> ## Documentation Index
> Fetch the complete documentation index at: https://docs-xcor.paloaltonetworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare LogPush source plugin

> Configure the Cloudflare LogPush source plugin in Palo Alto Networks Telemetry Pipeline to ingest logs for processing and routing.

export const entity_0 = "Cloudflare LogPush source plugin"

export const plugin_0 = "Cloudflare LogPush source plugin"

<Info>
  This information is for Palo Alto Networks Telemetry Pipeline, which is a standalone
  product separate from Palo Alto Networks Cortex XCOR.
</Info>

> Requires [pipeline agent](/ingest/pipeline/v2/component-versions) v25.3.8 or later.

The Cloudflare LogPush [source plugin](/ingest/pipeline/plugins/source-plugins)
(name: `cloudflare`) lets you ingest data from Cloudflare LogPush jobs into a
telemetry pipeline.

This is a
[push-based](/ingest/pipeline/plugins/source-plugins#push-based-and-pull-based-source-plugins)
source plugin.

<Note>
  This plugin doesn't support duplicates of itself within the same pipeline.
</Note>

## Supported telemetry types

The {plugin_0} for Palo Alto Networks Telemetry Pipeline supports these telemetry types:

| Logs | Metrics | Traces |
| :-: | :-: | :-: |
| <Icon icon="circle-check" color="green" /> | <Icon icon="ban" color="red" /> | <Icon icon="ban" color="red" /> |

## Configuration parameters

Use the parameters in this section to configure the {entity_0}. The
Palo Alto Networks Telemetry Pipeline web interface uses the items in the **Name** column to
describe these parameters. [Pipeline configuration files](/ingest/pipeline/v2/configure/config-files)
use the items in the **Key** column as YAML keys.

### General

| Name | Key | Description | Default |
| - | - | - | - |
| **Port** | `addr` | The port where Palo Alto Networks Telemetry Pipeline will listen for incoming data. In the Palo Alto Networks Telemetry Pipeline web interface, you only need to specify the actual port number. In pipeline configuration files, this value combines the network interface and port number. The network interface for this plugin is always `0.0.0.0`. | `9880` in the web interface, `0.0.0.0:9880` in pipeline configuration files |

### Security and TLS

| Name | Key | Description | Default |
| - | - | - | - |
| **HTTP Username** | `http_user` | Your username for HTTP basic authentication, if applicable. | *none* |
| **HTTP Password** | `http_passwd` | Your password for HTTP basic authentication, if applicable. | *none* |
| **TLS Certificate** | `cert_file` | The path to your TLS certificate file, if applicable. | *none* |
| **TLS Key** | `key_file` | The path to your TLS key file, if applicable. | *none* |

### Ownership Challenge

| Name | Key | Description | Default |
| - | - | - | - |
| **Skip Ownership Challenge** | `skipownershipchallenge` | If `false`, this plugin will trigger a [Cloudflare ownership challenge](#ownership-challenge). If `true`, this plugin won't trigger an ownership challenge. | `true` |
| **Cloudflare API Key or API Token** | `cloudflareapikey` | Required if **Skip Ownership Challenge** is `false`. The Cloudflare API key or API token to use in the ownership challenge. This parameter supports plain text values and the environment variables `CLOUDFLARE_API_TOKEN` and `CLOUDFLARE_API_KEY`. | *none* |
| **Cloudflare Email** | `cloudflareemail` | Required if **Skip Ownership Challenge** is `false` and if using key-based authentication, but not token-based authentication. The email address associated with your Cloudflare account. In addition to plain text values, this parameter supports the environment variable `CLOUDFLARE_EMAIL`. | *none* |
| **Destination** | `destination` | Required if **Skip Ownership Challenge** is `false`. The HTTP destination that you configured for your LogPush job. This parameter supports plain text values and the environment variable `CLOUDFLARE_DESTINATION`. | *none* |
| **Cloudflare Account ID** | `cloudflareaccountid` | Required if **Skip Ownership Challenge** is `false` and if **Cloudflare Zone ID** is unset. The Cloudflare account ID associated with your LogPush job. This parameter supports plain text values and the environment variable `CLOUDFLARE_ACCOUNT_ID`. | *none* |
| **Cloudflare Zone ID** | `cloudflarezoneid` | Required if **Skip Ownership Challenge** is `false` and if **Cloudflare Account ID** is unset. The Cloudflare zone ID associated with your LogPush job. This parameter supports plain text values and the environment variable `CLOUDFLARE_ZONE_ID`. | *none* |

