions
| Field | Description |
|---|---|
| date | Datetime that the storage usage was recorded, truncated to start of a day |
| datetimeHour | Datetime that the storage usage was recorded, truncated to start of an hour |
AccountDurableObjectsStorageGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountDurableObjectsStorageGroupsMax
| Field | Description |
|---|---|
| storedBytes | Max of stored bytes |
AccountDurableObjectsStorageGroupsOrderBy
| Field | Description |
|---|---|
AccountDurableObjectsSubrequestsAdaptiveGroups
Durable Objects subrequests with adaptive sampling
| Field | Description |
|---|---|
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountDurableObjectsSubrequestsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| date | Request datetime, truncated to start of a day |
| datetime | Request datetime |
| datetimeHour | Request datetime, truncated to start of an hour |
| datetimeMinute | Request datetime, truncated to start of a minute |
| environmentName | The name of the script environment |
| namespaceId | Durable Object namespace ID |
| objectId | Durable Object ID as a hex string |
| scriptName | The name of the script |
AccountDurableObjectsSubrequestsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountDurableObjectsSubrequestsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountDurableObjectsSubrequestsAdaptiveGroupsSum
| Field | Description |
|---|---|
| requestBodySizeUncached | Outgoing Durable Objects fetch request body size in bytes where the request was not cached |
AccountFbmAttackAnalyticsGroups
FBM analytics metadata for attacks detected by dosd
| Field | Description |
|---|---|
| attackId | Unique identifier of the mitigation that matched the packet, if any |
| attackType | DEPRECATED (Use attackVector for a richer description of the attack): Type of attack traffic |
| attackVector | Description of attack vector |
| bits | Sum of bits received during the attack |
| commonTcpFlags | Common TCP flags used by attack traffic, if any |
| commonTcpFlagsNames | Names of common TCP flags used by attack traffic, if any |
| destinationIp | Fixed destination IP used by attack traffic, if any |
| destinationPort | Fixed destination port used by attack traffic, if any |
| droppedBits | Sum of bits dropped during the attack |
| droppedPackets | Sum of packets dropped during the attack |
| endDatetime | Date and time that the attack ended; not available for ongoing attacks |
| ipProtocol | Fixed protocol used by attack traffic, if any |
| ipProtocolName | Fixed protocol used by attack traffic, if any |
| mitigationReason | Type of mitigation applied to attack traffic |
| mitigationScope | Whether mitigation was applied in only some locations or globally |
| mitigationType | Type of mitigation applied to attack traffic |
| packets | Sum of packets received during the attack |
| ruleId | Unique identifier of the rule that matched the packet, if any |
| ruleName | Human-readable name of the rule that matched the packet, if any |
| rulesetId | Unique identifier of the ruleset containing the rule that matched the packet, if any |
| rulesetOverrideId | Unique identifier of the ruleset override containing the rule that matched the packet, if any |
| sourceIp | Fixed source IP used by attack traffic, if any |
| sourcePort | Fixed source port used by attack traffic, if any |
| startDatetime | Date and time that the attack started |
| tcpFlags | Fixed TCP flags used by attack traffic, if any |
| tcpFlagsNames | Names of fixed TCP flags used by attack traffic, if any |
AccountFbmAttackAnalyticsGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountFbmAttackAnalyticsGroupsOrderBy
| Field | Description |
|---|---|
AccountFilter_InputObject
| Field | Description |
|---|---|
AccountFirewallEventsAdaptive
Raw Firewall events with adaptive sampling
| Field | Description |
|---|---|
| action | The code of the first-class action the Cloudflare Firewall took on this request |
| apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
| apiGatewayMatchedHost | API Gateway host matched at the edge |
| botDetectionIds | Array of detections ids that matched this request |
| botDetectionTags | Array of detections tags that matched this request |
| botScore | The final score originated from bot management detections. |
| botScoreSrcName | Name of the source detection which generated the bot management score. |
| clientASNDescription | The ASN of the visitor as string |
| clientAsn | The ASN number of the visitor |
| clientCountryName | Country from which request originated |
| clientIP | The visitor's IP address (IPv4 or IPv6) |
| clientIPClass | The classification of the visitor's IP address, possible values are: unknown | clean | badHost | searchEngine | allowlist | greylist | monitoringService | securityScanner | noRecord | scan | backupService | mobilePlatform | tor |
| clientRefererHost | The referer host |
| clientRefererPath | The referer path requested by visitor |
| clientRefererQuery | The referer query-string was requested by the visitor |
| clientRefererScheme | The referer url scheme requested by the visitor |
| clientRequestHTTPHost | The HTTP hostname requested by the visitor |
| clientRequestHTTPMethodName | The HTTP method used by the visitor |
| clientRequestHTTPProtocol | The version of HTTP protocol requested by the visitor |
| clientRequestPath | The path requested by visitor |
| clientRequestQuery | The query-string was requested by the visitor |
| clientRequestScheme | The url scheme requested by the visitor |
| contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
| contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
| contentScanNumObj | Number of scannable content objects |
| contentScanObjResults | Array of scan results in order of detection |
| contentScanObjSizes | Array of scan sizes in order of detection |
| contentScanObjTypes | Array of content types in order of detection |
| date | The date the event occurred at the edge |
| datetime | The date and time the event occurred at the edge |
| datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
| datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
| datetimeHour | The date and time the event occurred at the edge truncated to hours |
| datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
| description | The description of the rule triggered by this request |
| edgeColoName | The airport code of the Cloudflare datacenter that served this request |
| edgeResponseStatus | HTTP response status code returned to browser |
| httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application |
| ja3Hash | MD5 hash of the JA3 TLS fingerprint |
| ja4 | JA4 TLS fingerprint |
| ja4Signals | Inter-request statistics computed for this JA4 across Cloudflare's entire global edge network |
| kind | The kind of event, currently only possible values are: firewall |
| leakedCredentialCheckResult | The distinct result of checking for leaked credentials |
| matchIndex | Rules match index in the chain |
| metadata | Additional product-specific information. Metadata is organized in key:value pairs |
| originResponseStatus | HTTP origin response status code returned to browser |
| originatorRayName | The RayId of the request that issued the challenge/jschallenge |
| rayName | The RayId of the request |
| ref | The ref-field is a user-defined rule identifier that can be set via the API for some firewall products and allows users to label their rules individually alongside cloudflare provided identifiers (only available to entitled customers) |
| ruleId | The Cloudflare security product-specific RuleId triggered by this request |
| rulesetId | The Cloudflare security product-specific RulesetId triggered by this request |
