# See exactly why your WebSockets are closing! The new WebSocket Analytics dataset is here!

Hey everyone, it's Shii! I found a really practical update for anyone running WebSocket-based services, so I'm excited to share this one!

## What was announced?

Cloudflare's changelog announced a new Logpush dataset called `websocket_analytics`. It's built for Enterprise customers, letting them push per-connection WebSocket analytics to any Logpush destination. Each log record is emitted the moment a WebSocket connection closes.

The key fields it includes are:

- `ConnectionCloseReason` — why the connection ended (`peerReset`, `peerNoError`, `timedOut`, `upstreamReset`, `protocolViolation`, `unspecifiedError`, or `none`)
- `ConnectionCloseSource` — which side initiated the close (`upstream`, `downstream`, `me`, or `both`)
- `ConnectionTransportCloseCode` — the TLS alert code or TCP-level close code
- `RayID` — lets you correlate this with your existing HTTP request logs

On top of that, it includes directional byte counts (`BytesSentClient`, `BytesReceivedClient`, `BytesSentOrigin`, `BytesReceivedOrigin`), connection timestamps, client IP, colo code, and request metadata from the original WebSocket upgrade.

## Why it matters

According to the post, a lot of the fields in this dataset were previously only visible to Cloudflare engineers through internal tooling. WebSocket connections stay open for a long time by nature, which makes it hard to figure out why they closed, and that makes incident investigation tricky. Having this show up directly in your logs is a big deal for anyone operating these services.

## What changes

For example, you can group events like `ConnectionCloseReason == "peerReset"` by host and data center to detect spikes in TCP resets, right inside the log analysis tools you already use. What used to be a vague sense that "WebSockets are dropping for some reason" can now be explained concretely: which side closed it, why, and how often, all from your own data.

## Wrap-up

- A new `websocket_analytics` dataset emits one record every time a WebSocket connection closes
- It captures close reason, close source, TLS/TCP close codes, byte counts, and RayID
- Available on the Enterprise plan, to any Logpush destination

If you're running WebSocket-based services at enterprise scale, this is a genuinely welcome update that should make incident investigation much easier!