Cloudflare Logs Engine: Native Log Search Without the Third-Party Tax

Cloudflare’s network processes trillions of requests for millions of customers. For developers running production applications on that network, the logs generated for each request are often the only way to debug an issue, spot a security problem, or understand user behavior. But the sheer volume of data—petabytes per customer, stored for months—has traditionally forced teams into expensive, complex third-party tooling to get value from those logs.

Today, Cloudflare is launching Cloudflare Logs Engine, a new product designed to let customers store, search, and analyze Cloudflare Logs without leaving the Cloudflare ecosystem. Starting now, Enterprise customers who push logs to R2 can retrieve them by time range or by unique identifier (RayID). Cloudflare’s roadmap extends this to all plan types and adds more expressive querying.

The gap between analytics and raw logs

Cloudflare’s dashboard offers rich analytics for every product—request counts, cache hit ratios, CPU time, and more. Those summaries are ideal for spotting anomalies at a high level. But a developer trying to fix an application error needs to see the individual log lines that produced that error. For that, real-time tools like Instant Logs and wrangler tail are extremely effective—provided the problem is frequent enough to catch during a live debugging session.

Forensic investigation is different. When you need to find a rare event that caused an outage, or you suspect a security vulnerability and must identify every request that could have been exploited, you need to search the entire history of your logs. That has been the missing piece.

Why existing log pipelines fall short

Cloudflare has offered two ways to access logs. Logpull lets Enterprise customers store HTTP logs on Cloudflare for up to seven days, retrieving by time or RayID. Logpush streams logs to any external destination reliably—but then customers must arrange their own storage and analysis.

Cloudflare has partnerships with major SIEM and data warehouse providers, many with pre-built dashboards. But customers report three persistent problems with third-party stacks:

  • Cost: Providers bill for storage and for indexing every ingested line. Since Cloudflare is often a customer’s largest log emitter, indexing all that data can cost more than the service being logged.
  • Friction: Log analysis is typically triggered by a dashboard alert. But once you find the relevant log lines in an external tool, getting back to the correct Cloudflare dashboard to change a config is a disjointed journey.
  • Access: Logpush has been restricted to Enterprise plans, leaving smaller customers without a managed pipeline.

Separating storage from compute

Logs Engine’s core design decision is to decouple storage from analysis. Storage in R2 is inexpensive enough that long-term retention becomes practical for most customers. Analysis is billed separately—only for the queries you run, not for every line you ingest. Cloudflare says query pricing is still in development but emphasizes that it aims to be predictable and transparent.

That separation only helps if you can avoid scanning the full dataset for every question. Cloudflare’s answer is tight integration with its analytics layer. Most investigative work begins broad—determining which origins are affected, which clients are involved, and during what window. Cloudflare’s ABR (Adaptive Bit Rate) analytics can summarize that quickly. Once you narrow the scope, you switch to Logs Engine to pull the exact records matching your search criteria.

The final goal is accessibility. Cloudflare plans to bring these services to all plan types, not just Enterprise, and to make log storage and analysis as simple as a few dashboard clicks.

What’s live now and what’s next

Current availability is limited to Enterprise customers who store logs in R2 and retrieve them by time range. A beta for RayID-based retrieval is also open; interested customers can email [email protected]. Cloudflare’s stated roadmap includes:

  • Logging for any Cloudflare dataset at any retention period
  • Access for all plan types, including pay-as-you-go
  • Queries spanning multiple datasets simultaneously
  • Arbitrary filters on any column, plus aggregation across datasets
  • Immediate rule creation from log search results within the dashboard

Longer term, Cloudflare is exploring support for data sources beyond its own network. Combined with Analytics Engine, the intent is to provide a low-cost way to query arbitrary datasets in one place.