| sampleInterval | ABR sample interval |
| source | The Cloudflare security product triggered by this request |
| userAgent | visitor's user-agent string |
| wafAttackScore | Beta. Overall request score generated by the WAF detection module |
| wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
| wafMlAttackScore | DEPRECATED (Field is replaced with wafAttackScore): Beta. Overall request score generated by the WAF detection module |
| wafMlSqliAttackScore | DEPRECATED (Field is replaced with wafSqliAttackScore): Beta. WAF ML score for an SQLi attack |
| wafMlXssAttackScore | DEPRECATED (Field is replaced with wafXssAttackScore): Beta. WAF ML score for an XSS attack |
| wafRceAttackScore | Beta. WAF score for a RCE attack |
| wafSqliAttackScore | Beta. WAF score for a SQLi attack |
| wafXssAttackScore | Beta. WAF score for a XSS attack |
| zoneTag | Associated zone |
| zoneVersion | The version of a zone |
AccountFirewallEventsAdaptiveFilter_InputObject
| Field | Description |
|---|---|
AccountFirewallEventsAdaptiveGroups
Aggregated Firewall events with adaptive sampling
| Field | Description |
|---|---|
| avg | The average value used for sample interval |
| count | The sum of sample interval values |
| dimensions | List of dimensions to group by |
| sum |
AccountFirewallEventsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval |
AccountFirewallEventsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| action | The code of the first-class action the Cloudflare Firewall took on this request |
| apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
| apiGatewayMatchedHost | API Gateway host matched at the edge |
| botDetectionIds | Array of detections ids that matched this request |
| botDetectionTags | Array of detections tags that matched this request |
| botScore | The final score originated from bot management detections. |
| botScoreSrcName | Name of the source detection which generated the bot management score. |
| clientASNDescription | The ASN of the visitor as string |
| clientAsn | The ASN number of the visitor |
| clientCountryName | Country from which request originated |
| clientIP | The visitor's IP address (IPv4 or IPv6) |
| clientIPClass | The classification of the visitor's IP address, possible values are: unknown | clean | badHost | searchEngine | allowlist | greylist | monitoringService | securityScanner | noRecord | scan | backupService | mobilePlatform | tor |
| clientRefererHost | The referer host |
| clientRefererPath | The referer path requested by visitor |
| clientRefererQuery | The referer query-string was requested by the visitor |
| clientRefererScheme | The referer url scheme requested by the visitor |
| clientRequestHTTPHost | The HTTP hostname requested by the visitor |
| clientRequestHTTPMethodName | The HTTP method used by the visitor |
| clientRequestHTTPProtocol | The version of HTTP protocol requested by the visitor |
| clientRequestPath | The path requested by visitor |
| clientRequestQuery | The query-string was requested by the visitor |
| clientRequestScheme | The url scheme requested by the visitor |
| contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
| contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
| contentScanNumObj | Number of scannable content objects |
| contentScanObjResults | Array of scan results in order of detection |
| contentScanObjSizes | Array of scan sizes in order of detection |
| contentScanObjTypes | Array of content types in order of detection |
| date | The date the event occurred at the edge |
| datetime | The date and time the event occurred at the edge |
| datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
| datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
| datetimeHour | The date and time the event occurred at the edge truncated to hours |
| datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
| description | The description of the rule triggered by this request |
| edgeColoName | The airport code of the Cloudflare datacenter that served this request |
| edgeResponseStatus | HTTP response status code returned to browser |
| httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application |
| ja3Hash | MD5 hash of the JA3 TLS fingerprint |
| ja4 | JA4 TLS fingerprint |
| kind | The kind of event, currently only possible values are: firewall |
| matchIndex | Rules match index in the chain |
| originResponseStatus | HTTP origin response status code returned to browser |
| originatorRayName | The RayId of the request that issued the challenge/jschallenge |
| rayName | The RayId of the request |
| ref | The ref-field is a user-defined rule identifier that can be set via the API for some firewall products and allows users to label their rules individually alongside cloudflare provided identifiers (only available to entitled customers) |
| ruleId | The Cloudflare security product-specific RuleId triggered by this request |
| rulesetId | The Cloudflare security product-specific RulesetId triggered by this request |
| sampleInterval | ABR sample interval |
| source | The Cloudflare security product triggered by this request |
| userAgent | visitor's user-agent string |
| wafAttackScore | Beta. Overall request score generated by the WAF detection module |
| wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
| wafMlAttackScore | DEPRECATED (Field is replaced with wafAttackScore): Beta. Overall request score generated by the WAF ML detection module |
| wafMlSqliAttackScore | DEPRECATED (Field is replaced with wafSqliAttackScore): Beta. WAF ML score for an SQLi attack |
| wafMlXssAttackScore | DEPRECATED (Field is replaced with wafXssAttackScore): Beta. WAF ML score for an XSS attack |
| wafRceAttackScore | Beta. WAF score for a RCE attack |
| wafSqliAttackScore | Beta. WAF score for a SQLi attack |
| wafXssAttackScore | Beta. WAF score for a XSS attack |
| zoneTag | Associated zone |
| zoneVersion | The version of a zone |
AccountFirewallEventsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountFirewallEventsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountFirewallEventsAdaptiveGroupsSum
| Field | Description |
|---|---|
| botDetectionIdArray | Array of bot management detection ids |
| botDetectionIdCountArray | Count array of bot management detection ids. Elements in this array correspond to elements in botDetectionIdArray by index. |
| botDetectionTagArray | Array of bot management detection tags |
| botDetectionTagCountArray | Count array of bot management detection tags. Elements in this array correspond to elements in botDetectionTagArray by index. |
AccountFirewallEventsAdaptiveJa4SignalsElem
| Field | Description |
|---|---|
| signalName | Signal name |
| signalValue | Signal value |
AccountFirewallEventsAdaptiveMetadataElem
| Field | Description |
|---|---|
| key | The key of the metadata. Key format can vary by Cloudflare security product and can change over time. |
| value | The value of the metadata. Value format can vary by Cloudflare security product and can change over time. |
AccountFirewallEventsAdaptiveOrderBy
| Field | Description |
|---|---|
AccountFlowtrackdNetworkAnalyticsAdaptiveGroups
Network analytics data for flowtrackd
| Field | Description |
|---|---|
| avg | The average of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| bitRate | Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime |
| bitRateDay | Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date |
| bitRateFifteenMinutes | Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes |
| bitRateFiveMinutes | Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes |
| bitRateHour | Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour |
| bitRateMinute | Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute |
