Bridging Cloudflare Analytics and Prometheus

Cloudflare's dashboard contains a wealth of operational data, but for teams running Prometheus and Grafana as their primary monitoring stack, that information sits in a silo. At Labyrinth Labs, we needed Cloudflare's zone analytics alongside our infrastructure metrics to correlate events, debug incidents faster, and build more meaningful alerts for our client Pixel Federation.

Pulling raw logs from Cloudflare's Logs API wasn't practical — the volume is simply too large and costly to process. Cloudflare's GraphQL Analytics API, however, already aggregates thousands of events per second, which makes it a far more efficient data source. To bridge the gap, we built a custom Prometheus exporter in Go that queries this API and exposes the results as standard Prometheus metrics.

Exporter Design

Go was the obvious language choice given our Kubernetes focus and Cloudflare's official Golang SDK. The exporter queries Cloudflare's GraphQL API for each zone and translates the responses into Prometheus metrics served on the /metrics endpoint.

The data we pull covers:

  • Total request counts and rates
  • Bandwidth usage
  • Cache utilization
  • Threats and SSL usage
  • HTTP response codes
  • Content types and geographic origin of requests
  • Traffic distribution across Cloudflare's data centers

Most of this information comes from the http1mGroups node in the GraphQL API, while data-center distribution uses the httpRequestsAdaptiveGroups node. A full list of available datasets is documented at Cloudflare's GraphQL dataset reference.

To keep scrape times reasonable, the exporter runs queries against the API in parallel using Goroutines before aggregating and formatting the results for Prometheus.

Running It in Kubernetes

The exporter ships with a Docker image and an official Helm chart. Since metrics are served on /metrics, you only need to add the standard Prometheus scrape annotations to the pod or service. Depending on your Prometheus setup, you may need to adjust the Service annotations.

Configuration is straightforward: provide your Cloudflare API email and key, with an option to restrict scraping to specific zones. A Helmfile example is also included in the repository for teams that manage deployments that way.

We're planning to add a Prometheus ServiceMonitor to the Helm chart so users of the Prometheus operator can skip the annotations entirely.

Dashboards and Alerting

Once metrics are in Prometheus, we visualize them with a Grafana dashboard we published for this purpose. The dashboard groups panels into rows for easier navigation and lets you filter by individual zones.

The metrics also feed directly into alerting. You can define alerts either in Grafana or as Prometheus alert rules, matching the same workflows you use for infrastructure monitoring. For long-term retention, the metrics work with Thanos or Cortex if you want to store them indefinitely.

What's Next

Our goal is to expand coverage to everything Cloudflare's GraphQL API exposes. Firewall analytics, DoS analytics, and Network analytics are the next targets. Questions, bug reports, and pull requests are welcome on the GitHub repository.