Observability at Cloudflare: One Pane of Glass for Your Network

Every change you make to your infrastructure — a new feature deployment, a route update, or a firewall rule — demands one thing: visibility. You need to know whether your system is behaving as intended, and if it isn’t, exactly where and why it’s failing. Cloudflare's goal is to serve as the single pane of glass for all network activity, providing insights into every request, packet, and fetch that traverses its network.

Cloudflare frames observability around three core components:

  • Monitoring — measuring system health to signal when something goes wrong.
  • Analytics — visualizing data to spot patterns and insights.
  • Forensics — answering specific questions about individual events, down to the log line.

This framework is particularly critical for security. When a firewall or bot management rule takes action, you need to validate that the mitigation was correct and not a false positive. Was that request truly malicious, and if so, which detection system made the call?

Proactive Alerts

Dashboards are great for post-hoc analysis, but nobody wants to sit refreshing a page waiting for something to break. That’s the job of notifications. Cloudflare already offers a range of alert types, including origin error rates, security events, usage-based billing, and health checks. The plan is to continuously expand these to mirror the analytics offerings, with more customization and smarter detection algorithms.

Current detection methods include spike detection and advanced statistical approaches, and Cloudflare is iterating on these algorithms to reduce noise while improving accuracy. The long-term goal is simple: you shouldn’t have to watch the dashboard constantly — Cloudflare will let you know when things look off.

Drilling Into Analytics

Once you receive an alert, the next step is answering what triggered it. The Cloudflare dashboard is designed to show you exactly what’s happening through graphs, high-level metrics, and top-items lists. The emphasis is on customizability: define timeframes, add filters, and build your own metrics that correlate with raw logs to get a complete picture.

Because developers, security analysts, and network engineers all have different needs, the dashboard must serve each group. For security teams specifically, the goal is to build confidence before deploying policies. Rather than deploying a WAF rule and hoping for the best, you can use analytics to preemptively answer questions like, "What would happen if I blocked all requests flagged as XSS attacks?"

Cloudflare is actively working on layering security detection signals onto HTTP analytics, with the aim of extending the enterprise bot management experience to all security products. The result should be a dashboard that shows you the potential impact of a rule before you turn it on.

Logs for Granular Detail

For play-by-play details, logs are the answer. Each log event is measured differently: an HTTP request log captures an end user’s request or submission, while a firewall log records an action taken on that request — meaning there can be multiple firewall events per single HTTP request.

Today, Cloudflare customers use three primary methods to access logs:

  • Logpull and Logpush — for exporting logs to third-party analytics partners for storage and correlation.
  • Instant Logs — for live monitoring and troubleshooting directly from the dashboard or CLI.

Cloudflare is building log storage on R2 to bring more log power directly into its own dashboard. The aim is to replicate the usefulness of the firewall analytics activity log across all products minimizing reliance on sampled data. With persistent on-platform logs, even highly specific forensic queries become feasible: given a single ray ID, you should be able to trace back to the client IP, then investigate all other related requests — which ones were malicious, and what path they followed.

Tracing End-to-End Requests

Logs describe individual events, but they lack context. Traces fill that gap by showing the complete lifecycle of a request — from the user’s initial request through every system involved in its delivery. This granular forensics helps isolate exactly where errors or latency spikes occur.

Consider a Worker that performs a fetch to both your origin and a third-party API. Analytics might show average execution time and error rates, but they won't reveal which specific operation is the bottleneck. While tools like wrangler dev mode and console.log statements are useful for debugging, they can be tedious to instrument manually.

The developer experience goal is to provide built-in tracing tools that eliminate the need for manual instrumentation, allowing you to answer questions like, "Where is my Worker failing?" or "Which fetch call is causing a latency spike?"

The Road Ahead

Notifications, analytics, logs, and tracing each address a different observability need. Combined, they form a powerful toolkit for analysts and developers alike. Cloudflare’s near-term focus is bringing more of these capabilities into the existing dashboard, iterating on detection algorithms, and expanding customizations. Customer feedback will play a central role in shaping this roadmap as the platform evolves.