| bitRateTenSeconds | Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds |
| packetRate | Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime |
| packetRateDay | Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date |
| packetRateFifteenMinutes | Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes |
| packetRateFiveMinutes | Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes |
| packetRateHour | Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour |
| packetRateMinute | Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute |
| packetRateTenSeconds | Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds |
AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| applicationTag | Application tag associated with the packet |
| coloCity | City where the Cloudflare datacenter that received the packet is located |
| coloCode | Cloudflare datacenter that received the packet (nearest IATA airport code) |
| coloCountry | Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2) |
| coloGeohash | Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding) |
| coloName | Cloudflare datacenter that received the packet (unique site identifier) |
| date | Date that the packet was received |
| datetime | Date and time that the packet was received |
| datetimeFifteenMinutes | Date and time that the packet was received, rounded to the start of the nearest fifteen minutes |
| datetimeFiveMinutes | Date and time that the packet was received, rounded to the start of the nearest five minutes |
| datetimeHour | Date and time that the packet was received, rounded to the start of the nearest hour |
| datetimeMinute | Date and time that the packet was received, rounded to the start of the nearest minute |
| datetimeTenSeconds | Date and time that the packet was received, rounded to the start of the nearest ten seconds |
| destinationAsn | ASN associated with the destination IP of the packet, or 0 if there was no mapping available |
| destinationAsnName | Name of ASN associated with the destination IP of the packet, if available |
| destinationCountry | Country where the destination IP of the packet is located (ISO 3166-1 alpha-2) |
| destinationGeohash | Latitude and longitude where the destination IP of the packet is located (Geohash encoding) |
| destinationPort | Value of the Destination Port header field in the TCP or UDP packet |
| direction | Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral) |
| ethertype | Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6) |
| greChecksum | Value of the Checkusm header field in the GRE packet |
| greEthertype | Value of the Ethertype header field in the GRE packet |
| greHeaderLength | Length of the GRE packet header, in bytes |
| greKey | Value of the Key header field in the GRE packet |
| greSequenceNumber | Value of the Sequence Number header field in the GRE packet |
| greVersion | Value of the Version header field in the GRE packet |
| icmpChecksum | Value of the Checkusm header field in the ICMP packet |
| icmpCode | Value of the Code header field in the ICMP packet |
| icmpType | Value of the Type header field in the ICMP packet |
| ipDestinationAddress | Value of the Destination Address header field in the IPv4 or IPv6 packet |
| ipDestinationSubnet | Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipFragmentOffset | Value of the Fragment Offset header field in the IPv4 or IPv6 packet |
| ipHeaderLength | Length of the IPv4 or IPv6 packet header, in bytes |
| ipMoreFragments | Value of the More Fragments header field in the IPv4 or IPv6 packet |
| ipProtocol | Value of the Protocol header field in the IPv4 or IPv6 packet |
| ipProtocolName | Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet |
| ipSourceAddress | Value of the Source Address header field in the IPv4 or IPv6 packet |
| ipSourceSubnet | Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6) |
| ipTotalLength | Total length of the IPv4 or IPv6 packet, in bytes |
| ipTotalLengthBuckets | Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated |
| ipTtl | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet |
| ipTtlBuckets | Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated |
| ipv4Checksum | Value of the Checksum header field in the IPv4 packet |
| ipv4DontFragment | Value of the Don't Fragment header field in the IPv4 packet |
| ipv4Dscp | Value of the Differentiated Services Code Point header field in the IPv4 packet |
| ipv4Ecn | Value of the Explicit Congestion Notification header field in the IPv4 packet |
| ipv4Identification | Value of the Identification header field in the IPv4 packet |
| ipv4Options | List of Options numbers included in the IPv4 packet header |
| ipv6Dscp | Value of the Differentiated Services Code Point header field in the IPv6 packet |
| ipv6Ecn | Value of the Explicit Congestion Notification header field in the IPv6 packet |
| ipv6ExtensionHeaders | List of Extension Header numbers included in the IPv6 packet header |
| ipv6FlowLabel | Value of the Flow Label header field in the IPv6 packet |
| ipv6Identification | Value of the Identification extension header field in the IPv6 packet |
| leaseTag | IP lease tag associated with the packet |
| mitigationReason | Reason for applying a mitigation to the packet, if any |
| mitigationScope | Whether the packet matched a local or global mitigation, if any (possible values: local, global) |
| outcome | The action that was taken on the packet (possible values: pass, drop) |
| prefixTag | IP prefix tag associated with the packet |
| protocolState | State of the packet in the context of the protocol, if available |
| sampleInterval | ABR sample interval |
| sourceAsn | ASN associated with the source IP of the packet, or 0 if there was no mapping available |
| sourceAsnName | Name of ASN associated with the source IP of the packet, if available |
| sourceCountry | Country where the source IP of the packet is located (ISO 3166-1 alpha-2) |
| sourceGeohash | Latitude and longitude where the source IP of the packet is located (Geohash encoding) |
| sourcePort | Value of the Source Port header field in the TCP or UDP packet |
| tcpAcknowledgementNumber | Value of the Acknowledgement Number header field in the TCP packet |
| tcpChecksum | Value of the Checkusm header field in the TCP packet |
| tcpDataOffset | Value of the Data Offset header field in the TCP packet |
| tcpFlags | Value of the Flags header field in the TCP packet |
| tcpFlagsString | Human-readable string representation of the Flags header field in the TCP packet |
| tcpMss | Value of the MSS option header field in the TCP packet |
| tcpOptions | List of Options numbers included in the TCP packet header |
| tcpSackBlocks | Value of the SACK Blocks option header field in the TCP packet |
| tcpSackPermitted | Value of the SACK Permitted option header field in the TCP packet |
| tcpSequenceNumber | Value of the Sequence Number header field in the TCP packet |
| tcpTimestampEcr | Value of the Timestamp Echo Reply option header field in the TCP packet |
| tcpTimestampValue | Value of the Timestamp option header field in the TCP packet |
| tcpUrgentPointer | Value of the Urgent Pointer header field in the TCP packet |
| tcpWindowScale | Value of the Window Scale option header field in the TCP packet |
| tcpWindowSize | Value of the Window Size header field in the TCP packet |
| udpChecksum | Value of the Checkusm header field in the UDP packet |
| udpPayloadLength | Value of the Payload Length header field in the UDP packet |
| verdict | The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop) |
AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsSum
| Field | Description |
|---|---|
| bits | Sum of bits received |
| packets | Sum of packets received |
