No more per-zone setup! Logpush firewall events now roll up to the whole account!

Hey there, it's Shii-chan! Today I've got a nice little Logpush update from Cloudflare to share with you.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Over on the Cloudflare Changelog, there's news that Logpush now has an account-scoped firewall events dataset. Instead of setting up log delivery zone by zone, you can now create just one Logpush job at the account level and receive firewall events for every zone in that account, all together.

The story so far

Until now, firewall events came as a zone-scoped dataset, so every time you added a zone you had to create a separate Logpush job and babysit each one. With dozens of zones, both the setup and the upkeep got pretty heavy.

What changes

Create one job at the account level and events from all your zones flow in together, so the number of Logpush jobs you manage drops a lot. This is especially handy for security teams that want to collect firewall events across zones in one place.

There's also a new ZoneName field, so when you look at logs in your downstream pipeline you can instantly tell which zone each event came from.

Dive Deep

Digging in a bit more, the new account-scoped firewall_events dataset can be configured from both the Logpush API and the Cloudflare dashboard. The fields and filter expressions are the same as the existing zone-scoped dataset, with ZoneName added on top, so you can switch over without relearning anything. And all of your existing Logpush destinations keep working as-is.

Wrap-up

• An account-scoped firewall_events dataset arrives in Logpush
• One job receives firewall events for every zone in the account
• A new ZoneName field identifies which zone each event came from
• Fields, filter expressions, and destinations match the existing zone-scoped version
• Great for teams running lots of zones who want simpler log management!