Cloudflare Logpush Agent Analytics

This guide walks you through configuring Cloudflare Logpush to stream HTTP request logs into AirOps for Agent Analytics.

This guide walks you through configuring Cloudflare to stream into AirOps via Logpush. Once connected, AirOps automatically analyzes your traffic, classifies AI bot visits (ChatGPT, Claude, Perplexity, Google, and more), and surfaces insights in your Agent Analytics dashboard.

Logpush is a native, Cloudflare-managed feature that batches request logs and delivers them to an HTTP endpoint. Unlike the Workers integration, it requires no code to deploy or maintain, but it is only available on the Enterprise plan.

Logpush or Worker? Use Logpush if you are on a Cloudflare Enterprise plan. It is the easiest option and requires no code. If you are on any other plan, use the Cloudflare Worker integration instead, where you deploy and maintain a small Worker.

---

Prerequisites

• An active AirOps account with Agent Analytics enabled
• A Cloudflare account on the Enterprise plan (Logpush is Enterprise-only)
• Admin access to the Cloudflare zone serving your website
• Your Workspace API key, available in Settings → Workspace
• Your Brand Kit ID, available in the URL by navigating to Context → Brand Kits. The URL takes the form https://app.airops.com/<YOUR_WORKSPACE_SLUG>/data/brand_kits/<YOUR_BRAND_KIT_ID>

---

Dashboard Setup

The dashboard setup is the recommended approach for most websites. Logpush buffers per-request log events and delivers them to AirOps in compressed batches on its own cadence.

Step 1: Create a Logpush Job

1. Open the Cloudflare dashboard and select the domain serving your website. Logpush jobs are domain-specific, so you must be inside the specific domain (zone) you want to track, not the account-level view.
2. In the left navigation, expand Investigate and select Logpush.
3. Click Create a Logpush job.
4. For the dataset, select HTTP requests.

Step 2: Select Log Fields

Select the following fields. AirOps uses these for full analytics, and sending additional fields is harmless.

Field	Required
EdgeStartTimestamp	Yes
EdgeEndTimestamp	Yes
EdgeResponseStatus	Yes
EdgeResponseBytes	Yes
ClientIP	Yes
ClientRequestMethod	Yes
ClientRequestScheme	Yes
ClientRequestHost	Yes
ClientRequestURI	Yes
ClientRequestUserAgent	Yes
ClientRequestReferer	Yes
ClientCountry	Yes
ClientDeviceType	Yes

Step 3: Configure the HTTP Destination

Set the destination type to HTTP destination and enter the AirOps ingest endpoint as the destination URL. Your Workspace API key is passed as a custom request header.

Setting	Value
Destination URL	https://ingest.airops.com/api/v1/cloudflare-logpush/<YOUR_BRAND_KIT_ID>/ingest?header_X-API-Key=<YOUR_WORKSPACE_API_KEY>

Cloudflare attaches custom request headers as query parameters in the form header_<Name>=<Value>. The header_X-API-Key=<YOUR_WORKSPACE_API_KEY> parameter is how Cloudflare sends your AirOps Workspace API key with each delivery.

Step 4: Complete the Ownership Challenge

Before the job can be created, Cloudflare verifies that you own the destination. Cloudflare POSTs an ownership token to the destination URL. Retrieve that token and paste it back into the Cloudflare dashboard to complete verification.

Step 5: Enable the Job

1. Review the job configuration.
2. Enable the job to begin delivering logs.

Step 6: Verify the Connection

After enabling the Logpush job, data should begin flowing within a few minutes (Logpush batches before sending).

1. In the Cloudflare dashboard, check the Logpush job's delivery status. A recent successful delivery means data is reaching AirOps.
2. In your AirOps dashboard, navigate to Agent Analytics. The Cloudflare source moves to a connected state, and bot traffic populates once crawlers hit your site.

---

API Setup

You can also create the Logpush job programmatically using the Cloudflare API. This is useful for scripting or managing many zones. You will need a Cloudflare API token with the Logs Edit permission and your Zone ID.

curl --request POST \
  "https://api.cloudflare.com/client/v4/zones/<YOUR_ZONE_ID>/logpush/jobs" \
  --header "Authorization: Bearer <YOUR_CLOUDFLARE_API_TOKEN>" \
  --header "Content-Type: application/json" \
  --data '{
    "name": "airops-log-collector",
    "dataset": "http_requests",
    "destination_conf": "https://ingest.airops.com/api/v1/cloudflare-logpush/<YOUR_BRAND_KIT_ID>/ingest?header_X-API-Key=<YOUR_WORKSPACE_API_KEY>",
    "output_options": {
      "field_names": [
        "EdgeStartTimestamp",
        "EdgeEndTimestamp",
        "EdgeResponseStatus",
        "EdgeResponseBytes",
        "ClientIP",
        "ClientRequestMethod",
        "ClientRequestScheme",
        "ClientRequestHost",
        "ClientRequestURI",
        "ClientRequestUserAgent",
        "ClientRequestReferer",
        "ClientCountry",
        "ClientDeviceType"
      ],
      "timestamp_format": "rfc3339"
    },
    "enabled": true
  }'

The <YOUR_WORKSPACE_API_KEY> passed in the destination_conf should be the same value as your Workspace API key, available in Settings → Workspace. When you create the job via the API, Cloudflare still requires the ownership-challenge step described above before deliveries begin.

---

What to Expect After Setup

• Logs start reaching the HTTP destination you configured within minutes. Logpush batches log events on its own cadence before delivering them. This is the delivery time to that endpoint, not when traffic shows up in your dashboard.
• Agent Analytics displays AI bot and crawler traffic only. Human browsing is not shown.
• A brand kit shows as configured once Logpush delivers its first batch. Specific pages appear once a bot crawls a tracked page.

---

If You Don't See Data

Symptom	Likely Cause	Fix
Cloudflare job shows delivery errors / non-2xx	Destination URL or auth is misconfigured	Recheck the Brand Kit ID in the URL and confirm ?header_X-API-Key= is your current AirOps Workspace API key
Cloudflare shows 401 / 403 responses	Wrong or rotated key, or wrong workspace	Verify the API key is current and that the Brand Kit is owned by that workspace
Successful delivery but Agent Analytics is empty	Expected: only bot traffic is displayed	Wait for a crawler to visit; human visits are not shown
First bot rows haven't appeared yet	Crawl timing	First visible rows appear whenever a crawler next visits, which depends on crawl frequency

If you are still stuck, contact AirOps support with your Brand Kit ID and the Logpush job's delivery status.

---

Stopping or Disconnecting

To stop sending data to AirOps, disable or delete the Logpush job in the Cloudflare dashboard. Rotating your AirOps Workspace API key also stops delivery, since Cloudflare will continue sending the old key.

---

What AirOps Tracks

Once connected, AirOps automatically:

• Ingests your Cloudflare request logs via Logpush
• Classifies AI bot traffic: identifies visits from ChatGPT, Claude, Google, Perplexity, Gemini, Meta, Apple, Bing, ByteDance, Common Crawl, and others
• Categorizes crawl behavior: distinguishes between AI training crawlers, AI search fetches, AI indexing, and user-initiated AI browsing
• Surfaces analytics: AI bot and crawler traffic breakdowns and crawl trends in your dashboard