AccountGatewayL4DownstreamSessionsAdaptiveGroups
Aggregated metrics about downstream (client to edge) L4 Gateway Sessions. Metrics are reported on TCP or UDP session close
| Field | Description |
|---|---|
| count | The number of downstream sessions |
| dimensions | List of dimensions to group by |
| quantiles | |
| sum |
AccountGatewayL4DownstreamSessionsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| coloCode | IATA Airport code that represents the city in which a Cloudflare data center (colo) is located |
| coloCountry | ISO 3166-1 alpha-2 code that represents the country in which a Cloudflare data center (colo) is located |
| date | Start timestamp of this session, truncated to date |
| datetimeFifteenMinutes | Start timestamp of this session, truncated to multiple of 15 minutes |
| datetimeFiveMinutes | Start timestamp of this session, truncated to multiple of 5 minutes |
| datetimeHour | Start timestamp of this session, truncated to the hour |
| datetimeMinute | Start timestamp of this session, truncated to the minute |
| quicErrorCode | QUIC specific error code. Possible values are https://www.iana.org/assignments/quic/quic.xhtml#quic-transport-error-codes |
| rttUs | Last Round Trip Time estimation for this session in microseconds |
| sessionId | Identifier for this session |
| sourceIP | IP address of the client making this session |
| tokenAuthStatus | Client token authentication status. Possible values are success | failed with invalid token and upto date token key ID | failed with invalid token due to outdated/missing token key ID | failed due to reused token |
| tokenSigningRegion | Broad location assigned to client in this session |
| transport | Transport protocol used for this session. Possible values are tcp | quic | udp |
| transportHandshakeDurationUs | Time taken for TCP/TLS or QUIC handshake in microsecond |
| transportStatus | Transport Status. Possible values are unknown | success | failure |
AccountGatewayL4DownstreamSessionsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountGatewayL4DownstreamSessionsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountGatewayL4DownstreamSessionsAdaptiveGroupsQuantiles
| Field | Description |
|---|---|
| tokenAuthDurationUsP50 | Time taken for Client Token Authentication in microseconds |
| transportHandshakeDurationUsP50 | Time taken for TCP/TLS or QUIC handshake in microseconds |
AccountGatewayL4DownstreamSessionsAdaptiveGroupsSum
| Field | Description |
|---|---|
| bytesRecvd | Total bytes received in this session |
| bytesSent | Total bytes sent in this session |
| clientBytesRetransmitted | Total bytes retransmitted by client in this session |
| packetsRecvd | Total number of packets received in this session |
| packetsSent | Total number of packets sent in this session |
| tokenAuthDurationUs | Time taken for client token authentication in microseconds |
AccountGatewayL4SessionsAdaptiveGroups
BETA - Aggregate counts of Gateway L4 sessions with adaptive sampling
| Field | Description |
|---|---|
| count | The number of Gateway L4 sessions |
| dimensions | List of dimensions to group by |
AccountGatewayL4SessionsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| action | action taken by gateway |
| applicationIds | IDs of the applications that matched the session parameters |
| applicationNames | Names of the applications that matched the session parameters |
| coloCode | Colo Code of edge server |
| datetime | Datetime that the session was started |
| datetimeHour | Datetime that the session was started truncated to hours |
| datetimeMinute | Datetime that the session was started truncated to minutes |
| destinationIp | The destination IP address for the session |
| destinationPort | The destination port for the session |
| detectedProtocol | The detected protocol of network traffic |
| deviceId | The device ID of the gateway user who initiated the session |
| dstIpContinent | Continent code of the session destination IP address |
| dstIpCountry | Country code of the session destination IP address |
| The email address of the gateway user who initiated the session | |
| proxyEndpoint | The proxy endpoint used on this session |
| sessionId | The network session unique identifier |
| sni | The SNI pulled from the session tls handshake, if present |
| sourceInternalIp | Local LAN IP of the device. Only available when connected via a GRE/IPsec tunnel on-ramp |
| sourceIp | The source IP address for the session |
| sourcePort | The source port for the session |
| srcIpContinent | Continent code of the session source IP address |
| srcIpCountry | Country code of the session source IP address |
| transport | DEPRECATED (Field is replaced with transportProtocol): The transport protocol used in the session, one of (0, tcp) (1, quic) (2, udp). Deprecated, please use transportProtocol |
| transportProtocol | The transport protocol used in the session, one of (0, tcp) (1, quic) (2, udp) |
| userId | The ID of the gateway user who initiated the session |
| virtualNetworkId | The ID of the virtual nework the device was connected to |
| virtualNetworkName | The name of the virtual nework the device was connected to |
AccountGatewayL4SessionsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountGatewayL4SessionsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountGatewayL4UpstreamSessionsAdaptiveGroups
Aggregated metrics about upstream (edge to client) L4 Gateway Sessions. Metrics are reported on TCP, QUIC or UDP session close
| Field | Description |
|---|---|
| count | The number of upstream sessions |
| dimensions | List of dimensions to group by |
| quantiles | |
| sum |
AccountGatewayL4UpstreamSessionsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| coloCode | IATA Airport code that represents the city in which a Cloudflare data center (colo) is located |
| coloCountry | ISO 3166-1 alpha-2 code that represents the country in which a Cloudflare data center (colo) is located |
| date | Start timestamp of this session, truncated to date |
| datetimeFifteenMinutes | Start timestamp of this session, truncated to multiple of 15 minutes |
| datetimeFiveMinutes | Start timestamp of this session, truncated to multiple of 5 minutes |
| datetimeHour | Start timestamp of this session, truncated to the hour |
| datetimeMinute | Start timestamp of this session, truncated to the minute |
| destinationIP | IP address of the origin server |
| domainName | SNI domain name for this session |
| downstreamSessionId | Downstream session identifier of this session |
| httpConnectReqStatus | Client HTTP CONNECT request status. Possible values are unknown | success | failure |
| quicErrorCode | QUIC error code. Possible values are https://www.iana.org/assignments/quic/quic.xhtml#quic-transport-error-codes |
| rttUs | Last Round Trip Time estimation for this session in microseconds |
| tokenSigningRegion | Broad location assigned to client in this session |
| totalTunnelSetupDurationUs | Total time taken for tunnel setup in microseconds |
| transport | Transport protocol used for this session. Possible values are tcp | quic | udp |
| transportStatus | Transport status. Possible values are unknown | success | failure |
AccountGatewayL4UpstreamSessionsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountGatewayL4UpstreamSessionsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountGatewayL4UpstreamSessionsAdaptiveGroupsQuantiles
| Field | Description |
|---|---|
| connectReqHandlingDurationUsP50 | Time taken for CONNECT request handling in microseconds |
| totalTunnelSetupDurationUsP50 | Total time taken for tunnel setup in microseconds |
| tunnelSetupDurationUsP50 | Time taken to setup the tunnel in microseconds |
AccountGatewayL4UpstreamSessionsAdaptiveGroupsSum
