跳转到内容
搜索文档
↵选择
↑↓导航
ESC关闭

使用 cURL 管理 Logpush

最后更新 查看 MarkdownAgent 设置

您可以在命令行中使用 cURL 管理 Cloudflare Logpush 服务。

开始之前，请先查阅以下文档：

步骤 1 - 获取所有权质询

Required API token permissions

At least one of the following token permissions is required:
  • Logs Write
Get ownership challengebash
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/logpush/ownership" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"destination_conf": "s3://<BUCKET_PATH>?region=us-west-2"
	}'

参数

响应

质询文件会写入目标位置，文件名会出现在响应中（若目标类型适合，文件名也可能以路径形式表示）。例如：

{
  "success": true,
  "errors": [],
  "messages": [],
  "result": {
    "filename": "burritobot/logs/ownership-challenge.txt",
    "valid": true,
    "message": ""
  }
}

下一步创建作业时，您需要提供该文件中包含的令牌。

步骤 2 - 创建作业

Required API token permissions

At least one of the following token permissions is required:
  • Logs Write
Create Logpush jobbash
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/logpush/jobs" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "<DOMAIN_NAME>",
		"destination_conf": "s3://<BUCKET_PATH>?region=us-west-2",
		"dataset": "http_requests",
		"output_options": {
				"field_names": [
						"ClientIP",
						"ClientRequestHost",
						"ClientRequestMethod",
						"ClientRequestURI",
						"EdgeEndTimestamp",
						"EdgeResponseBytes",
						"EdgeResponseStatus",
						"EdgeStartTimestamp",
						"RayID"
				],
				"timestamp_format": "rfc3339"
		},
		"ownership_challenge": "<OWNERSHIP_CHALLENGE_TOKEN>"
	}'

参数

  • name（可选）- 建议使用您的域名作为作业名称；作业创建后名称不可更改。
  • destination_conf - 详情请参阅 Destination。
  • dataset - 您希望接收的日志类别。完整支持的数据集列表请参阅 Datasets；该参数在作业创建后不可更改。
  • output_options（可选）- 请参阅 Log Output Options。
    • 通常包含所需字段和时间戳格式。
    • 在以下情况下，将时间戳格式设为 RFC 3339（"timestamp_format": "rfc3339"）：
  • ownership_challenge - 用于证明目标所有权的质询令牌。
  • kind（可选）- 用于区分 Logpush 与 Edge Log Delivery 作业。详情请参阅 Kind。
  • filter（可选）- 详情请参阅 Filters。

响应

响应中会返回新创建的作业 ID。例如：

{
  "errors": [],
  "messages": [],
  "result": {
    "id": <JOB_ID>,
    "dataset": "http_requests",
    "kind": "",
    "enabled": false,
    "name": "<DOMAIN_NAME>",
    "output_options": {
      "field_names": ["ClientIP", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "EdgeEndTimestamp","EdgeResponseBytes", "EdgeResponseStatus", "EdgeStartTimestamp", "RayID"],
      "timestamp_format": "rfc3339"
    },
    "destination_conf": "s3://<BUCKET_PATH>?region=us-west-2",
    "last_complete": null,
    "last_error": null,
    "error_message": null
  },
  "success": true
}

步骤 3 - 启用（更新）作业

首先使用作业 ID 检索特定作业的信息：

Required API token permissions

At least one of the following token permissions is required:
  • Logs Write
Get Logpush job detailsbash
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/logpush/jobs/$JOB_ID" \
	--request GET \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

响应

{
  "errors": [],
  "messages": [],
  "result": {
    "id": <JOB_ID>,
    "dataset": "http_requests",
    "kind": "",
    "enabled": false,
    "name": "<DOMAIN_NAME>",
    "output_options": {
      "field_names": ["ClientIP", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "EdgeEndTimestamp","EdgeResponseBytes", "EdgeResponseStatus", "EdgeStartTimestamp", "RayID"],
      "timestamp_format": "rfc3339"
    },
    "destination_conf": "s3://<BUCKET_PATH>?region=us-west-2",
    "last_complete": null,
    "last_error": null,
    "error_message": null
  },
  "success": true
}

请注意，默认情况下作业未启用（"enabled": false）。

如果您不记得作业 ID，可以使用 zone ID 检索：

Required API token permissions

At least one of the following token permissions is required:
  • Logs Write
List Logpush jobsbash
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/logpush/jobs" \
	--request GET \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

接下来，发送更新请求以启用作业：

Required API token permissions

At least one of the following token permissions is required:
  • Logs Write
Update Logpush jobbash
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/logpush/jobs/$JOB_ID" \
	--request PUT \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"enabled": true
	}'

响应

{
  "errors": [],
  "messages": [],
  "result": {
    "id": <JOB_ID>,
    "dataset": "http_requests",
    "kind": "",
    "enabled": true,
    "name": "<DOMAIN_NAME>",
    "output_options": {
      "field_names": ["ClientIP", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "EdgeEndTimestamp","EdgeResponseBytes", "EdgeResponseStatus", "EdgeStartTimestamp", "RayID"],
      "timestamp_format": "rfc3339"
    },
    "destination_conf": "s3://<BUCKET_PATH>?region=us-west-2",
    "last_complete": null,
    "last_error": null,
    "error_message": null
  },
  "success": true
}

作业启用后，几分钟内您就会开始接收日志，之后会尽快以批次形式持续接收，直到禁用作业。对于请求量非常高的 zone，首次接收日志可能需要数小时。

除修改 enabled 外，您还可以更新 output_options 的值。要修改 destination_conf，需要请求所有权质询，并在更新请求中提供相关令牌。您也可以删除当前作业并创建新作业。

