← Logs / logs / logpush / logpush-job / enable-destinations

Enable IBM Cloud Logs

Cloudflare Logpush supports pushing logs directly to IBM Cloud Logs via dashboard or API.

1. In the Cloudflare dashboard, go to the Logpush page at the account or or domain (also known as zone) level.

   For account: Go to Logpush ↗

   For domain (also known as zone): Go to Logpush ↗

2. Depending on your choice, you have access to account-scoped datasets and zone-scoped datasets, respectively.

3. Select Create a Logpush job.

4. In Select a destination, choose IBM Cloud Logs.

5. Enter the following destination information:

• HTTP Source Address - For example, ibmcl://<INSTANCE_ID>.ingress.<REGION>.logs.cloud.ibm.com/logs/v1/singles.
• IBM API Key - For more information refer to the IBM Cloud Logs documentation ↗.

When you are done entering the destination details, select Continue.

6. Select the dataset to push to the storage service.

7. In the next step, you need to configure your logpush job:

   • Enter the Job name.
   • Under If logs match, you can select the events to include and/or remove from your logs. Refer to Filters for more information. Not all datasets have this option available.
   • In Send the following fields, you can choose to either push all logs to your storage destination or selectively choose which logs you want to push.

8. In Advanced Options, you can:

   • Choose the format of timestamp fields in your logs (RFC3339 (default), Unix, or UnixNano).
   • Select a sampling rate for your logs or push a randomly-sampled percentage of logs.
   • Enable redaction for CVE-2021-44228. This option will replace every occurrence of ${ with x{.

9. Select Submit once you are done configuring your logpush job.

To set up an IBM Cloud Logs job:

1. Create a job with the appropriate endpoint URL and authentication parameters.
2. Enable the job to begin pushing logs.

To create a job, make a POST request to the Logpush jobs endpoint with the following fields:

• name (optional) - Use your domain name as the job name.
• output_options (optional) - This parameter is used to define the desired output format and structure. Below are the configurable fields:
  • output_type
  • timestamp_format
  • batch_prefix and batch_suffix
  • record_prefix and record_suffix
  • record_delimiter
• destination_conf - A log destination consisting of Instance ID, Region and IBM API Key ↗ in the string format below.

ibmcl://<INSTANCE_ID>.ingress.<REGION>.logs.cloud.ibm.com/logs/v1/singles?ibm_api_key=<IBM_API_KEY>

• max_upload_records (optional) - The maximum number of log lines per batch. This must be at least 1,000 lines or more. Note that there is no way to specify a minimum number of log lines per batch. This means that log files may contain many fewer lines than specified.
• max_upload_bytes (optional) - The maximum uncompressed file size for a batch of logs. We recommend a default value of 2 MB per upload based on IBM's limits, which our system will enforce for this destination. Since minimum file sizes cannot be set, log files may be smaller than the specified batch size.
• dataset - The category of logs you want to receive. Refer to Datasets for the full list of supported datasets.

Example request using cURL:

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/logpush/jobs" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "<DOMAIN_NAME>",
		"output_options": {
				"output_type": "ndjson",
				"timestamp_format": "rfc3339",
				"batch_prefix": "[",
				"batch_suffix": "]",
				"record_prefix": "{\"applicationName\":\"ibm-platform-log\",\"subsystemName\":\"internet-svcs:logpush\",\"text\":{",
				"record_suffix": "}}",
				"record_delimiter": ","
		},
		"destination_conf": "ibmcl://<INSTANCE_ID>.ingress.<REGION>.logs.cloud.ibm.com/logs/v1/singles?ibm_api_key=<IBM_API_KEY>",
		"max_upload_bytes": 2000000,
		"dataset": "http_requests",
		"enabled": true
	}'

Response:

{
  "errors": [],
  "messages": [],
  "result": {
    "id": <JOB_ID>,
    "dataset": "http_requests",
    "kind": "",
    "max_upload_bytes": 2000000,
    "enabled": true,
    "name": "<DOMAIN_NAME>",
    "output_options": {
      "output_type": "ndjson",
      "timestamp_format": "rfc3339",
      "batch_prefix": "[",
      "batch_suffix": "]",
      "record_prefix": "{\"applicationName\":\"ibm-platform-log\",\"subsystemName\":\"internet-svcs:logpush\",\"text\":{",
      "record_suffix": "}}",
      "record_delimiter": ","
    },
    "destination_conf": "ibmcl://<INSTANCE_ID>.ingress.<REGION>.logs.cloud.ibm.com/logs/v1/singles?ibm_api_key=<IBM_API_KEY>",
    "last_complete": null,
    "last_error": null,
    "error_message": null
  },
  "success": true
}

Refer to Manage Logpush with cURL to update a job (including enabling and disabling).