| Field | Description |
|---|---|
| bytesRecvd | Total bytes received in this session |
| bytesSent | Total bytes sent in this session |
| connectReqHandlingDurationUs | Time taken for CONNECT request handling in microseconds |
| originBytesRetransmitted | Total bytes retransmitted by origin in this session |
| packetsRecvd | Total number of packets received in this session |
| packetsSent | Total number of packets sent in this session |
| totalTunnelSetupDurationUs | Total time taken for tunnel setup in microseconds |
| tunnelSetupDurationUs | Time taken for tunnel setup in microseconds |
AccountGatewayL7RequestsAdaptiveGroups
BETA - Aggregate counts of Gateway L7 requests with adaptive sampling
| Field | Description |
|---|---|
| count | The number of Gateway L7 requests |
| dimensions | List of dimensions to group by |
AccountGatewayL7RequestsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| action | action taken by gateway |
| applicationIds | IDs of the applications that matched the request parameters |
| applicationNames | Names of the applications that matched the request parameters |
| categoryIds | IDs of the categories that matched the request parameters |
| categoryNames | Names of the categories that matched the request parameters |
| coloCode | Colo Code of edge server |
| datetime | Datetime that the request happened |
| datetimeHour | Datetime that the request happened truncated to hours |
| datetimeMinute | Datetime that the request happened truncated to minutes |
| deviceId | The device ID of the gateway user who made the request |
| dstIpContinent | Continent code of the request destination IP address |
| dstIpCountry | Country code of the request destination IP address |
| The email address of the gateway user who made the request | |
| httpHost | The destination host for the request |
| httpStatusCode | HTTP status code gateway returned to the user. 0 if nothing was returned(e.g client disconnected) |
| isIsolated | Indicates whether this request was made through an isolated link |
| privateAppAUD | Access private app AUD |
| proxyEndpoint | The proxy endpoint used on this request |
| quarantined | Indicates if the request content was quarantined |
| requestId | The request unique identifier |
| sourceInternalIp | Local LAN IP of the device. Only available when connected via a GRE/IPsec tunnel on-ramp |
| srcIpContinent | Continent code of the request source IP address |
| srcIpCountry | Country code of the request source IP address |
| untrustedCertificateAction | Action taken when an untrusted origin certificate error occurs |
| url | The request URL |
| userId | The ID of the gateway user who made the request |
| virtualNetworkId | The ID of the virtual nework the device was connected to |
| virtualNetworkName | The name of the virtual nework the device was connected to |
AccountGatewayL7RequestsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountGatewayL7RequestsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountGatewayResolverByCategoryAdaptiveGroups
BETA - Aggregate counts of Gateway Resolver queries by category with adaptive sampling
| Field | Description |
|---|---|
| count | The number of Gateway Resolver queries |
| dimensions | List of dimensions to group by |
AccountGatewayResolverByCategoryAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| authoritativeNameserverIps | List of IPs of the authoritative nameservers that provided the answers, if any |
| categoryId | ID of the category that was assigned to the domain |
| cnames | List of resolved intermediate cname domains |
| datetime | The date and time the DNS query was resolved |
| datetimeHour | The date and time the event occurred at the edge truncated to hours |
| datetimeMinute | The date and time the event occurred at the edge truncated to minutes |
| dohSubdomain | The destination DoH subdomain the DNS query was made to |
| dotSubdomain | The destination DoT subdomain the DNS query was made to |
| edeErrors | List of returned Extended DNS Error Codes |
| locationId | The uuid identifying the customer Location used when resolving |
| matchedApplicationId | ID of the application the domain belongs to |
| matchedApplicationName | Name of the application the domain belongs to |
| policyId | ID of the policy/rule that was applied, if any |
| policyName | Name of the policy that was applied, if any |
| resolvedIpContinents | Continent code of each resolved IP, if any |
| resolvedIpCountries | Country code of each resolved IP, if any |
| resolvedIps | List of resolved IPs in the response, if any |
| resolverDecision | Enum identifier for the decision made by gateway-resolver, one of: (0, unknown) (1, allowedByQueryName) (2, blockedByQueryName) (3, blockedByCategory) (4, allowedOnNoLocation) (5, allowedOnNoPolicyMatch) (6, blockedAlwaysCategory) (7, overrideForSafeSearch) (8, overrideApplied) (9, blockedRule) (10, allowedRule) |
| resourceRecordClasses | Resource records' classes |
| resourceRecordNames | Resource records' names |
| resourceRecordRDatas | Resource records' rdata values |
| resourceRecordTTLs | Resource records' TTL values |
| resourceRecordTypes | Resource records' types |
| srcIpContinent | Continent code of the source IP address making the DNS query |
| srcIpCountry | Country code of the source IP address making the DNS query |
AccountGatewayResolverByCategoryAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountGatewayResolverByCategoryAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountGatewayResolverByCustomResolverGroups
Stats on dns custom resolvers
| Field | Description |
|---|---|
| avg | The average value for a metric |
| count | The number of Gateway Resolver queries |
| dimensions | List of dimensions to group by |
| max | Maximum response time |
AccountGatewayResolverByCustomResolverGroupsAvg
| Field | Description |
|---|---|
| customResolverTimeInMs | Average latency |
| sampleInterval | Average sample interval |
AccountGatewayResolverByCustomResolverGroupsDimensions
| Field | Description |
|---|---|
| cacheStatus | whether the response was cached or not |
| customResolverAddress | address at which custom resolver query was resolved at |
| customResolverResponseCode | Response code recieved from the custom resolver 0 => unknown 27 => dnsFirewallSuccess 29 => dnsFirewallCustomerRatelimit 31 => dnsFirewallUpstreamFailure 32 => dnsFirewallUpstreamServfail |
| customResolverTimeInMs | time took for custom resolver to respond |
| datetime | The date and time the DNS query was resolved |
| locationId | The uuid identifying the customer Location used when resolving |
| queryName | Name of the query, e.g. one.dash.cloudflare.com |
| resolverDecision | Enum identifier for the decision made by gateway-resolver, one of: (0, unknown) (1, allowedByQueryName) (2, blockedByQueryName) (3, blockedByCategory) (4, allowedOnNoLocation) (5, allowedOnNoPolicyMatch) (6, blockedAlwaysCategory) (7, overrideForSafeSearch) (8, overrideApplied) (9, blockedRule) (10, allowedRule) |
AccountGatewayResolverByCustomResolverGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountGatewayResolverByCustomResolverGroupsMax
| Field | Description |
|---|---|
| customResolverTimeInMs | Maximum response time |
AccountGatewayResolverByCustomResolverGroupsOrderBy
| Field | Description |
|---|---|
AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroups
Total time spent on executing firewall rules at the edge
| Field | Description |
|---|---|
| avg | The average value for a metric per dimension |
| count | The number of Gateway Resolver queries |
| dimensions | List of dimensions to group by |
| max | Maximum execution time |
| quantiles | Quantiles of a rule execution performance |
AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsAvg
| Field | Description |
|---|---|
| sampleInterval | Average sample interval |
AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| datetime | Request timestamp |
| datetimeMonth | Request timestamp month |
AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsMax
| Field | Description |
|---|---|
| executionTime | Maximum execution time |
AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsQuantiles
| Field | Description |
|---|---|
| executionTimeMsP25 | Execution time performance of 25th percentile in milliseconds |
| executionTimeMsP50 | Execution time performance of 50th percentile in milliseconds |
| executionTimeMsP75 | Execution time performance of 75th percentile in milliseconds |
| executionTimeMsP90 | Execution time performance of 90th percentile in milliseconds |
| executionTimeMsP95 | Execution time performance of 95th percentile in milliseconds |
| executionTimeMsP98 | Execution time performance of 98th percentile in milliseconds |
| executionTimeMsP99 | Execution time performance of 99th percentile in milliseconds |
AccountGatewayResolverQueriesAdaptiveGroups
BETA - Aggregate counts of Gateway Resolver queries with adaptive sampling
| Field | Description |
|---|---|
| count | The number of Gateway Resolver queries |
| dimensions | List of dimensions to group by |
AccountGatewayResolverQueriesAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| authoritativeNameserverIps | List of IPs of the authoritative nameservers that provided the answers, if any |
| categoryIds | Json array of categories for this query |
| categoryNames | List of matching categories names for this query |
| cnames | List of resolved intermediate cname domains |
| datetime | The date and time the DNS query was resolved |
| datetimeHour | The date and time the event occurred at the edge truncated to hours |
| datetimeMinute | The date and time the event occurred at the edge truncated to minutes |
| dohSubdomain | The destination DoH subdomain the DNS query was made to |
| dotSubdomain | The destination DoT subdomain the DNS query was made to |
| edeErrors | List of returned Extended DNS Error Codes |
| locationId | The uuid identifying the customer Location used when resolving |
| locationName | The name identifying the customer Location used when resolving |
| matchedApplicationId | ID of the application the domain belongs to |
| matchedApplicationName | Name of the application the domain belongs to |
| matchedIndicatorFeedIds | Json array of indicator feed IDs for this query that matched rule |
| matchedIndicatorFeedNames | List of indicator feed names for this query |
| policyId | ID of the policy/rule that was applied, if any |
| policyName | Name of the policy that was applied, if any |
| queryName | Name of the query, e.g. one.dash.cloudflare.com |
| queryNameReversed | Name of the query in reverse order, e.g. com.cloudflare.dash.one |
| resolvedIpContinents | Continent code of each resolved IP, if any |
| resolvedIpCountries | Country code of each resolved IP, if any |
| resolvedIps | List of resolved IPs in the response, if any |
| resolverDecision | Enum identifier for the decision made by gateway-resolver, one of: (0, unknown) (1, allowedByQueryName) (2, blockedByQueryName) (3, blockedByCategory) (4, allowedOnNoLocation) (5, allowedOnNoPolicyMatch) (6, blockedAlwaysCategory) (7, overrideForSafeSearch) (8, overrideApplied) (9, blockedRule) (10, allowedRule) |
| resourceRecordClasses | Resource records' classes |
| resourceRecordNames | Resource records' names |
| resourceRecordRDatas | Resource records' rdata values |
| resourceRecordTTLs | Resource records' TTL values |
| resourceRecordTypes | Resource records' types |
| scheduleInfo | Json object of schedule releated information |
| srcIpContinent | Continent code of the source IP address making the DNS query |
| srcIpCountry | Country code of the source IP address making the DNS query |
AccountGatewayResolverQueriesAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountGatewayResolverQueriesAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountHttpRequests1dGroups
Daily rollups of request data
| Field | Description |
|---|---|
| avg | The average value for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
| uniq | The number of unique values for a metric per dimension |
AccountHttpRequests1dGroupsAvg
| Field | Description |
|---|---|
| bytes | |
| sampleInterval | Average sample interval |
AccountHttpRequests1dGroupsBrowserMapElem
| Field | Description |
|---|---|
| pageViews | Successful requests for HTML content |
| uaBrowserFamily | Browser type |
AccountHttpRequests1dGroupsClientHTTPVersionMapElem
| Field | Description |
|---|---|
| clientHTTPProtocol | HTTP version |
| requests |
AccountHttpRequests1dGroupsClientSSLMapElem
| Field | Description |
|---|---|
| clientSSLProtocol | Protocol version |
| requests |
AccountHttpRequests1dGroupsContentTypeMapElem
| Field | Description |
|---|---|
| bytes | Bytes returned to client |
| edgeResponseContentTypeName | Content type returned to client |
| requests |
AccountHttpRequests1dGroupsCountryMapElem
| Field | Description |
|---|---|
| bytes | Bytes returned to client |
| clientCountryName | Country from which request originated |
| requests | |
| threats | Requests classified as threats |
AccountHttpRequests1dGroupsDimensions
| Field | Description |
|---|---|
| date | Request date |
AccountHttpRequests1dGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountHttpRequests1dGroupsIpClassMapElem
| Field | Description |
|---|---|
| ipType | IP class |
| requests |
AccountHttpRequests1dGroupsOrderBy
| Field | Description |
|---|---|
AccountHttpRequests1dGroupsResponseStatusMapElem
| Field | Description |
|---|---|
| edgeResponseStatus | HTTP response status code returned to client |
| requests |
AccountHttpRequests1dGroupsSum
| Field | Description |
|---|---|
| browserMap | |
| bytes | Bytes returned to client |
| cachedBytes | Bytes returned to client from cache |
| cachedRequests | Requests served from cache |
| clientHTTPVersionMap | |
| clientSSLMap | |
| contentTypeMap | |
| countryMap | |
| encryptedBytes | Bytes returned to client using SSL/TLS protocol |
| encryptedRequests | Requests served using SSL/TLS protocol |
| ipClassMap | |
| pageViews | Successful requests for HTML content |
| requests | |
| responseStatusMap | |
| threatPathingMap | |
| threats | Requests classified as threats |
AccountHttpRequests1dGroupsThreatPathingMapElem
| Field | Description |
|---|---|
| requests | |
| threatPathingName | Threat type |
AccountHttpRequests1dGroupsUniq
| Field | Description |
|---|---|
| uniques | A number of unique IPs |
AccountHttpRequests1hGroups
Hourly rollups of request data
| Field | Description |
|---|---|
| avg | The average value for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
| uniq | The number of unique values for a metric per dimension |
AccountHttpRequests1hGroupsAvg
| Field | Description |
|---|---|
| bytes | |
| sampleInterval | Average sample interval |
AccountHttpRequests1hGroupsBrowserMapElem
| Field | Description |
|---|---|
| pageViews | Successful requests for HTML content |
| uaBrowserFamily | Browser type |
AccountHttpRequests1hGroupsClientHTTPVersionMapElem
| Field | Description |
|---|---|
| clientHTTPProtocol | HTTP version |
| requests |
AccountHttpRequests1hGroupsClientSSLMapElem
| Field | Description |
|---|---|
| clientSSLProtocol | Protocol version |
| requests |
AccountHttpRequests1hGroupsContentTypeMapElem
| Field | Description |
|---|---|
| bytes | Bytes returned to client |
| edgeResponseContentTypeName | Content type returned to client |
| requests |
AccountHttpRequests1hGroupsCountryMapElem
| Field | Description |
