cloud.aws.cloudflare

[ 1 Introduction ] [ 2 Valid tags and data tables ] [ 3 Table structure ]

Introduction

The tags beginning with cloud.aws.cloudflare identify events generated by Cloudflare + AWS.

Valid tags and data tables

The full tag must have 4 levels. The first 3 are fixed as cloud.aws.cloudflare. The fourth level indicates the event subtype.

These are the valid tags and corresponding data tables that will receive the parsers' data:

Product / Service	Tags	Data tables

Product / Service	Tags	Data tables
Cloudflare + AWS	`cloud.aws.cloudflare.events`	`cloud.aws.cloudflare.events`

For more information, read more About Devo tags.

Table structure

These are the fields displayed in this table:

cloud.aws.cloudflare.events

Field	Type	Extra fields

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
ACCID	`str`
REGION	`str`
ClientAsn	`int4`
ClientBytes	`int4`
ClientCountry	`str`
ClientIP	`ip4`
ClientMatchedIpFirewall	`str`
ClientPort	`int4`
ClientProto	`str`
OriginBytes	`int4`
OriginIP	`str`
OriginPort	`int4`
OriginProto	`str`
Application	`str`
ColoCode	`str`
ConnectTimestamp	`timestamp`
DisconnectTimestamp	`timestamp`
Event	`str`
IpFirewall	`bool`
ProxyProtocol	`str`
Status	`int4`
Timestamp	`timestamp`
ClientTcpRtt	`int4`
ClientTlsCipher	`str`
ClientTlsClientHelloServerName	`str`
ClientTlsProtocol	`str`
ClientTlsStatus	`str`
OriginTcpRtt	`int4`
OriginTlsCipher	`str`
OriginTlsFingerprint	`str`
OriginTlsMode	`str`
OriginTlsProtocol	`str`
OriginTlsStatus	`str`
ClientRequestHost	`str`
ClientRequestMethod	`str`
ClientRequestURI	`str`
EdgeEndTimestamp	`timestamp`
EdgeResponseBytes	`int4`
EdgeResponseStatus	`int4`
EdgeStartTimestamp	`timestamp`
BotTags	`str`
ParentRayID	`str`
RayID	`str`
SecurityLevel	`str`
SmartRouteColoID	`int4`
UpperTierColoID	`int4`
ZoneID	`int8`
ZoneName	`str`
CacheCacheStatus	`str`
CacheTieredFill	`bool`
CacheResponseBytes	`int4`
CacheResponseStatus	`int4`
ClientASN	`int4`
ClientDeviceType	`str`
ClientIPClass	`str`
ClientMTLSAuthCertFingerprint	`str`
ClientMTLSAuthStatus	`str`
ClientSSLCipher	`str`
ClientSSLProtocol	`str`
ClientSrcPort	`int4`
ClientTCPRTTMs	`int4`
ClientXRequestedWith	`str`
ClientRequestBytes	`int4`
ClientRequestPath	`str`
ClientRequestProtocol	`str`
ClientRequestReferer	`str`
ClientRequestScheme	`str`
ClientRequestSource	`str`
ClientRequestUserAgent	`str`
FirewallMatchesActions	`str`
FirewallMatchesRuleIDs	`str`
FirewallMatchesSources	`str`
EdgeCFConnectingO2O	`bool`
EdgeColoCode	`str`
EdgeColoID	`int4`
EdgePathingOp	`str`
EdgePathingSrc	`str`
EdgePathingStatus	`str`
EdgeRateLimitAction	`str`
EdgeRateLimitID	`int4`
EdgeRequestHost	`str`
EdgeResponseBodyBytes	`int4`
EdgeResponseCompressionRatio	`int4`
EdgeResponseContentType	`str`
EdgeServerIP	`str`
EdgeTimeToFirstByteMs	`int4`
OriginDNSResponseTimeMs	`int4`
OriginRequestHeaderSendDurationMs	`int4`
OriginSSLProtocol	`str`
OriginTCPHandshakeDurationMs	`int4`
OriginTLSHandshakeDurationMs	`int4`
OriginResponseBytes	`int4`
OriginResponseDurationMs	`int4`
OriginResponseHTTPExpires	`str`
OriginResponseHTTPLastModified	`str`
OriginResponseHeaderReceiveDurationMs	`int4`
OriginResponseStatus	`int4`
OriginResponseTime	`int8`
WAFAction	`str`
WAFFlags	`str`
WAFMatchedVar	`str`
WAFProfile	`str`
WAFRuleID	`str`
WAFRuleMessage	`str`
WorkerCPUTime	`int4`
WorkerStatus	`str`
WorkerSubrequest	`bool`
WorkerSubrequestCount	`int4`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