R2 Log Storage Cuts the Cost of Keeping Cloudflare Logs

Cloudflare enterprise customers can now use Logpush to send raw product logs directly to R2, the company's object storage service. The move targets a persistent operational pain point: the tradeoff between retaining logs you need for debugging, security investigations, or compliance, and the storage bill that comes with them.

At high traffic volumes, that bill gets steep quickly. A site handling 100,000 requests per second generates roughly 9.2 TB of HTTP request logs per day, or about 850 GB after gzip compression. Over a month, that's around 26 TB of compressed logs in storage. Add WAF and Spectrum logs across multiple domains and products, and the costs for SaaS builders and large enterprises alike can multiply fast.

R2's pricing model changes the math. For a typical workload where data is written and read exactly once—say, shipping logs to object storage before feeding them into an alerting system—R2 comes out to roughly 86% savings compared to Amazon S3. That comparison excludes per-operation read/write costs.

Querying historical data carries its own price tag. Services like Amazon Athena charge based on the amount of data scanned, so a deep look back through stored logs can rack up hundreds of dollars per query. Storing logs on R2 sidesteps that expense, though it does put the retrieval burden on the customer.

Retrieval Gets a Managed Path

Cloudflare's existing Logpull product offers seven days of retention and a simple API, with no third-party setup required. But Logpull is limited: it only covers HTTP request logs, and queried data volumes are capped.

The team is building tools specifically for pulling logs out of R2 across all supported datasets. The first iteration will support lookups by time period and rayId, similar to Logpull. Later iterations will handle more complex queries, such as returning logs between time X and Y that contain 500 errors or where WAF action = block. Interested enterprise customers can sign up for a closed beta of the Log Retrieval API.

Getting Started

Enterprise customers need R2 added to their contract first—reach out to your account team. Once R2 is enabled, create a bucket for your logs and use the Logpush setup flow to create the job. Detailed instructions are available in the Logpush to R2 developer documentation.

What's Next

Logpush is still evolving. On the roadmap are new datasets (Network Analytics Logs and Worker's Trace Events), log filtering, and custom log formatting. Cloudflare also plans to build log analysis and forensics features on top of R2, with the goal of tying log storage directly into the dashboard so operators can view high-level analytics and drill into individual log lines in one place.