### Advanced

| Name | Key | Description | Default |
| - | - | - | - |
| **Response Headers** | `resp_headers` | The header for Palo Alto Networks Telemetry Pipeline to include in responses to Cloudflare. To include multiple headers, include each header as a new line. Supports templating. | `Content-Type:application/json` |
| **Response Status Code** | `resp_status_code` | The HTTP status code for Palo Alto Networks Telemetry Pipeline to include in responses to Cloudflare. | `200` |
| **Response Body** | `resp_body` | The response body for Palo Alto Networks Telemetry Pipeline to send to Cloudflare. Supports templating. | `{"status": "ok"}` |
| **Time Extraction Template** | `time_from` | The template to extract time data from logs. For example, if your logs use the RFC3339 time format, set the value `{{.Format time.RFC3339Nano}}`. If no value is set, Palo Alto Networks Telemetry Pipeline assigns a timestamp to each log based on when Palo Alto Networks Telemetry Pipeline *receives* that log. | *none* |
| **Cloudflare Base URL** | `baseurl` | Required if **Skip Ownership Challenge** is `false`. The Cloudflare API base URL to use in the ownership challenge. This parameter supports plain text values and the environment variable `CLOUDFLARE_BASE_URL`. | `https://api.cloudflare.com/client/v4/` |
| **Memory Buffer Limit** | `mem_buf_limit` | Sets a limit for how much buffered data the plugin can write to memory, which affects backpressure. This value must follow Fluent Bit's rules for [unit sizes](https://docs.fluentbit.io/manual/administration/configuring-fluent-bit#unit-sizes). If unspecified, no limit is enforced. <p />For v2 pipelines, this parameter affects only pipelines with the Deployment or DaemonSet [workload](/ingest/pipeline/v2/configure/kubernetes/workloads) type. To learn more, see the v2 [backpressure](/ingest/pipeline/v2/configure/backpressure) guide. <p />For v3 pipelines, this parameter is independent from the [OpenTelemetry `memory_limiter` and `batch` processors](/ingest/pipeline/v3#route-data-from-fluent-bit-to-opentelemetry). | *none* |

## LogPush jobs

For information about setting up Cloudflare LogPush jobs, consult the Cloudflare
LogPush [Enable HTTP destination](https://developers.cloudflare.com/logs/get-started/enable-destinations/http/)
guide.

When you create a new LogPush job in Cloudflare, there might be a delay before
data from that job starts flowing to Palo Alto Networks Telemetry Pipeline.
Similarly, when you delete
a LogPush job in Cloudflare, there might be a delay before data stops flowing.
These delays can range anywhere from a few minutes to 15 minutes.

## Ownership challenge

You can set **Skip Ownership Challenge** to `false` to trigger a one-time
[Cloudflare ownership challenge](https://developers.cloudflare.com/api/resources/logpush/subresources/ownership/methods/create/)
for enhanced security and safety. However, this ownership challenge is optional,
and it's possible to send LogPush data to Palo Alto Networks Telemetry Pipeline without it.

<Note>
  If you trigger an ownership challenge outside of Palo Alto Networks Telemetry Pipeline, the ensuing
  challenge response will appear in your pipeline logs, including tokens, and will
  be sent to any of your pipeline's active destinations. This behavior occurs even
  when the **Skip Ownership Challenge** setting in Palo Alto Networks Telemetry Pipeline is set to
  `true`.
</Note>


## Related topics

- [Palo Alto Networks Telemetry Pipeline release notes](/ingest/pipeline/v2/release-notes.md)
- [Ingest telemetry data with source plugins](/ingest/pipeline/plugins/source-plugins.md)
- [Vercel Logs source plugin](/ingest/pipeline/plugins/source-plugins/vercel.md)
- [Splunk HEC source plugin](/ingest/pipeline/plugins/source-plugins/splunk-hec.md)
- [HTTP source plugin](/ingest/pipeline/plugins/source-plugins/http.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.