> For the complete documentation index, see [llms.txt](https://docs.airops.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.airops.com/insights/settings/cloudflare-logpush-agent-analytics.md).

# Cloudflare Logpush Agent Analytics

This guide walks you through configuring Cloudflare to stream into AirOps via **Logpush**. Once connected, AirOps automatically analyzes your traffic, classifies AI bot visits (ChatGPT, Claude, Perplexity, Google, and more), and surfaces insights in your Agent Analytics dashboard.

Logpush is a native, Cloudflare-managed feature that batches request logs and delivers them to an HTTP endpoint. Unlike the [Workers integration](/insights/settings/cloudflare-worker-agent-analytics.md), it requires no code to deploy or maintain, but it is only available on the **Enterprise** plan.

{% hint style="info" %}
**Logpush or Worker?** Use **Logpush** if you are on a Cloudflare Enterprise plan. It is the easiest option and requires no code. If you are on any other plan, use the [Cloudflare Worker integration](/insights/settings/cloudflare-worker-agent-analytics.md) instead, where you deploy and maintain a small Worker.
{% endhint %}

***

## Prerequisites

* An active **AirOps** account with Agent Analytics enabled
* A **Cloudflare** account on the **Enterprise** plan (Logpush is Enterprise-only)
* Admin access to the Cloudflare zone serving your website
* Your **Workspace API key**, available in `Settings → Workspace`
* Your **Brand Kit ID**, available in the URL by navigating to `Context → Brand Kits`. The URL takes the form `https://app.airops.com/<YOUR_WORKSPACE_SLUG>/data/brand_kits/<YOUR_BRAND_KIT_ID>`

***

## Dashboard Setup

The dashboard setup is the **recommended** approach for most websites. Logpush buffers per-request log events and delivers them to AirOps in compressed batches on its own cadence.

### Step 1: Create a Logpush Job

1. Open the **Cloudflare dashboard** and select the domain serving your website. Logpush jobs are domain-specific, so you must be inside the specific domain (zone) you want to track, not the account-level view.
2. In the left navigation, expand **Investigate** and select **Logpush**.
3. Click **Create a Logpush job**.
4. For the dataset, select **HTTP requests**.

### Step 2: Select Log Fields

Select the following fields. AirOps uses these for full analytics, and sending additional fields is harmless.

| Field                    | Required |
| ------------------------ | -------- |
| `EdgeStartTimestamp`     | Yes      |
| `EdgeEndTimestamp`       | Yes      |
| `EdgeResponseStatus`     | Yes      |
| `EdgeResponseBytes`      | Yes      |
| `ClientIP`               | Yes      |
| `ClientRequestMethod`    | Yes      |
| `ClientRequestScheme`    | Yes      |
| `ClientRequestHost`      | Yes      |
| `ClientRequestURI`       | Yes      |
| `ClientRequestUserAgent` | Yes      |
| `ClientRequestReferer`   | Yes      |
| `ClientCountry`          | Yes      |
| `ClientDeviceType`       | Yes      |

### Step 3: Configure the HTTP Destination

Set the destination type to **HTTP destination** and enter the AirOps ingest endpoint as the destination URL. Your Workspace API key is passed as a custom request header.

| Setting             | Value                                                                                                                      |
| ------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| **Destination URL** | `https://ingest.airops.com/api/v1/cloudflare-logpush/<YOUR_BRAND_KIT_ID>/ingest?header_X-API-Key=<YOUR_WORKSPACE_API_KEY>` |

{% hint style="info" %}
Cloudflare attaches custom request headers as query parameters in the form `header_<Name>=<Value>`. The `header_X-API-Key=<YOUR_WORKSPACE_API_KEY>` parameter is how Cloudflare sends your AirOps Workspace API key with each delivery.
{% endhint %}

### Step 4: Complete the Ownership Challenge

Before the job can be created, Cloudflare verifies that you own the destination. Cloudflare POSTs an ownership token to the destination URL. Retrieve that token and paste it back into the Cloudflare dashboard to complete verification.

### Step 5: Enable the Job

1. Review the job configuration.
2. Enable the job to begin delivering logs.

### Step 6: Verify the Connection

After enabling the Logpush job, data should begin flowing within **a few minutes** (Logpush batches before sending).

