Cloudflare LogPush source plugin - Cortex XCOR Documentation

This information is for Palo Alto Networks Telemetry Pipeline, which is a standalone product separate from Palo Alto Networks Cortex XCOR.

Requires pipeline agent v25.3.8 or later.

The Cloudflare LogPush source plugin (name: cloudflare) lets you ingest data from Cloudflare LogPush jobs into a telemetry pipeline. This is a push-based source plugin.

This plugin doesn’t support duplicates of itself within the same pipeline.

Supported telemetry types

The Cloudflare LogPush source plugin for Palo Alto Networks Telemetry Pipeline supports these telemetry types:

Logs	Metrics	Traces

Configuration parameters

Use the parameters in this section to configure the Cloudflare LogPush source plugin. The Palo Alto Networks Telemetry Pipeline web interface uses the items in the Name column to describe these parameters. Pipeline configuration files use the items in the Key column as YAML keys.

General

Name	Key	Description	Default
Port	`addr`	The port where Palo Alto Networks Telemetry Pipeline will listen for incoming data. In the Palo Alto Networks Telemetry Pipeline web interface, you only need to specify the actual port number. In pipeline configuration files, this value combines the network interface and port number. The network interface for this plugin is always `0.0.0.0`.	`9880` in the web interface, `0.0.0.0:9880` in pipeline configuration files

Security and TLS

Name	Key	Description	Default
HTTP Username	`http_user`	Your username for HTTP basic authentication, if applicable.	none
HTTP Password	`http_passwd`	Your password for HTTP basic authentication, if applicable.	none
TLS Certificate	`cert_file`	The path to your TLS certificate file, if applicable.	none
TLS Key	`key_file`	The path to your TLS key file, if applicable.	none

Ownership Challenge

Name	Key	Description	Default
Skip Ownership Challenge	`skipownershipchallenge`	If `false`, this plugin will trigger a Cloudflare ownership challenge. If `true`, this plugin won’t trigger an ownership challenge.	`true`
Cloudflare API Key or API Token	`cloudflareapikey`	Required if Skip Ownership Challenge is `false`. The Cloudflare API key or API token to use in the ownership challenge. This parameter supports plain text values and the environment variables `CLOUDFLARE_API_TOKEN` and `CLOUDFLARE_API_KEY`.	none
Cloudflare Email	`cloudflareemail`	Required if Skip Ownership Challenge is `false` and if using key-based authentication, but not token-based authentication. The email address associated with your Cloudflare account. In addition to plain text values, this parameter supports the environment variable `CLOUDFLARE_EMAIL`.	none
Destination	`destination`	Required if Skip Ownership Challenge is `false`. The HTTP destination that you configured for your LogPush job. This parameter supports plain text values and the environment variable `CLOUDFLARE_DESTINATION`.	none
Cloudflare Account ID	`cloudflareaccountid`	Required if Skip Ownership Challenge is `false` and if Cloudflare Zone ID is unset. The Cloudflare account ID associated with your LogPush job. This parameter supports plain text values and the environment variable `CLOUDFLARE_ACCOUNT_ID`.	none
Cloudflare Zone ID	`cloudflarezoneid`	Required if Skip Ownership Challenge is `false` and if Cloudflare Account ID is unset. The Cloudflare zone ID associated with your LogPush job. This parameter supports plain text values and the environment variable `CLOUDFLARE_ZONE_ID`.	none

Advanced

Name	Key	Description	Default
Response Headers	`resp_headers`	The header for Palo Alto Networks Telemetry Pipeline to include in responses to Cloudflare. To include multiple headers, include each header as a new line. Supports templating.	`Content-Type:application/json`
Response Status Code	`resp_status_code`	The HTTP status code for Palo Alto Networks Telemetry Pipeline to include in responses to Cloudflare.	`200`
Response Body	`resp_body`	The response body for Palo Alto Networks Telemetry Pipeline to send to Cloudflare. Supports templating.	`{"status": "ok"}`
Time Extraction Template	`time_from`	The template to extract time data from logs. For example, if your logs use the RFC3339 time format, set the value `{{.Format time.RFC3339Nano}}`. If no value is set, Palo Alto Networks Telemetry Pipeline assigns a timestamp to each log based on when Palo Alto Networks Telemetry Pipeline receives that log.	none
Cloudflare Base URL	`baseurl`	Required if Skip Ownership Challenge is `false`. The Cloudflare API base URL to use in the ownership challenge. This parameter supports plain text values and the environment variable `CLOUDFLARE_BASE_URL`.	`https://api.cloudflare.com/client/v4/`
Memory Buffer Limit	`mem_buf_limit`	Sets a limit for how much buffered data the plugin can write to memory, which affects backpressure. This value must follow Fluent Bit’s rules for unit sizes. If unspecified, no limit is enforced. For v2 pipelines, this parameter affects only pipelines with the Deployment or DaemonSet workload type. To learn more, see the v2 backpressure guide. For v3 pipelines, this parameter is independent from the OpenTelemetry `memory_limiter` and `batch` processors.	none

LogPush jobs

For information about setting up Cloudflare LogPush jobs, consult the Cloudflare LogPush Enable HTTP destination guide. When you create a new LogPush job in Cloudflare, there might be a delay before data from that job starts flowing to Palo Alto Networks Telemetry Pipeline. Similarly, when you delete a LogPush job in Cloudflare, there might be a delay before data stops flowing. These delays can range anywhere from a few minutes to 15 minutes.

Ownership challenge

You can set Skip Ownership Challenge to false to trigger a one-time Cloudflare ownership challenge for enhanced security and safety. However, this ownership challenge is optional, and it’s possible to send LogPush data to Palo Alto Networks Telemetry Pipeline without it.

If you trigger an ownership challenge outside of Palo Alto Networks Telemetry Pipeline, the ensuing challenge response will appear in your pipeline logs, including tokens, and will be sent to any of your pipeline’s active destinations. This behavior occurs even when the Skip Ownership Challenge setting in Palo Alto Networks Telemetry Pipeline is set to true.

​Supported telemetry types

​Configuration parameters

​General

​Security and TLS

​Ownership Challenge

​Advanced

​LogPush jobs

​Ownership challenge

Supported telemetry types

Configuration parameters

General

Security and TLS

Ownership Challenge

Advanced

LogPush jobs

Ownership challenge