Visualise Cloudflare Edge Logs with Grafana

Jacob Pretorius - Solution Architect & OMVP

What's an edge log?

{"CacheCacheStatus":"hit","CacheReserveUsed":false,"CacheResponseBytes":4748,"CacheResponseStatus":200,"CacheTieredFill":false,"ClientASN":6128,"ClientCity":"New York City","ClientCountry":"us","ClientDeviceType":"desktop","ClientIP":"2600:4808:XXXX:XXXX:XXXX","ClientIPClass":"noRecord","ClientLatitude":"4X.XX","ClientLongitude":"-7X.XX","ClientMTLSAuthCertFingerprint":"","ClientMTLSAuthStatus":"unknown","ClientRegionCode":"NY","ClientRequestBytes":10463,"ClientRequestHost":"www.site.com","ClientRequestMethod":"GET","ClientRequestPath":"/globalassets/image.jpg","ClientRequestProtocol":"HTTP/3","ClientRequestReferer":"https://www.site.com/products","ClientRequestScheme":"https,"ClientRequestSource":"eyeball","ClientRequestURI":"/globalassets/image.jpg?quality=80&width=270&height=270&format=avif","ClientRequestUserAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ClientSSLCipher":"AEAD-AES128-GCM-SHA256","ClientSSLProtocol":"TLSv1.3","ClientSrcPort":50823,"ClientTCPRTTMs":0,"ClientXRequestedWith":"","ContentScanObjResults":[],"ContentScanObjSizes":[],"ContentScanObjTypes":[],"Cookies":{},"EdgeCFConnectingO2O":false,"EdgeColoCode":"IAD","EdgeColoID":1024,"EdgeEndTimestamp":"2025-06-10T14:20:00Z","EdgePathingOp":"wl","EdgePathingSrc":"undef","EdgePathingStatus":"nr","EdgeRequestHost":"www.site.com","EdgeResponseBodyBytes":3085,"EdgeResponseBytes":3795,"EdgeResponseCompressionRatio":1,"EdgeResponseContentType":"image/avif","EdgeResponseStatus":200,"EdgeServerIP":"","EdgeStartTimestamp":"2025-06-10T14:20:00Z","EdgeTimeToFirstByteMs":23,"LeakedCredentialCheckResult":"none","OriginDNSResponseTimeMs":0,"OriginIP":"","OriginRequestHeaderSendDurationMs":0,"OriginResponseBytes":0,"OriginResponseDurationMs":0,"OriginResponseHTTPExpires":"","OriginResponseHTTPLastModified":"","OriginResponseHeaderReceiveDurationMs":0,"OriginResponseStatus":0,"OriginResponseTime":0,"OriginSSLProtocol":"unknown","OriginTCPHandshakeDurationMs":0,"OriginTLSHandshakeDurationMs":0,"ParentRayID":"00","RayID":"94d981c96ae82ade","RequestHeaders":{},"ResponseHeaders":{},"SecurityAction":"","SecurityActions":[],"SecurityRuleDescription":"","SecurityRuleID":"","SecurityRuleIDs":[],"SecuritySources":[],"SmartRouteColoID":0,"UpperTierColoID":0,"WAFAttackScore":85,"WAFFlags":"0","WAFMatchedVar":"","WAFRCEAttackScore":92,"WAFSQLiAttackScore":94,"WAFXSSAttackScore":97,"WorkerCPUTime":0,"WorkerScriptName":"","WorkerStatus":"unknown","WorkerSubrequest":false,"WorkerSubrequestCount":0,"WorkerWallTimeUs":0,"ZoneName":"site.com"}

Some of it is useful

						
              "CacheCacheStatus":"hit",
              "ClientCity":"Paris",
              "ClientIP":"40.89.xx.xx",
              "ClientRequestPath":"/globalassets/image.jpg",
              "ClientRequestSource":"eyeball",

Really useful

						
              "CacheCacheStatus":"dynamic",
              "ClientASN":132203,
              "ClientCity":"Singapore",
              "ClientIP":"43.134.xx.xx",
              "ClientRequestPath":"/search-products",
              "EdgeResponseStatus":403,
              "WAFAttackScore":85,
              "SecurityAction":"managedChallenge"

## Conclusion - We can be more proactive with attacks and scrapers, rather than reactive. - Traffic Type and CF Block Actions are very insightful. - I'm interested to see what visualisations people come up with.

Github

https://github.com/jacobpretorius/Opti.Edge.Logs.Grafana