Log Explorer Brings Native Log Investigation to Cloudflare's Dashboard

Cloudflare has announced beta availability of Log Explorer, a feature that lets customers search HTTP request and Security Event logs directly in the Cloudflare Dashboard. Built as an extension of Security Analytics, Log Explorer provides access to raw logs alongside the aggregate views that Security Analytics already offers, removing the need to export log data to third-party tools for security analysis.

Why Raw Logs Matter

Security Analytics gives teams a high-level look at HTTP traffic, with dashboards designed to highlight potentially malicious, unmitigated traffic. But those dashboards rely on Adaptive Bit Rate (ABR) analytics with data sampling. That approach works well for aggregate trends, but not for the detailed, per-request data that engineers and SOC analysts need when investigating an incident.

Raw logs answer questions that metrics cannot, such as:

  • What is causing an increase in 403 errors?
  • What data was accessed by a specific IP address?
  • What did a particular user's session look like?

Traditionally, getting these answers meant maintaining a stack of separate monitoring and log analysis tools. In multi-cloud or hybrid environments, that fragmentation adds cost and complexity. Log Explorer offers a lower-cost path: store logs in Cloudflare for an uncapped, customizable period and query them without leaving the dashboard.

Features and Capabilities

Log Explorer is designed for both SOC engineers hunting for potential incidents and compliance officers with specific log retention requirements. Supported features include:

  • Searching HTTP Request and Security Event logs
  • Filtering on any field with standard operators
  • Switching between basic filter mode and a SQL query interface
  • Selecting which fields to display
  • Viewing log events in table format
  • Looking up HTTP request records by Ray ID

Investigating Unmitigated Attacks

The workflow logic goes like this: in Security Analytics, an analyst spots traffic flagged as a likely attack but not mitigated. Clicking through to the logs reveals a common client IP address behind most requests, all of them tagged as bot traffic. From there, the analyst can craft a WAF rule to block the IP or all traffic with a bot score below a threshold.

For documentation purposes—say, a compliance team needs the scope and impact of an attack—Log Explorer can query all HTTP requests from a suspect IP within the time window of a traffic spike. Adding the OriginResponseBytes field to the query, with a filter for values greater than zero, shows whether any data was actually exfiltrated.

Handling False Positives

Cloudflare's security tools rely on IP reputation and ML-based WAF attack scores to classify requests. Those systems are effective, but sometimes legitimate traffic gets blocked. With Log Explorer, analysts can find specific requests that were mistakenly blocked, see why they were flagged, and adjust WAF rules accordingly.

Log Explorer also supports direct lookup by Ray ID, the identifier assigned to every request through Cloudflare. A single query returns the relevant record. The default LIMIT clause in the query has no impact on Ray ID lookups, since a Ray ID is unique and returns only one record.

Built on R2 and Delta Lake

Under the hood, Log Explorer is a long-term, append-only log storage platform running on Cloudflare R2. It uses the Delta Lake protocol, an open-source storage framework that brings ACID compliance and high performance to data stored in a cloud object store. The design combines R2's cost-effective storage with SQL-queryable access.

Each dataset is stored per customer—similar to Cloudflare D1—so data from different customers is not mixed. That single-tenant model will later enable custom retention policies and regional data placement. Datasets are stored as Delta tables in R2 buckets, with data organized as Apache Parquet objects and paired with an append-only, checkpointed transaction log. This setup allows multiple concurrent writers with optimistic concurrency.

Optimistic concurrent writes require atomic updates to the underlying object store. That need drove R2 to add a PutIfAbsent operation with strong consistency—something that sets Log Explorer apart from Delta Lake solutions on AWS S3, which typically require an external store to manage write synchronization.

Log Explorer is written in Rust, using open-source libraries such as delta-rs (a Rust implementation of the Delta Lake protocol) and Apache Arrow DataFusion as the query engine.

Roadmap and Availability

Future plans include tighter integration between Analytics and Log Explorer, additional datasets (including Zero Trust logs), custom retention periods, and integrated alerting. Pricing will be finalized before general availability. Interested users can request access to the beta via Cloudflare's signup form.