Cloudflare Expands Log Explorer With 14 New Datasets

Onyx4 weeks ago

0 1 5 minutes read

Cloudflare’s Log Explorer Takes Observability Further With Major Dataset Expansion

Cloudflare has taken a decisive step forward in its observability offerings by expanding Log Explorer with 14 new product datasets. This update, announced on December 7, addresses long-standing needs for more comprehensive log visibility across its suite, while also fixing critical issues in SQL date filter consistency. The enhancements meet the rising demands of developers and security analysts for reliable, native insights, streamlining how they investigate, debug, and monitor network and application activity on Cloudflare’s global infrastructure.

A Significant Step for Native Observability

Observability—the ability to understand a complex system’s internal state from its outputs—has become a cornerstone of modern security and DevOps. Cloudflare’s Log Explorer is central to its mission to provide affordable, flexible, and accessible observability directly within the Cloudflare dashboard. By removing the need for third-party storage and tool integrations, Log Explorer aims to accelerate incident response, reduce operational costs, and strengthen data governance.

With the latest update, the breadth and depth of available data have grown substantially. Now, engineers, developers, and security professionals can correlate security, performance, and network events in a single interface, all while benefiting from enhancements in query reliability and flexibility.

The 14 New Datasets: Expanded Horizons for Investigation

The heart of the recent update lies in the addition of 14 product-specific log datasets. These cover a spectrum of operational and security events at both the zone (domain) and account level, allowing for richer, multidimensional analysis. The expanded datasets include:

Zone-Level Datasets:
- Dns_logs
- Nel_reports
- Page_shield_events
- Spectrum_events
- Zaraz_events
Account-Level Datasets:
- Audit Logs
- Audit_logs_v2
- Biso_user_actions
- DNS firewall logs
- Email_security_alerts
- Magic Firewall IDS
- Network Analytics
- Sinkhole HTTP
- ipsec_logs

This expansion opens the door for advanced threat hunting, historical forensics, compliance tracking, and holistic performance diagnostics. For instance, when investigating a suspicious IP seen in a firewall log, a user can now seamlessly pivot into correlated network analytics or policy bypass logs—all from within the Log Explorer interface.

The official changelog highlights how these new datasets facilitate “full context” for investigations, making it easier to piece together events that may span different services, account scopes, or timeframes.

SQL Date Filter: Precision and Predictability Restored

Alongside the new datasets, Cloudflare addressed a notorious pain point: inconsistencies between custom SQL date field filters and the date picker dropdown. This bug fix ensures that time-sensitive queries behave as expected, with custom and dropdown filtering in sync—critical for incident response, regulatory inquiries, and debugging elusive bugs.

The change provides users smoother, more accurate log querying and ultimately increases trust in the Log Explorer’s outputs. With reliable temporal filtering, teams can create saved searches and dashboards with confidence, especially when tracking fast-moving or intermittent issues.

Why This Matters: Developer and Security Team Impacts

The Log Explorer’s dataset expansion and filter improvements are rooted in concrete, operational benefits for its user base:

Break Down Silos: Log Explorer now allows for complex, cross-functional analysis without leaving the Cloudflare dashboard or wrangling exports across multiple tools.
Faster Debugging: Developers and site reliability engineers can correlate metrics and events across the application, infrastructure, and security stack, expediting root cause analysis.
Improved Collaboration: With native search, audit logs, and rich dataset support, multiple teams (DevOps, Security, Compliance) stay in sync on emerging issues or policy violations.
Streamlined Compliance: Detailed and structured datasets assist in meeting standards for audit trails, user activity monitoring, and data access reviews.
Cost Efficiency: By leveraging Cloudflare’s own storage (powered by R2 and Delta Lake protocol), organizations reduce reliance on costly third-party log aggregation solutions.

Fundamentally, these improvements reduce the lag between detection and action—a core concern as cloud and network threats grow more sophisticated and regulatory demands sharpen.

How Log Explorer Works: A Technical Overview

At its core, Log Explorer leverages Cloudflare’s R2 object storage and the Delta Lake protocol to store data in ACID-compliant, high-performance single-tenant Delta tables, isolated per customer for security and flexibility. This approach enables scalable querying, future-proof retention policies, and straightforward integration with other Cloudflare-native analytics tools.

The SQL-based interface—now reinforced with fine-tuned date filtering—allows engineers to specify exact combinations of columns, timeframes, and filters. Best practices recommend focused queries such as SELECT rayId or SELECT COUNT(*) to improve response times and avoid the inefficiency of SELECT *.

Users access Log Explorer directly within the Cloudflare dashboard. The experience is designed for rapid workflows: select a dataset, define the view, set the desired time window, and retrieve actionable insights without exporting data or stitching together external feeds.

Log Explorer’s Evolution: A Timeline of Enhancements

June 2025: Cloudflare announces general availability of Log Explorer, bringing in-platform log search and analysis out of beta.
July 2025: Usage tracking for log volume and billing becomes available, empowering administrators to observe consumption and costs in real time.
August 2025: Extended log retention up to two years is introduced for contract customers, at $0.10 per GB per month—supporting long-term forensic and compliance needs.
September 2025: The results table is rebuilt with sortable columns, column visibility managers, and rapid copying functions for smoother data handling.
Early November 2025: Distribution charts and resizable custom SQL query windows are rolled out, refining the user experience for complex workflows and data visualizations.
December 2025: The current update lands with expanded datasets and improvements to date-based queries.

Each step of this timeline reveals Cloudflare’s commitment to continuous improvement and the incremental delivery of user-requested features.

Security, Compliance, and the Future of Log Explorer

Cloudflare’s native approach is particularly significant as organizations grapple with stricter compliance mandates, data localization laws, and escalating threat landscapes. Having logs stored within Cloudflare’s infrastructure—without external third-party dependency—means organizations retain tighter control over sensitive data and reduce latency between detection and response.

The new datasets bolster Zero Trust observability. As organizations adopt more complex architectures—blending web applications, APIs, email systems, and network edge services—the need to correlate events across these domains intensifies. Security teams can now watch for emergent threats, validate policy adherence, and fine-tune defensive postures using fine-grained, real-time evidence.

In industry discussions, Cloudflare leadership has pointed to these features as foundational for native monitoring, rapid forensics, and unified dashboarding. Extended retention, detailed audit logs, and dataset-level query control further position Log Explorer as a central hub for not only security and operations but also for compliance and business analysts.

Accessible Resources and Further Reading

What’s Next for Cloudflare Log Explorer?

As digital infrastructure grows more intricate and attack surfaces expand, the need for unified, in-platform observability continues to mount. With its latest expansion, Cloudflare cements its position as a leader in accessible log management, giving users the tools to see further, act faster, and collaborate smarter. The addition of these datasets, combined with technical refinements, represents not just a feature update, but a foundational improvement in how teams pursue security, performance, and operational excellence within today’s digital economy.

Onyx4 weeks ago

0 1 5 minutes read