1. In the **Cloudflare dashboard**, check the Logpush job's delivery status. A recent successful delivery means data is reaching AirOps.
2. In your **AirOps dashboard**, navigate to **Agent Analytics**. The Cloudflare source moves to a connected state, and bot traffic populates once crawlers hit your site.

***

## API Setup

You can also create the Logpush job programmatically using the Cloudflare API. This is useful for scripting or managing many zones. You will need a Cloudflare API token with the **Logs Edit** permission and your **Zone ID**.

```bash
curl --request POST \
  "https://api.cloudflare.com/client/v4/zones/<YOUR_ZONE_ID>/logpush/jobs" \
  --header "Authorization: Bearer <YOUR_CLOUDFLARE_API_TOKEN>" \
  --header "Content-Type: application/json" \
  --data '{
    "name": "airops-log-collector",
    "dataset": "http_requests",
    "destination_conf": "https://ingest.airops.com/api/v1/cloudflare-logpush/<YOUR_BRAND_KIT_ID>/ingest?header_X-API-Key=<YOUR_WORKSPACE_API_KEY>",
    "output_options": {
      "field_names": [
        "EdgeStartTimestamp",
        "EdgeEndTimestamp",
        "EdgeResponseStatus",
        "EdgeResponseBytes",
        "ClientIP",
        "ClientRequestMethod",
        "ClientRequestScheme",
        "ClientRequestHost",
        "ClientRequestURI",
        "ClientRequestUserAgent",
        "ClientRequestReferer",
        "ClientCountry",
        "ClientDeviceType"
      ],
      "timestamp_format": "rfc3339"
    },
    "enabled": true
  }'
```

{% hint style="info" %}
The `<YOUR_WORKSPACE_API_KEY>` passed in the `destination_conf` should be the same value as your Workspace API key, available in `Settings → Workspace`. When you create the job via the API, Cloudflare still requires the ownership-challenge step described above before deliveries begin.
{% endhint %}

***

## What to Expect After Setup

* Logs start reaching the **HTTP destination** you configured within **minutes**. Logpush batches log events on its own cadence before delivering them. This is the delivery time to that endpoint, not when traffic shows up in your dashboard.
* Agent Analytics displays **AI bot and crawler traffic only**. Human browsing is not shown.
* A brand kit shows as configured once Logpush delivers its first batch. Specific pages appear once a bot crawls a tracked page.

***

## If You Don't See Data

| Symptom                                          | Likely Cause                             | Fix                                                                                                           |
| ------------------------------------------------ | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
| Cloudflare job shows delivery errors / non-2xx   | Destination URL or auth is misconfigured | Recheck the Brand Kit ID in the URL and confirm `?header_X-API-Key=` is your current AirOps Workspace API key |
| Cloudflare shows `401` / `403` responses         | Wrong or rotated key, or wrong workspace | Verify the API key is current and that the Brand Kit is owned by that workspace                               |
| Successful delivery but Agent Analytics is empty | Expected: only bot traffic is displayed  | Wait for a crawler to visit; human visits are not shown                                                       |
| First bot rows haven't appeared yet              | Crawl timing                             | First visible rows appear whenever a crawler next visits, which depends on crawl frequency                    |

If you are still stuck, contact AirOps support with your **Brand Kit ID** and the Logpush job's **delivery status**.

***

## Stopping or Disconnecting

To stop sending data to AirOps, disable or delete the Logpush job in the Cloudflare dashboard. Rotating your AirOps Workspace API key also stops delivery, since Cloudflare will continue sending the old key.

***

## What AirOps Tracks

Once connected, AirOps automatically:

* **Ingests your Cloudflare request logs** via Logpush
* **Classifies AI bot traffic**: identifies visits from ChatGPT, Claude, Google, Perplexity, Gemini, Meta, Apple, Bing, ByteDance, Common Crawl, and others
* **Categorizes crawl behavior**: distinguishes between AI training crawlers, AI search fetches, AI indexing, and user-initiated AI browsing
* **Surfaces analytics**: AI bot and crawler traffic breakdowns and crawl trends in your dashboard


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.airops.com/insights/settings/cloudflare-logpush-agent-analytics.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.