Cloudflare R2 Now a Log Destination

With Cloudflare R2 object storage reaching General Availability, customers can now use R2 as a destination for their log data. Logpush jobs can write logs from any Cloudflare product directly into an R2 bucket, giving teams a storage option that avoids the egress fees typical of other object stores.

Until now, Cloudflare only supported pushing logs to third-party destinations for storage and analysis. The new integration lets customers keep logs within Cloudflare's ecosystem, which reduces the cost barrier associated with accessing stored data. This is especially relevant for high-traffic properties where log volume—and the associated retrieval fees—can become a significant line item.

R2's S3 API compatibility means existing tooling can interact with the stored logs without modification. Retention is fully customer-controlled, and there are no egress charges for pulling data out of Cloudflare.

Configuring a Logpush Job to R2

Setting up a Logpush job to R2 can be done through either the Cloudflare dashboard or the Cloudflare API. When creating a job in the dashboard, R2 appears as a selectable destination during the configuration flow:

BLOG-1385 Embedded Image - U88uoO

An equivalent API call follows the standard Logpush job creation pattern with the R2 destination specified:

curl -s -X POST 'https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/logpush/jobs' \
-H "X-Auth-Email: <EMAIL>" \
-H "X-Auth-Key: <API_KEY>" \
-d '{
 "name":"<DOMAIN_NAME>",
"destination_conf":"r2://<BUCKET_PATH>/{DATE}?account-id=<ACCOUNT_ID>&access-key-id=<R2_ACCESS_KEY_ID>&secret-access-key=<R2_SECRET_ACCESS_KEY>",
 "dataset": "http_requests",
"logpull_options":"fields=ClientIP,ClientRequestHost,ClientRequestMethod,ClientRequestURI,EdgeEndTimestamp,EdgeResponseBytes,EdgeResponseStatus,EdgeStartTimestamp,RayID&timestamps=rfc3339",
 "kind":"edge"
}' | jq .

Full configuration details are available in the Logpush over R2 documentation.

Retrieving Logs by Time Range

For logs already stored in R2, the Cloudflare API provides a retrieval endpoint that accepts a time range. Instead of manually locating objects across buckets, customers can query for logs within specific start and end times:

curl -s -g -X GET 'https://api.cloudflare.com/client/v4/accounts/<ACCOUNT_ID>/logs/retrieve?start=2022-09-25T16:00:00Z&end=2022-09-25T16:05:00Z&bucket=<YOUR_BUCKET>&prefix=<YOUR_FILE_PREFIX>/{DATE}' \
-H "X-Auth-Email: <EMAIL>" \
-H "X-Auth-Key: <API_KEY>" \ 
-H "R2-Access-Key-Id: R2_ACCESS_KEY_ID" \
-H "R2-Secret-Access-Key: R2_SECRET_ACCESS_KEY" | jq .

Details on the retrieval API are documented under Log Retrieval API. Once logging infrastructure is in place, standard monitoring and alerting practices can be applied to the Logpush jobs themselves to ensure they remain healthy.

Roadmap and Feedback

Cloudflare plans to extend log analysis and forensics capabilities on top of R2. For now, the team is interested in feedback on retrieval options and overall improvements. Customers can get started by setting up R2 and enabling Logpush from their Cloudflare plan.