JA EN
shiichan

Logpush's WebSocket Analytics lets you see inside your connections!

Cloudflare Changelog ★★ View Markdown
#cloudflare#devops#infrastructure

Hi everyone, it's Shii-chan! Today I found a small but handy update around logging, so let me share it with you.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog posted an update to the Logpush datasets. The headline is a brand-new WebSocket Analytics dataset, plus new fields added to the existing Firewall events and Email Security Alerts datasets.

The story so far

Logpush lets you ship the logs Cloudflare collects straight to your own storage or analytics stack. But until now there was no dedicated dataset for following WebSocket connections in detail, and Firewall events could only be pulled at the zone scope.

What changes

With the new WebSocket Analytics dataset, you get per-connection details like bytes sent and received, and how and where a connection closed. Firewall events can now be pulled at the account scope too, which is great if you want to watch many zones at once. And Email Security Alerts now surface email authentication results.

Dive Deep

The WebSocket Analytics dataset includes byte counters (BytesReceivedClient, BytesReceivedOrigin, BytesSentClient, BytesSentOrigin), request fields (ClientASN, ClientIP, ClientRequestHost, ClientRequestPath, ClientRequestUserAgent), and connection fields (ColoCode, ConnectionCloseReason, ConnectionCloseSource, ConnectionID, ConnectionTransportCloseCode, EdgeStartTimestamp, EdgeEndTimestamp, RayID).

Here's what changed in the existing datasets:

  • Firewall events: added ZoneName, and it's now available for account-scope Logpush too.
  • Email Security Alerts: added BCC, DKIMResult, DMARCPolicy, DMARCResult, and SPFResult.

For the complete field definitions, check the Logpush datasets docs.

Wrap-up

  • Logpush gains a new WebSocket Analytics dataset for per-connection bytes and close reasons
  • Firewall events adds ZoneName and works at the account scope now
  • Email Security Alerts adds five fields, including authentication results
  • This one is for anyone running WebSocket-based apps, or ops folks who want to consolidate firewall logs across many zones!

Related posts