Cloudflare Unifies Logs, Traces, and Analytics into Single Observability Platform

Cloudflare Unifies Logs, Traces, and Analytics into Single Observability Platform Cloudflare announced eight major observability updates designed to consolidate logs, metrics, traces, and alert systems into a unified platform accessible via SQL, dashboards, and agentic workflows. A unified Logs interface brings together Workers Observability and Log Explorer across datasets such as HTTP, Containers, and AI Gateway. Cloudflare Traces entered open beta with OpenTelemetry export and W3C trace context propagation support. A new unified SQL API and Workers runtime binding allow querying telemetry directly through SQL, the cf CLI, and MCP servers. Logpush and SQL-driven Transformers are now available across self-serve plans with usage-based pricing, and all plans receive 30 days of domain analytics. Unified Logs and Cloudflare Traces The updated Logs console consolidates Workers Observability and Log Explorer, allowing users to query events from HTTP, firewall, R2, and AI Gateway sources using SQL or natural language. Alongside this, Cloudflare Traces entered open beta, delivering request-level insight into routing decisions, cache handling, and worker execution. Users can set baseline sampling rates, configure dynamic Trace Rules, and export trace data via OpenTelemetry standards and W3C trace context propagation. SQL Querying, Alerts, and Dashboards A new unified SQL API standardizes telemetry queries across disparate Cloudflare datasets for human operators and AI agents using the cf CLI or Observability MCP server. Developers can also query telemetry natively inside Cloudflare Workers via a runtime binding. Furthermore, the upgraded Alerts engine allows configuring conditions and SLO thresholds directly using custom SQL, with webhook notifications now supported on all subscription tiers alongside customizable multi-dataset dashboards. Expanded Logpush Access and Volume Pricing Logpush, previously restricted to Enterprise tiers, is now available to all self-serve customers alongside the general availability of SQL-based Transformers for pre-delivery event reshaping. Cloudflare also introduced 30 days of domain analytics across all plans and outlined a volume-based ingestion and storage pricing structure for logs and traces scheduled to take effect across plans on December 1, 2026.

Cloudflare 推出可观测性平台八大更新：整合日志、分布式追踪与统一 SQL API Cloudflare 宣布对其可观测性平台推出八项重大更新，将日志、追踪、分析、告警、仪表板及导出能力整合成单一平台，支持统一 SQL 查询及针对 AI Agent 的工具链，并更新了计费模式。 全新日志主页整合了 Workers 与安全日志，并上线公开测试版 Cloudflare Traces，支持 OpenTelemetry 及 W3C 上下文传播。 推出统一 SQL API 及 Workers 原生绑定，配合全新 cf CLI 和 MCP 服务器，方便人员与 AI Agent 进行跨产品遥测查询。 自定义告警现支持全量 SQL 数据集并向所有方案开放 Webhook，全套餐还享有 30 天域名历史分析与自定义仪表板。 Logpush 与 Transformers 正式向所有自助服务方案开放，同时引入基于摄入和存储数据量的新定价方案。 全新日志中心与分布式追踪 Cloudflare 整合了 Workers Observability 与 Log Explorer，形成统一的 Logs 主页，用户可在 HTTP、防火墙、Containers、R2 等数据集间切换排查。同时，Cloudflare Traces 进入公开测试阶段，提供针对安全规则、路由、缓存决策及 Workers 的请求级追踪视图，支持基础采样率与基于特征的追踪规则，并兼容 OpenTelemetry 和 W3C 追踪上下文标准。 统一 SQL API 与 AI Agent 工具生态 测试版统一 SQL API 让用户与 AI Agent 能够使用同一种 SQL 语法、鉴权模型与 API，直接跨 Workers 日志、容器安全事件及 HTTP 日志进行关联查询。此外，该能力已作为原生绑定集成至 Workers 运行时，并支持通过全新 Cloudflare CLI（cf）以及 Observability MCP 服务器接入，助力自动化事件排查与监控闭环。 告警升级、域名分析与自定义仪表板 Notifications 更名为“Alerts”，支持针对 SQL API 覆盖的任意数据集编写自定义 SQL 规则、设置阈值或 SLO 告警，且 Webhook 现已支持所有套餐。此外，所有方案均默认提供 30 天域名历史分析数据，用户还可以利用自定义仪表板聚合跨产品的指标、日志与安全事件，统一观察应用运行状况。 Logpush 全面开放与用量计费机制 原先仅供企业版使用的 Logpush 现已向所有自助服务计划开放，Transformers 功能正式可用，允许在日志交付前直接运行 SQL 进行清洗与转换。针对日志与追踪数据，自 2026 年 12 月 1 日起将改为基于实际摄入量与存储量计费；Logpush 和 Transformers 亦采用了提供免费月度配额的用量计费方案。

Today, we’re launching eight major updates that bring your logs, traces, analytics, alerts, dashboards, and exporting into [one observability platform](https://developers.cloudflare.com/observability/), with simpler and more predictable pricing. **Here's what's launching:** Understanding an issue often requires data from more than one Cloudflare product. A spike in 5xx responses could come from a Worker, from your origin, or from Cloudflare failing to connect to your origin globally or regionally. But investigating it today requires knowing which product owns each signal and how to query it. Observability should be a platform-wide capability: it should reflect how applications actually behave and give you the complete context needed to resolve an issue. Over the coming months, you’ll see more Cloudflare products, datasets, and workflows become part of this shared observability platform, with more consistent pricing, product experiences, and features. These eight updates are the first step into a more unified Observability problem. The [new Logs home](https://developers.cloudflare.com/observability/logs/) combines [Workers Observability](https://developers.cloudflare.com/workers/observability/) (for debugging Workers applications and its connected resources) with [Log Explorer](https://developers.cloudflare.com/log-explorer/) (for searching across security logs). You can now choose from log datasets like HTTP events, firewall