← Log Explorer / log-explorer

Manage datasets

Log Explorer allows you to enable, disable, or delete datasets available to query in Log Search.

Log Explorer currently supports the following datasets:

• HTTP Requests (http_requests)
• Firewall Events (firewall_events)
• DNS Logs (dns_logs)
• NEL Reports (nel_reports)
• Page Shield Events (page_shield_events) (events for client-side security)
• Spectrum Events (spectrum_events)
• Zaraz Events (zaraz_events)

• Access requests (access_requests)
• CASB findings (casb_findings)
• Device posture results (device_posture_results)
• Gateway DNS (gateway_dns)
• Gateway HTTP (gateway_http)
• Gateway Network (gateway_network)
• Zero Trust Network Session Logs (zero_trust_network_sessions)
• Audit Logs (audit_logs)
• Audit_logs_v2 (audit_logs_v2)
• Browser Isolation User Actions (biso_user_actions)
• DNS firewall logs (dns_firewall_logs)
• Email security alerts (email_security_alerts)
• Magic IDS Detections (magic_ids_detections)
• Network Analytics (network_analytics_logs)
• Sinkhole HTTP Logs (sinkhole_http_logs)
• IP Sec Logs (ipsec_logs)

In order for Log Explorer to begin storing logs, you need to enable the desired datasets. You can do this via the dashboard or the API.

1. In the Cloudflare dashboard, go to the Log Explorer > Manage datasets page.

   Go to Manage datasets ↗

2. Select Add dataset to select the datasets you want to query.

3. Choose a dataset and then a zone. Then, select Add. You can always return to this page to enable more datasets or manage your existing ones.

If you are using the API, Use the Log Explorer API to enable Log Explorer for each dataset you wish to store. It may take a few minutes after a log stream is enabled before you can view the logs.

The following curl command is an example for enabling the zone-level dataset http_requests, as well as the expected response when the command succeeds.

curl https://api.cloudflare.com/client/v4/zones/{zone_id}/logs/explorer/datasets \
--header "Authorization: Bearer <API_TOKEN>" \
--json '{
  "dataset": "http_requests"
}'

{
	"result": {
		"dataset": "http_requests",
		"object_type": "zone",
		"object_id": "<ZONE ID>",
		"created_at": "2025-06-03T14:33:16Z",
		"updated_at": "2025-06-03T14:33:16Z",
		"dataset_id": "01973635f7e273a1964a02f4d4502499",
		"enabled": true,
		"deletion_protection": true
	},
	"success": true,
	"errors": [],
	"messages": []
}

To enable an account-level dataset, replace zones/{zone_id} with accounts/{account_id} in the curl command. For example:

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/logs/explorer/datasets \
--header "Authorization: Bearer <API_TOKEN>" \
--json '{
  "dataset": "access_requests"
}'

Deleting a dataset permanently removes the dataset and its stored data. Deletion runs asynchronously. You cannot recreate the same dataset for the account or zone while deletion is in progress.