|---|---|
| bytes | Bytes returned to client |
| clientCountryName | Country from which request originated |
| requests | |
| threats | Requests classified as threats |
AccountHttpRequests1hGroupsDimensions
| Field | Description |
|---|---|
| date | Request date |
| datetime | Request datetime truncated to the hour |
AccountHttpRequests1hGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountHttpRequests1hGroupsIpClassMapElem
| Field | Description |
|---|---|
| ipType | IP class |
| requests |
AccountHttpRequests1hGroupsOrderBy
| Field | Description |
|---|---|
AccountHttpRequests1hGroupsResponseStatusMapElem
| Field | Description |
|---|---|
| edgeResponseStatus | HTTP response status code returned to client |
| requests |
AccountHttpRequests1hGroupsSum
| Field | Description |
|---|---|
| browserMap | |
| bytes | Bytes returned to client |
| cachedBytes | Bytes returned to client from cache |
| cachedRequests | Requests served from cache |
| clientHTTPVersionMap | |
| clientSSLMap | |
| contentTypeMap | |
| countryMap | |
| encryptedBytes | Bytes returned to client using SSL/TLS protocol |
| encryptedRequests | Requests served using SSL/TLS protocol |
| ipClassMap | |
| pageViews | Successful requests for HTML content |
| requests | |
| responseStatusMap | |
| threatPathingMap | |
| threats | Requests classified as threats |
AccountHttpRequests1hGroupsThreatPathingMapElem
| Field | Description |
|---|---|
| requests | |
| threatPathingName | Threat type |
AccountHttpRequests1hGroupsUniq
| Field | Description |
|---|---|
| uniques | A number of unique IPs |
AccountHttpRequests1mGroups
Minutely rollups of request data
| Field | Description |
|---|---|
| avg | The average value for a metric per dimension |
| dimensions | List of dimensions to group by |
| sum | The sum of values for a metric per dimension |
| uniq | The number of unique values for a metric per dimension |
AccountHttpRequests1mGroupsAvg
| Field | Description |
|---|---|
| bytes | |
| sampleInterval | Average sample interval |
AccountHttpRequests1mGroupsBrowserMapElem
| Field | Description |
|---|---|
| pageViews | Successful requests for HTML content |
| uaBrowserFamily | Browser type |
AccountHttpRequests1mGroupsClientHTTPVersionMapElem
| Field | Description |
|---|---|
| clientHTTPProtocol | HTTP version |
| requests |
AccountHttpRequests1mGroupsClientSSLMapElem
| Field | Description |
|---|---|
| clientSSLProtocol | Protocol version |
| requests |
AccountHttpRequests1mGroupsContentTypeMapElem
| Field | Description |
|---|---|
| bytes | Bytes returned to client |
| edgeResponseContentTypeName | Content type returned to client |
| requests |
AccountHttpRequests1mGroupsCountryMapElem
| Field | Description |
|---|---|
| bytes | Bytes returned to client |
| clientCountryName | Country from which request originated |
| requests | |
| threats | Requests classified as threats |
AccountHttpRequests1mGroupsDimensions
| Field | Description |
|---|---|
| date | Request date |
| datetime | Request datetime, truncated to the minute |
| datetimeDay | Request datetime truncated to the day |
| datetimeFifteenMinutes | Request datetime truncated to multiple of 15 minutes |
| datetimeFiveMinutes | Request datetime truncated to multiple of 5 minutes |
| datetimeHalfOfHour | Request datetime truncated to multiple of 30 minutes |
| datetimeHour | Request datetime truncated to the hour |
| datetimeMinute | DEPRECATED (Field is replaced with datetime): Request datetime truncated to the minute |
AccountHttpRequests1mGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountHttpRequests1mGroupsIpClassMapElem
| Field | Description |
|---|---|
| ipType | IP class |
| requests |
AccountHttpRequests1mGroupsOrderBy
| Field | Description |
|---|---|
AccountHttpRequests1mGroupsResponseStatusMapElem
| Field | Description |
|---|---|
| edgeResponseStatus | HTTP response status code returned to client |
| requests |
AccountHttpRequests1mGroupsSum
| Field | Description |
|---|---|
| browserMap | |
| bytes | Bytes returned to client |
| cachedBytes | Bytes returned to client from cache |
| cachedRequests | Requests served from cache |
| clientHTTPVersionMap | |
| clientSSLMap | |
| contentTypeMap | |
| countryMap | |
| encryptedBytes | Bytes returned to client using SSL/TLS protocol |
| encryptedRequests | Requests served using SSL/TLS protocol |
| ipClassMap | |
| pageViews | Successful requests for HTML content |
| requests | |
| responseStatusMap | |
| threatPathingMap | |
| threats | Requests classified as threats |
AccountHttpRequests1mGroupsThreatPathingMapElem
| Field | Description |
|---|---|
| requests | |
| threatPathingName | Threat type |
AccountHttpRequests1mGroupsUniq
| Field | Description |
|---|---|
| uniques | A number of unique IPs |
AccountHttpRequestsAdaptive
Raw HTTP requests with adaptive sampling
| Field | Description |
|---|---|
| apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
| apiGatewayMatchedHost | API Gateway host matched at the edge |
| botDetectionIds | Array of detections ids that matched this request |
| botDetectionTags | Array of detections tags that matched this request |
| botManagementDecision | Judgement of the bot management system |
| botScore | The final score originated from bot management detections. |
| botScoreBucketBy10 | Range of the bot management score |
| botScoreSrcName | Name of the source detection which generated the bot management score. |
| cacheReserveUsed | Used Cache Reserve to serve the response |
| cacheStatus | Cache status |
| clientASNDescription | The ASN of the visitor as string |
| clientAsn | The ASN number of the visitor |
| clientCountryName | Country from which request originated |
| clientDeviceType | |
| clientIP | The visitor's IP address (IPv4 or IPv6) |
| clientRefererHost | The referrer host |
| clientRequestHTTPHost | The HTTP hostname requested by the visitor |
| clientRequestHTTPMethodName | HTTP method of client request |
| clientRequestHTTPProtocol | The version of HTTP protocol requested by the visitor |
| clientRequestPath | The path requested by visitor |
| clientRequestQuery | Query parameters of client request |
| clientRequestReferer | HTTP request referrer |
| clientRequestScheme | The url scheme requested by the visitor |
| clientSSLProtocol | SSL protocol version |
| coloCode | |
| contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
| contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
| contentScanNumObj | Number of scannable content objects |
| contentScanObjResults | Array of scan results in order of detection |
| contentScanObjSizes | Array of scan sizes in order of detection |
| contentScanObjTypes | Array of content types in order of detection |
| date | The date the event occurred at the edge |
| datetime | The date and time the event occurred at the edge |
| datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
| datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
| datetimeHour | The date and time the event occurred at the edge truncated to hours |
| datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
| edgeDnsResponseTimeMs | The time elapsed resolving a CNAME if it was required to reach your origin |
| edgeResponseContentTypeName | |
| edgeResponseStatus | HTTP response status code returned to browser |
| edgeTimeToFirstByteMs | The time elapsed between processing the first byte of the request until when we started sending a response |
| httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application |
| isCrossZoneSubrequest | '1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise. |
| ja3Hash | MD5 hash of the JA3 TLS fingerprint |
| ja4 | JA4 TLS fingerprint |
| ja4Signals | Inter-request statistics computed for this JA4 across Cloudflare's entire global edge network |