events, Workers, Containers, R2, and AI Gateway, and use the same investigative tools and capabilities for each. Start with an increase in request latency, group it by hostname or data center, narrow the results to affected paths, and inspect individual requests by Ray ID. If the investigation leads to another Cloudflare product, switch datasets without leaving Logs. Support for querying across multiple datasets is coming soon, making it possible to connect related events across products in a single query. You can query your logs with raw SQL or with built-in filters to narrow down on specific events. Create visualizations with natural language, and easily investigate and understand detected anomalies. `Use cf cli (https://developers.cloudflare.com/cf/) to query my Worker logs/traces using the sql API and tell me about any unusual patterns or trends. If there is nothing unusual, give me a rundown of the past few days of my traffic. If I am not logged in bring me through the auth flow.` We’re launching [Cloudflare Traces in open beta](http://blog.cloudflare.com/cloudflare-tracing), giving you a request-level view of supported security rules, transformations, cache decisions, routing, Workers, and origin handling. You get to see how your traffic moved through our platform, and connect the dots between how you’ve configured Cloudflare, and how this influences request processing time, routing decisions, and more. [Set a baseline sampling rate](https://developers.cloudflare.com/observability/traces/configuration/) for continuous visibility, then use [Trace Rules](https://developers.cloudflare.com/observability/traces/configuration/#trace-rules) to capture specific traffic at a higher rate during an investigation. Target hostnames, paths, IP addresses, or headers, search by [Ray ID](https://developers.cloudflare.com/fundamentals/reference/cloudflare-ray-id), and inspect the resulting spans directly in the Cloudflare dashboard. You can export traces over [OpenTelemetry](https://opentelemetry.io/), while [W3C trace context propagation](https://www.w3.org/TR/trace-context/) lets you accept incoming trace context and pass along context to your origin. Check out the [full blog post to learn more about Cloudflare Tracing](http://blog.cloudflare.com/cloudflare-tracing) or give  this command to your agent to get started: `Using the Cloudflare cf CLI, configure Tracing for my zone with a 10% sampling rate and persist traces in Cloudflare. If I have multiple zones, ask me which one to use.` Agents also need a consistent way to sift through your observability data, investigate issues, correlate signals, and verify fixes. We’re launching [a unified SQL API,](https://developers.cloudflare.com/analytics/sql-api/) now in beta, for querying telemetry across Cloudflare. Instead of integrating separately with Workers logs, Containers security events, HTTP request logs, and analytics data, people and agents can query them using one SQL dialect, authentication model, and API. Your agent can use the new [Cloudflare CLI](https://blog.cloudflare.com/cloudflare-cf-cli-launch/), `cf`, to find and run queries from the command line or connect through [Cloudflare’s Observability MCP](https://github.com/cloudflare/mcp) server to investigate logs, traces and analytics. [Dataset schemas, fields, and example queries](https://developers.cloudflare.com/analytics/sql-api/datasets/) are available to help both people and agents build queries. Additionally, we’re also bringing the SQL interface directly into Workers with a [native binding.](https://developers.cloudflare.com/workers/runtime-apis/bindings/analytics-sql/) Your Worker can now do things like query [Analytics Engine](https://developers.cloudflare.com/analytics/analytics-engine/) data to meter customer usage and power billing workflows, build customer-facing analytics dashboards, generate health reports, or automate incident investigation without configuring a separate API client. For all logs and traces ingested and stored on Cloudflare, we are moving to one unified Observability subscription and pricing. Beginning **December 1, 2026**, this pricing model will apply across all plans (effective upon renewal for all Enterprise customers) and cover existing Developer Platform logs, including Workers, Containers, AI Gateway, as well as all tracing data. Because logs and traces can vary dramatically in size, the new model is based on the **volume you ingest and store** rather than an event-based count. This pricing adjustment will be. Check out our [documentation](https://developers.cloudflare.com/observability/pricing/) for more details on pricing. | Plan | Included Usage | Retention | Additional usage | |---|---|---|---| | Free | 0.5 GB of ingestion per day | 7 days | Not available | | Paid and Enterprise | 50 GB of ingestion 10 GB-month of storage per billing cycle | Up to 1 year (coming soon) | $0.25 per GB ingested $0.10 per GB-month stored | Notifications ([now called “Alerts”](https://developers.cloudflare.com/notifications/)) just got a major upgrade. You can now define custom