Logpush Can Now Filter Out DDoS Attack Traffic!

Hi, I'm Shii-chan! Today I found a nice quality-of-life update in the Cloudflare Changelog that makes log management a little easier. Logpush output that used to get flooded with DDoS attack logs should get a lot cleaner now!

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, Logpush jobs can now exclude traffic that Cloudflare has already identified as a DDoS attack. You can turn this on from the dashboard's Advanced Options by selecting "Exclude DDoS attack traffic," or by adding this field to an API job request:

{
  "filter_attack_traffic": true
}

It supports three datasets:

• http_requests
• firewall_events
• network_analytics_logs

The story so far

Until now, Logpush sent everything through as-is, legitimate requests and traffic that had already been blocked as a DDoS attack, all mixed together. The bigger the attack, the more the log volume ballooned right along with it.

What changes

This is great news for teams feeding logs into a SIEM or analytics pipeline. DDoS attack traffic tends to spike log volume dramatically the moment an attack starts, and individually inspecting each of those blocked requests rarely gives you much useful signal. Yet you still pay for the transfer, storage, and ingestion. Being able to drop attack traffic right at the Logpush output means less noise and lower cost on the log pipeline side, so the events you actually care about don't get buried.

Wrap-up

• Logpush jobs have a new option to exclude identified DDoS attack traffic
• Supported datasets: http_requests, firewall_events, and network_analytics_logs
• Enable it via the dashboard's "Exclude DDoS attack traffic" toggle, or set filter_attack_traffic: true through the API
• A handy setting for any team trying to cut cost and noise out of their log analytics pipeline!