Cloudflare logs move to R2 for long-term retention
Cloudflare has announced that customers will soon be able to store logs from its products directly on Cloudflare R2 storage. The move is aimed at helping organizations consolidate infrastructure by keeping log data within the Cloudflare ecosystem, potentially reducing costs and administrative overhead for security and IT teams.
Cloudflare's products generate logs that answer operational and security questions, such as:
- Why are requests being blocked by Firewall rules?
- Why are users seeing disconnects from applications using Spectrum?
- Why is there a spike in Cloudflare Gateway requests to a specific application?
Storing logs on R2 is positioned as a complement to Cloudflare's existing logging tools, filling a gap for affordable, long-term log retention across any of its products.
The evolution of log management
Log collection has shifted dramatically over the past two decades. In the early 2000s, organizations ran self-managed infrastructure and were responsible for ingesting logs from hundreds of sources across the IT stack. That required dedicated storage for endless log volumes, plus specialized teams to build ETL pipelines and make data actionable.
By the 2010s, managed services reduced much of that logging burden. But new challenges emerged: each managed service sends logs at different latencies, in different formats, with varying levels of detail. To get a unified view of their infrastructure, organizations typically needed to build or buy a SIEM solution.
Cloudflare replaces many of those managed services. Once a customer is onboarded, analytics tools for products like CDN, Firewall, Magic Transit and Spectrum provide both high-level trends and the ability to slice and dice data for deeper patterns. But analytics show data at an aggregate level; raw logs remain essential for many use cases, so Cloudflare has built a separate set of logging products.
Current logging options
Cloudflare currently offers three main ways to access logs:
- Instant Logs: Announced during Speed Week, this feature shows live traffic to a domain, useful for debugging and triaging. Users can monitor traffic, make a config change, and immediately see its effect.
- Logpush: A pipeline that moves data from Cloudflare's 250+ data centers to customers in under a minute. Logpush supports delivery to various cloud storage or SIEM destinations, with partnerships in place for major SIEM platforms.
- Logpull: A REST API for accessing HTTP request logs. Customers favor Logpull for its easy configuration, lack of third-party storage requirements, and the ability to pull data ad hoc for up to seven days.
Why store logs on R2?
Cloudflare says the top four requests from customers regarding log storage are:
- Low cost log storage within tight budgets.
- Low effort to set up and maintain.
- The ability to store logs for as long as needed.
- Access to logs from any Cloudflare product.
For many organizations, Cloudflare is a primary data source and generates more data than other applications. R2 is significantly cheaper than other cloud providers, so customers don't need to sample logs or drop products altogether to control costs.
Setup is intended to be a one-click affair, with no configuration details to manage. Retention is fully under customer control to align with security and compliance requirements. The feature will cover all products that currently have logging, with more to come as the product line expands.
Future direction
Cloudflare sees log storage on R2 as a foundation for log analysis and forensic capabilities directly on the platform. Combining analytics for a high-level view with raw log inspection for root cause analysis could help with investigations, support requests, and incident response.
