See exactly why your WebSockets are closing! The new WebSocket Analytics dataset is here!

Hey everyone, it's Shii! I found a really practical update for anyone running WebSocket-based services, so I'm excited to share this one!

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's changelog announced a new Logpush dataset called websocket_analytics. It's built for Enterprise customers, letting them push per-connection WebSocket analytics to any Logpush destination. Each log record is emitted the moment a WebSocket connection closes.

The key fields it includes are:

• ConnectionCloseReason — why the connection ended (peerReset, peerNoError, timedOut, upstreamReset, protocolViolation, unspecifiedError, or none)
• ConnectionCloseSource — which side initiated the close (upstream, downstream, me, or both)
• ConnectionTransportCloseCode — the TLS alert code or TCP-level close code
• RayID — lets you correlate this with your existing HTTP request logs

On top of that, it includes directional byte counts (BytesSentClient, BytesReceivedClient, BytesSentOrigin, BytesReceivedOrigin), connection timestamps, client IP, colo code, and request metadata from the original WebSocket upgrade.

Why it matters

According to the post, a lot of the fields in this dataset were previously only visible to Cloudflare engineers through internal tooling. WebSocket connections stay open for a long time by nature, which makes it hard to figure out why they closed, and that makes incident investigation tricky. Having this show up directly in your logs is a big deal for anyone operating these services.

What changes

For example, you can group events like ConnectionCloseReason == "peerReset" by host and data center to detect spikes in TCP resets, right inside the log analysis tools you already use. What used to be a vague sense that "WebSockets are dropping for some reason" can now be explained concretely: which side closed it, why, and how often, all from your own data.

Wrap-up

• A new websocket_analytics dataset emits one record every time a WebSocket connection closes
• It captures close reason, close source, TLS/TCP close codes, byte counts, and RayID
• Available on the Enterprise plan, to any Logpush destination

If you're running WebSocket-based services at enterprise scale, this is a genuinely welcome update that should make incident investigation much easier!