Gateway log export takes the manual work out of DNS audits
Cloudflare Gateway, the DNS filtering component of Cloudflare for Teams, now supports automated log export to third-party storage and security information and event management (SIEM) platforms. The feature, built on Cloudflare's existing Logpush Service, is designed to replace the manual, page-by-page review of DNS queries in the Teams dashboard with a configurable, continuous data feed.
The problem the feature addresses is one of scale. A single home office might generate thousands of DNS queries a week, but an organization with a thousand employees can easily produce five million rows of log data in a single day. Reviewing that volume through a web UI is impractical. The Logpush integration gives administrators the raw data they need for auditing, retention, and analysis in a destination they already control.
Understanding the data volume
Cloudflare Gateway sits between users and the public Internet, resolving DNS queries and blocking requests to known malware, phishing, and other filtered categories. When a user requests a blocked site, the DNS query is stopped before a connection is made. The logs capture the hostname requested, the time of the request, and whether Gateway allowed or blocked it.
For a single device, that data is easy enough to search in the Cloudflare for Teams interface. But the average user generates about 5,000 DNS queries per day. Multiply that across an organization and the logs become a rich source of audit data — covering regular traffic, potential phishing campaigns, and the use of unauthorized cloud services — but also an unwieldy dataset to traverse manually.
How the export works
Logpush is Cloudflare's existing pipeline for exporting network data to customer-owned destinations. Rather than building a system to poll Cloudflare APIs, administrators configure Logpush to send log deltas every five minutes to a supported provider. The service supports AWS S3, Google Cloud Storage, Sumo Logic, and Microsoft Azure out of the box.
To set up Gateway log export, administrators navigate to the Logpush section of the Logs component in the Cloudflare for Teams UI. From there, the wizard walks through two steps: selecting the Gateway fields to export and validating ownership of the storage destination.
The field selector lets you choose exactly which data points to include in the export. The destination validation step confirms you control the target bucket or account before any data is written. Once saved, Logpush sends updated logs to the destination every five minutes. Multiple destinations can be configured, and the same section of the UI can be used to monitor the health of each export job.
The same Logpush mechanism already supports log export for Cloudflare Access, the other half of the Cloudflare for Teams platform. That configuration currently lives in the Cloudflare dashboard alongside infrastructure features like the WAF and CDN, but Cloudflare plans to migrate it into the Teams UI as well.
Deployment and plan requirements
Gateway itself can be deployed in under five minutes. Teams can secure an entire office network through router-level configuration or distribute Gateway to roaming devices via mobile device management, either over IPv6 networks or with a dedicated IPv4 address as part of a Cloudflare Enterprise account.
Once deployed, administrators can block known threats with a single click or extend policies to specific content categories. The new log export feature, however, is limited to customers on a contract plan. All Cloudflare for Teams plans include 30 days of searchable log data in the UI.
