Monitoring Cloudflare Logs with ClickStack

3. Click **Save Source**

This maps Cloudflare's native columns directly to HyperDX's log viewer without any data transformation or duplication. The **Body** displays a request summary like `GET /api/v1/users 200`, and all Cloudflare fields are available as searchable attributes.

Verify data in HyperDX

#### Verify data in HyperDX[​](#verify-hyperdx "Direct link to Verify data in HyperDX")

Navigate to the **Search** view and select the **Cloudflare Logs** source. Set the time range to cover your data. You should see log entries with:

- Request summaries in the Body column (e.g., `GET /api/v1/users 200`)
- Severity levels color-coded by HTTP status (INFO for 2xx, WARN for 4xx, ERROR for 5xx)
- Searchable attributes like `http.status_code`, `client.country`, `cache.status`, and `bot.score`

## Demo dataset[​](#demo-dataset "Direct link to Demo dataset")

For users who want to test the integration before configuring their production Cloudflare Logpush, we provide a sample dataset with realistic HTTP request logs.

Start ClickPipes with the demo dataset

#### Start ClickPipes with the demo dataset[​](#start-demo "Direct link to Start ClickPipes with the demo dataset")

1. ClickHouse Cloud Console → **Data Sources** → **Create ClickPipe**
2. **Source**: Amazon S3
3. **Authentication**: Public
4. **S3 file path**: `https://datasets-documentation.s3.eu-west-3.amazonaws.com/clickstack-integrations/cloudflare/cloudflare-http-logs.json`
5. Click **Incoming data**
6. Select **JSON** as the format
7. Click **Parse information** and review the detected schema
8. Set the **Table name** to `cloudflare_http_logs`
9. Click **Complete Setup**

The dataset includes 5,000 HTTP request log entries spanning 24 hours with realistic patterns including traffic from multiple countries, cache hits and misses, API and static asset requests, error responses, and security events.

Configure HyperDX data source

#### Configure HyperDX data source[​](#configure-demo-source "Direct link to Configure HyperDX data source")

Follow the [data source configuration steps](#configure-source) to create a HyperDX source pointing to the `cloudflare_http_logs` table. If you already configured the source in the production integration section, this step is not needed.

Verify demo data

#### Verify demo data[​](#verify-demo "Direct link to Verify demo data")

```
SELECT count() FROM cloudflare_http_logs;
-- Should return 5000
```

Navigate to the **Search** view in HyperDX, select the **Cloudflare Logs** source, and set the time range to **2026-02-23 00:00:00 - 2026-02-26 00:00:00**.

You should see log entries with request summaries, searchable Cloudflare attributes, and severity levels based on HTTP status codes.

Timezone Display

HyperDX displays timestamps in your browser's local timezone. The demo data spans **2026-02-24 00:00:00 - 2026-02-25 00:00:00 (UTC)**. The wide time range ensures you'll see the demo logs regardless of your location. Once you see the logs, you can narrow the range to a 24-hour period for clearer visualizations.

## Dashboards and visualization[​](#dashboards "Direct link to Dashboards and visualization")

Download the dashboard configuration

#### [Download](/docs/examples/cloudflare-logs-dashboard.json) the dashboard configuration[​](#download "Direct link to download")

Import dashboard

#### Import dashboard[​](#import-dashboard "Direct link to Import dashboard")

1. HyperDX → **Dashboards** → **Import Dashboard**

2. Upload `cloudflare-logs-dashboard.json` → **Finish Import**

View dashboard

#### View dashboard[​](#view-dashboard "Direct link to View dashboard")

Note

For the demo dataset, set the time range to **2026-02-24 00:00:00 - 2026-02-25 00:00:00 (UTC)** (adjust based on your local timezone). The imported dashboard won't have a time range specified by default.

## Troubleshooting[​](#troubleshooting "Direct link to Troubleshooting")

### Data not appearing in ClickHouse[​](#no-data "Direct link to Data not appearing in ClickHouse")

Verify the table was created and contains data:

```
SHOW TABLES FROM default LIKE 'cloudflare_http_logs';
SELECT count() FROM cloudflare_http_logs;
```

If the table exists but is empty, check ClickPipes for errors: ClickHouse Cloud Console → **Data Sources** → Your ClickPipe → **Logs**. For authentication issues with private buckets, see the [S3 ClickPipes access control documentation](/docs/integrations/clickpipes/object-storage/s3/overview#access-control).

### Logs not appearing in HyperDX[​](#no-hyperdx "Direct link to Logs not appearing in HyperDX")

If data is in ClickHouse but not visible in HyperDX, check the data source configuration:

- Verify a source exists for `cloudflare_http_logs` under HyperDX → **Team Settings** → **Sources**
- Ensure the **Timestamp Column** is set to `toDateTime(EdgeStartTimestamp / 1000000000)` — Cloudflare timestamps are in nanoseconds and need to be converted
- Verify your time range in HyperDX covers the data. For the demo dataset, use **2026-02-23 00:00:00 - 2026-02-26 00:00:00**

## Next steps[​](#next-steps "Direct link to Next steps")

- Set up [alerts](/docs/use-cases/observability/clickstack/alerts) for security events (WAF blocks, bot traffic spikes, error rate thresholds)
- Optimize [retention policies](/docs/use-cases/observability/clickstack/ttl) based on your data volume
- Create additional dashboards for specific use cases (API performance, cache optimization, geographic traffic analysis)

## Going to production[​](#going-to-production "Direct link to Going to production")

This guide demonstrates ingesting Cloudflare logs using a public demo dataset. For production deployments, configure Cloudflare Logpush to write to your own S3 bucket and set up ClickPipes with [IAM role-based authentication](/docs/cloud/data-sources/secure-s3) for secure access. Select only the [Logpush fields](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/zone/http_requests/) you need to reduce storage costs and ingestion volume. Enable daily subfolders in Logpush for better file organization and use `**/*` in your ClickPipes path pattern to match across subdirectories.

See the [S3 ClickPipes documentation](/docs/integrations/clickpipes/object-storage/s3/overview) for advanced configuration options including [SQS-based unordered ingestion](/docs/integrations/clickpipes/object-storage/s3/overview#continuous-ingestion-any-order) for handling backfills and out-of-order files.

- [Overview](#overview)- [Integration with existing Cloudflare Logpush](#existing-cloudflare)
    - [Prerequisites](#prerequisites)- [Demo dataset](#demo-dataset)- [Dashboards and visualization](#dashboards)- [Troubleshooting](#troubleshooting)
          - [Data not appearing in ClickHouse](#no-data)- [Logs not appearing in HyperDX](#no-hyperdx)- [Next steps](#next-steps)- [Going to production](#going-to-production)

Was this page helpful?