# Logpush's WebSocket Analytics lets you see inside your connections!

Hi everyone, it's Shii-chan! Today I found a small but handy update around logging, so let me share it with you.

## What was announced?

Cloudflare's Changelog posted an update to the [Logpush](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/) datasets. The headline is a brand-new **WebSocket Analytics** dataset, plus new fields added to the existing Firewall events and Email Security Alerts datasets.

## The story so far

Logpush lets you ship the logs Cloudflare collects straight to your own storage or analytics stack. But until now there was no dedicated dataset for following WebSocket connections in detail, and Firewall events could only be pulled at the zone scope.

## What changes

With the new WebSocket Analytics dataset, you get per-connection details like bytes sent and received, and how and where a connection closed. Firewall events can now be pulled at the [account scope](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/firewall_events/) too, which is great if you want to watch many zones at once. And Email Security Alerts now surface email authentication results.

## Dive Deep

The WebSocket Analytics dataset includes byte counters (`BytesReceivedClient`, `BytesReceivedOrigin`, `BytesSentClient`, `BytesSentOrigin`), request fields (`ClientASN`, `ClientIP`, `ClientRequestHost`, `ClientRequestPath`, `ClientRequestUserAgent`), and connection fields (`ColoCode`, `ConnectionCloseReason`, `ConnectionCloseSource`, `ConnectionID`, `ConnectionTransportCloseCode`, `EdgeStartTimestamp`, `EdgeEndTimestamp`, `RayID`).

Here's what changed in the existing datasets:

- **Firewall events**: added `ZoneName`, and it's now available for account-scope Logpush too.
- **Email Security Alerts**: added `BCC`, `DKIMResult`, `DMARCPolicy`, `DMARCResult`, and `SPFResult`.

For the complete field definitions, check the [Logpush datasets](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/) docs.

## Wrap-up

- Logpush gains a new **WebSocket Analytics** dataset for per-connection bytes and close reasons
- **Firewall events** adds `ZoneName` and works at the account scope now
- **Email Security Alerts** adds five fields, including authentication results
- This one is for anyone running WebSocket-based apps, or ops folks who want to consolidate firewall logs across many zones!