alerts directly on anything supported by our new unified SQL API, including HTTP request logs, Workers events, Workers Analytics Engine datasets, analytics datasets, traces, and security events. Choose a dataset in the dashboard or define the condition using custom SQL. Then select a threshold, anomaly, or SLO, set the evaluation window, and choose where the alert should go. You might alert when origin 5xx responses exceed a threshold for five minutes, a Container repeatedly fails, Worker errors increase after a deployment, or trace latency crosses an expected limit. You can send alerts right to tools your teams are already using, including incident management tools, chat platforms, and webhooks. [Webhooks are now available on all plans](https://developers.cloudflare.com/notifications/get-started/configure-webhooks/), allowing you to route alerts to custom services or even your agent to begin investigating immediately. To get started check out our [documentation](https://developers.cloudflare.com/notifications/) or give this command to your agent: ``` Use cf cli (https://developers.cloudflare.com/cf/) to query my HTTP and Worker analytics using the sql API. Then setup an alert to alert me on bad state (high 5xx, high exception rate, anomalous TTFB/wall time, etc.) If I am not logged into cf cli bring me through the auth flow. ``` Understanding what is happening on your domain has often meant piecing together metrics from different Cloudflare products. We’re bringing traffic, performance, security, cache, origin, and DNS data together so you can see how they relate. If latency increases, you can quickly see whether it is tied to a specific Cloudflare data center, hostname, or origin. In addition, you now get [30 days of domain analytics on every plan.](https://developers.cloudflare.com/analytics/account-and-zone-analytics/zone-analytics/) A full month of history gives you time to investigate issues after they happen, compare today with the same day in previous weeks, and tell the difference between a one-time spike and a longer trend. Prebuilt dashboards cover common use cases, but applications often use several parts of Cloudflare. With [Custom Dashboards](https://developers.cloudflare.com/analytics/custom-dashboards/), you can bring together analytics from across Cloudflare, logs and traces from the Workers platform, and security events in one view. Track request volume, errors, latency, storage, and blocked traffic, then share the dashboard with your team. Instead of rebuilding queries during every investigation, you have one place to monitor the signals that matter to your application. [Logpush](https://developers.cloudflare.com/logs/logpush/), previously available only to Enterprise, is now available on all self-serve plans, letting you export all Cloudflare logs to the tools and destinations you already use. Need to apply filters, perform redaction, enrich events or reshape output before delivery? [Transformers](https://developers.cloudflare.com/logs/logpush/transformers/) is now generally available, letting you apply any SQL transformation without operating a separate ETL pipeline. We’re introducing [usage-based pricing](https://developers.cloudflare.com/changelog/post/2026-09-30-logpush-usage-based-pricing/) for Logpush and Transformers. Each includes a free monthly allowance, with simple pricing for additional usage: | Export usage | Included each month | Additional usage | | Exports to Cloudflare destinations | 25 GB | $0.03 per GB | | Exports to external destinations | 25 GB | $0.10 per GB | | Logpush Transformers | 1 GB | $0.04 per GB | Visit the [documentation](https://developers.cloudflare.com/logs/logpush/) to get started with Logpush and explore complete pricing details. ``` Use cf CLI (https://developers.cloudflare.com/cf/) to set up a Logpush job that sends my Worker logs/traces to an existing R2 bucket. Check for existing R2 buckets and Logpush jobs first to avoid duplicates. If multiple buckets exist, ask me which one to use. If none exist, guide me through creating one and setting up the required credentials. If I am not logged in, bring me through the authentication flow. Confirm with me before creating or modifying resources, and verify the Logpush job afterward. Never expose credentials or secrets. ``` We hear you when you say Cloudflare can feel like a black box. These updates are just the beginning of exposing what’s happening, making the underlying data accessible, and giving you the context that you need to act. That transparency matters even more as agents move from writing software to operating it. An agent can only close the loop between a change and its outcome if it can query what happened, identify the failure, and verify the fix. By building around [OpenTelemetry](https://opentelemetry.io/), [W3C Trace Context,](https://www.w3.org/TR/trace-context/) and SQL, we are committed to giving you and your agents standard, portable interfaces to that context. Check out our new [Observability documentation](https://developers.cloudflare.com/observability/) home to learn more.