| leakedCredentialCheckResult | The distinct result of checking for leaked credentials |
| originASN | |
| originASNDescription | ASN associated with origin |
| originIP | |
| originResponseDurationMs | |
| originResponseStatus | HTTP origin response status code returned to browser |
| rayName | The RayId of the request |
| requestSource | |
| securityAction | The code of the first-class action the Cloudflare Firewall took on this request |
| securitySource | The Cloudflare security product triggered by this request |
| upperTierColoName | |
| userAgent | visitor's user-agent string |
| userAgentBrowser | Browser parsed from the user agent |
| userAgentOS | OS parsed from the user agent |
| wafAttackScore | Beta. Overall request score generated by the WAF detection module |
| wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
| wafRceAttackScore | Beta. WAF score for a RCE attack |
| wafSqliAttackScore | Beta. WAF score for a SQLi attack |
| wafXssAttackScore | Beta. WAF score for a XSS attack |
| xRequestedWith | The X-Requested-With header of the client request |
| zoneTag | Associated zone |
| zoneVersion | The version of a zone |
AccountHttpRequestsAdaptiveFilter_InputObject
| Field | Description |
|---|---|
AccountHttpRequestsAdaptiveGroups
Aggregated HTTP requests data with adaptive sampling
| Field | Description |
|---|---|
| avg | The average value used for sample interval |
| confidence | ALPHA - DO NOT USE |
| count | The number of values for a metric per dimension |
| dimensions | List of dimensions to group by |
| quantiles | Quantiles of a metric per dimension |
| ratio | The ratio of a range of status codes, between 0 and 1 |
| sum | The sum of values for a metric per dimension |
AccountHttpRequestsAdaptiveGroupsAvg
| Field | Description |
|---|---|
| crossZoneSubrequests | The proportion of requests that were inititiated by a Cloudflare Worker on another zone |
| edgeDnsResponseTimeMs | |
| edgeTimeToFirstByteMs | |
| originResponseDurationMs | The average originResponseDuration, in milliseconds, excluding 0 values (i.e. cached ones) |
| sampleInterval |
AccountHttpRequestsAdaptiveGroupsConfidence
| Field | Description |
|---|---|
| count | The number of values for a metric per dimension, with confidence intervals |
| level | Confidence level that was requested |
| sum | The sum of values for a metric per dimension, with confidence intervals |
AccountHttpRequestsAdaptiveGroupsDimensions
| Field | Description |
|---|---|
| apiGatewayMatchedEndpoint | API Gateway endpoint matched at the edge |
| apiGatewayMatchedHost | API Gateway host matched at the edge |
| botDetectionIds | Array of detections ids that matched this request |
| botDetectionTags | Array of detections tags that matched this request |
| botManagementDecision | Judgement of the bot management system |
| botScore | The final score originated from bot management detections. |
| botScoreBucketBy10 | Range of the bot management score |
| botScoreSrcName | Name of the source detection which generated the bot management score. |
| cacheReserveUsed | Used Cache Reserve to serve the response |
| cacheStatus | |
| clientASNDescription | The ASN of the visitor as string |
| clientAsn | |
| clientCountryName | Country from which request originated |
| clientDeviceType | |
| clientIP | |
| clientRefererHost | The referrer host |
| clientRequestHTTPHost | Host requested by the client |
| clientRequestHTTPMethodName | HTTP method of client request |
| clientRequestHTTPProtocol | HTTP protocol version |
| clientRequestPath | Path of client request |
| clientRequestQuery | Query parameters of client request |
| clientRequestReferer | HTTP request referrer |
| clientRequestScheme | HTTP request URI scheme (http/https) |
| clientSSLProtocol | SSL protocol version |
| coloCode | |
| contentScanHasFailed | 1 if not all contents for this request where successfully scanned, else 0 |
| contentScanNumMaliciousObj | Number of scannable content objects that are malicious |
| contentScanNumObj | Number of scannable content objects |
| contentScanObjResults | Array of scan results in order of detection |
| contentScanObjSizes | Array of scan sizes in order of detection |
| contentScanObjTypes | Array of content types in order of detection |
| date | The date the event occurred at the edge |
| datetime | The date and time the event occurred at the edge |
| datetimeFifteenMinutes | The date and time the event occurred at the edge truncated to a multiple of 15 minutes |
| datetimeFiveMinutes | The date and time the event occurred at the edge truncated to a multiple of 5 minutes |
| datetimeHour | The date and time the event occurred at the edge truncated to hours |
| datetimeMinute | The date and time the event occurred at the edge truncated to the minute |
| edgeDnsResponseTimeMs | The time elapsed resolving a CNAME if it was required to reach your origin |
| edgeResponseContentTypeName | |
| edgeResponseStatus | |
| edgeTimeToFirstByteMs | The time elapsed between processing the first byte of the request until when we started sending a response |
| httpApplicationVersion | DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application |
| isCrossZoneSubrequest | '1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise. |
| ja3Hash | MD5 hash of the JA3 TLS fingerprint |
| ja4 | JA4 TLS fingerprint |
| leakedCredentialCheckResult | The distinct result of checking for leaked credentials |
| originASN | |
| originASNDescription | ASN associated with origin |
| originIP | |
| originResponseDurationMs | |
| originResponseStatus | HTTP response status code returned by the origin |
| requestSource | |
| sampleInterval | ABR sample interval |
| securityAction | The code of the first-class action the Cloudflare Firewall took on this request |
| securitySource | The Cloudflare security product triggered by this request |
| upperTierColoName | |
| userAgent | |
| userAgentBrowser | Browser parsed from the user agent |
| userAgentOS | OS parsed from the user agent |
| wafAttackScore | Beta. Overall request score generated by the WAF detection module |
| wafAttackScoreClass | Beta. Overall request score class generated by the WAF detection module |
| wafRceAttackScore | Beta. WAF score for a RCE attack |
| wafSqliAttackScore | Beta. WAF score for a SQLi attack |
| wafXssAttackScore | Beta. WAF score for a XSS attack |
| xRequestedWith | The X-Requested-With header of the client request |
| zoneTag | Associated zone |
| zoneVersion | The version of a zone |
AccountHttpRequestsAdaptiveGroupsFilter_InputObject
| Field | Description |
|---|---|
AccountHttpRequestsAdaptiveGroupsOrderBy
| Field | Description |
|---|---|
AccountHttpRequestsAdaptiveGroupsQuantiles
| Field | Description |
|---|---|
| edgeDnsResponseTimeMsP50 | 50th percentile DNS Response Time (milliseconds) |
| edgeDnsResponseTimeMsP95 | 95th percentile DNS Response Time (milliseconds) |
| edgeDnsResponseTimeMsP99 | 99th percentile DNS Response Time (milliseconds) |
| edgeResponseBytesP50 | 50th percentile Bytes returned to client |
| edgeResponseBytesP95 | 95th percentile Bytes returned to client |
| edgeResponseBytesP99 | 99th percentile Bytes returned to client |
| edgeTimeToFirstByteMsP50 | 50th percentile Time To First Byte (milliseconds) |
| edgeTimeToFirstByteMsP95 | 95th percentile Time To First Byte (milliseconds) |
| edgeTimeToFirstByteMsP99 | 99th percentile Time To First Byte (milliseconds) |
| originResponseDurationMsP50 | 50th percentile Origin Response Duration (milliseconds) |
| originResponseDurationMsP95 | 95th percentile Origin Response Duration (milliseconds) |
| originResponseDurationMsP99 | 99th percentile Origin Response Duration (milliseconds) |