Skip to content

[Logs] Update Logpush dataset field definitions (2026-05-19) #30910

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
soheiokamoto wants to merge 1 commit into
base: production
Choose a base branch
from
+37 −9
Open

[Logs] Update Logpush dataset field definitions (2026-05-19) #30910

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions src/content/changelog/logs/2026-05-19-log-fields-updated.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
---
title: Updated fields across multiple Logpush datasets in Cloudflare Logs
description: Fields have been updated across multiple Logpush datasets in Cloudflare Logs.
date: 2026-05-19
---

Cloudflare has updated [Logpush datasets](/logs/logpush/logpush-job/datasets/):

### Updated fields in existing datasets

- **DEX Device State Events** (added): `DeviceRegistrationProfileID`.
- **HTTP requests** (added): `MatchedRules`.

For the complete field definitions for each dataset, refer to [Logpush datasets](/logs/logpush/logpush-job/datasets/).
6 changes: 6 additions & 0 deletions ...ntent/docs/logs/logpush/logpush-job/datasets/account/dex_device_state_events.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,6 +111,12 @@ Type: `string`

The unique ID for the device registration.

## DeviceRegistrationProfileID

Type: `string`

The ID for the Device Profile used for the device registration.

## DiskReadBPS

Type: `int`
Expand Down
8 changes: 4 additions & 4 deletions src/content/docs/logs/logpush/logpush-job/datasets/account/mnm_flow_logs.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ The destination port number.

Type: `string`

If the flow is routed through a WARP device, the device ID.
The ID of the network device (such as a router or switch) that originated the flow.

## EgressBits

Expand Down Expand Up @@ -73,7 +73,7 @@ The flow protocol (e.g., 'AWS_VPC', 'IPFIX', 'SFLOW_5', 'NETFLOW_V9', etc.).

Type: `int or string`

The timestamp of the flow.
The timestamp of the flow. To specify the timestamp format, refer to [Output types](/logs/logpush/logpush-job/log-output-options/#output-types).

## NumFlows

Expand Down Expand Up @@ -103,7 +103,7 @@ The protocol number (e.g., 6 for TCP, 17 for UDP).

Type: `string`

Comma-separated list of rule IDs associated with the flow if any.
Comma-separated list of Magic Network Monitoring rule IDs associated with the flow, if any.

## SampleRate

Expand Down Expand Up @@ -151,4 +151,4 @@ The TCP flags.

Type: `int or string`

The date and time of the event.
The date and time of the event. To specify the timestamp format, refer to [Output types](/logs/logpush/logpush-job/log-output-options/#output-types).
2 changes: 2 additions & 0 deletions ...t/docs/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,8 @@ sidebar:
order: 21
---

Network session logs are generated for all traffic proxied through Cloudflare Gateway across all supported [on-ramps](/cloudflare-one/networks/connectivity-options/), such as the Cloudflare One Client (WARP), proxy endpoints (PAC files), Browser Isolation, and Cloudflare Tunnel.

The descriptions below detail the fields available for `zero_trust_network_sessions`.

## AccountID
Expand Down
8 changes: 4 additions & 4 deletions src/content/docs/logs/logpush/logpush-job/datasets/zone/firewall_events.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,25 +177,25 @@ Type: `int`

HTTP response status code returned to browser.

## FirewallForAIInjectionScore
## FirewallForAIInjectionScore (deprecated)

Type: `int`

The score indicating the likelihood of a prompt injection attack in the request, as determined by Firewall for AI. Deprecated: Use AISecurityInjectionScore instead.

## FirewallForAIPIICategories
## FirewallForAIPIICategories (deprecated)

Type: `array[string]`

List of PII categories detected in the request by Firewall for AI. Deprecated: Use AISecurityPIICategories instead.

## FirewallForAITokenCount
## FirewallForAITokenCount (deprecated)

Type: `int`

The number of tokens in the request, as counted by Firewall for AI. Deprecated: Use AISecurityTokenCount instead.

## FirewallForAIUnsafeTopicCategories
## FirewallForAIUnsafeTopicCategories (deprecated)

Type: `array[string]`

Expand Down
8 changes: 7 additions & 1 deletion src/content/docs/logs/logpush/logpush-job/datasets/zone/http_requests.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -453,6 +453,12 @@ Type: `string`

Result of the check for [leaked credentials](/waf/detections/leaked-credentials/). <br />Possible results are: <em>password_leaked</em> \| <em>username_and_password_leaked</em> \| <em>username_password_similar</em> \| <em>username_leaked</em> \| <em>clean</em>.

## MatchedRules

Type: `array[object]`

Array of matched FL product rules grouped by product. Each object contains: <em>product</em> (string, e.g. snippets, transform, redirects), <em>rulesetId</em> (string), <em>rulesetVersion</em> (int), and <em>rules</em> (array of objects, each with <em>id</em> (string) and optional <em>metadata</em> (object with string key-value pairs)).
Copy link
Copy Markdown
Contributor

@ask-bonk ask-bonk Bot May 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Undefined acronym. The style guide requires spelling out abbreviations on first use. Please update the internal source YAML to clarify what FL means, or remove the abbreviation.


## OriginDNSResponseTimeMs

Type: `int`
Expand All @@ -475,7 +481,7 @@ Time taken to send request headers to origin after establishing a connection. No

Type: `int`

Number of bytes returned by the origin server.
Number of bytes returned by the origin server. Consider using CacheResponseBytes and filtering out OriginResponseStatus with values 0 and 304, which indicate a revalidated response. Read more [here](/logs/faq/common-calculations/#how-can-i-calculate-bytes-served-by-the-origin-from-cloudflare-logs).
Copy link
Copy Markdown
Contributor

@ask-bonk ask-bonk Bot May 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fix link text per style guide (never use "here", "read more", etc.):

Suggested change
Number of bytes returned by the origin server. Consider using CacheResponseBytes and filtering out OriginResponseStatus with values 0 and 304, which indicate a revalidated response. Read more [here](/logs/faq/common-calculations/#how-can-i-calculate-bytes-served-by-the-origin-from-cloudflare-logs).
Number of bytes returned by the origin server. Consider using CacheResponseBytes and filtering out OriginResponseStatus with values 0 and 304, which indicate a revalidated response. For more information, refer to [Calculating bytes served by the origin](/logs/faq/common-calculations/#how-can-i-calculate-bytes-served-by-the-origin-from-cloudflare-logs).


## OriginResponseDurationMs

Expand Down