作业启用并开始执行后，last_complete 字段会显示上一批日志成功发送到目标的时间：

按 ID 获取作业并查看 last_complete 信息的请求

Required API token permissions

At least one of the following token permissions is required:
  • Logs Write
Get Logpush job detailsbash
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/logpush/jobs/$JOB_ID" \
	--request GET \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

响应

{
  "errors": [],
  "messages": [],
  "result": {
    "id": <JOB_ID>,
    "dataset": "http_requests",
    "kind": "",
    "enabled": true,
    "name": "<DOMAIN_NAME>",
    "output_options": {
      "field_names": ["ClientIP", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "EdgeEndTimestamp","EdgeResponseBytes", "EdgeResponseStatus", "EdgeStartTimestamp", "RayID"],
      "timestamp_format": "rfc3339"
    },
    "destination_conf": "s3://<BUCKET_PATH>?region=us-west-2",
    "last_complete": "2018-08-09T21:26:00Z",
    "last_error": null,
    "error_message": null
  },
  "success": true
}

可选 - 删除作业

Required API token permissions

At least one of the following token permissions is required:
  • Logs Write
Delete Logpush jobbash
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/logpush/jobs/$JOB_ID" \
	--request DELETE \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

删除作业时请谨慎，此操作不可撤销。

响应

{
  "errors": [],
  "messages": [],
  "result": {},
  "success": true
}

可选 - 检索作业

使用作业 ID 检索特定作业：

Required API token permissions

At least one of the following token permissions is required:
  • Logs Write
Get Logpush job detailsbash
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/logpush/jobs/$JOB_ID" \
	--request GET \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

响应

{
  "errors": [],
  "messages": [],
  "result": [
    {
      "id": <JOB_ID>,
      "dataset": "http_requests",
      "kind": "",
      "enabled": true,
      "name": "<DOMAIN_NAME>",
      "output_options": {
        "field_names": ["ClientIP", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "EdgeEndTimestamp","EdgeResponseBytes", "EdgeResponseStatus", "EdgeStartTimestamp", "RayID"],
        "timestamp_format": "rfc3339"
      },
      "destination_conf": "s3://<BUCKET_PATH>?region=us-west-2",
      "last_complete": null,
      "last_error": null,
      "error_message": null
    }
  ],
  "success": true
}

检索所有数据集的全部作业：

Required API token permissions

At least one of the following token permissions is required:
  • Logs Write
List Logpush jobsbash
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/logpush/jobs" \
	--request GET \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

响应

{
  "errors": [],
  "messages": [],
  "result": [
    {
      "id": <JOB_ID>,
      "dataset": "spectrum_events",
      "kind": "",
      "enabled": true,
      "name": "<DOMAIN_NAME>",
      "output_options": {
        "field_names": ["Application", "ClientAsn", "ClientIP", "ColoCode", "Event", "OriginIP", "Status"],
      },
      "destination_conf": "s3://<BUCKET_PATH>?region=us-west-2",
      "last_complete": "2019-10-01T00:25:00Z",
      "last_error": null,
      "error_message": null
    },
    {
      "id": <JOB_ID>,
      "dataset": "http_requests",
      "kind": "",
      "enabled": false,
      "name": "<DOMAIN_NAME>",
      "output_options": {
        "field_names": ["ClientIP", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "EdgeEndTimestamp","EdgeResponseBytes", "EdgeResponseStatus", "EdgeStartTimestamp", "RayID"],
        "timestamp_format": "rfc3339"
      },
      "destination_conf": "s3://<BUCKET_PATH>?region=us-west-2",
      "last_complete": "2019-09-24T21:15:00Z",
      "last_error": null,
      "error_message": null
    }
  ]
}

可选 - 更新 output_options

若要添加（或移除）字段、更改时间戳格式，或启用针对 Log4j - CVE-2021-44228 漏洞的保护，请先检索您 zone 的当前 output_options。

Required API token permissions

At least one of the following token permissions is required:
  • Logs Write
Get Logpush job detailsbash
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/logpush/jobs/$JOB_ID" \
	--request GET \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

响应

{
  "errors": [],
  "messages": [],
  "result": {
    "id": <JOB_ID>,
    "dataset": "http_requests",
    "kind": "",
    "enabled": true,
    "name": "<DOMAIN_NAME>",
    "output_options": {
      "field_names": ["ClientIP", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "EdgeEndTimestamp","EdgeResponseBytes", "EdgeResponseStatus", "EdgeStartTimestamp", "RayID"],
      "timestamp_format": "rfc3339"
    },
    "destination_conf": "s3://<BUCKET_PATH>?region=us-west-2",
    "last_complete": "2021-12-14T19:56:49Z",
    "last_error": null,
    "error_message": null
  },
  "success": true
}

接下来，按需编辑 output_options 并创建 PUT 请求。以下示例启用了 CVE-2021-44228 脱敏选项。

Required API token permissions

At least one of the following token permissions is required:
  • Logs Write
Update Logpush jobbash
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/logpush/jobs/$JOB_ID" \
	--request PUT \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"output_options": {
				"field_names": [
						"ClientIP",
						"ClientRequestHost",
						"ClientRequestMethod",
						"ClientRequestURI",
						"EdgeEndTimestamp",
						"EdgeResponseBytes",
						"EdgeResponseStatus",
						"EdgeStartTimestamp",
						"RayID"
				],
				"timestamp_format": "rfc3339"
		}
	}'

请注意，目前无法通过 UI 使用 CVE-2021-44228 选项，通过 UI 更新 Logpush 作业会移除此选项。

响应

{
  "errors": [],
  "messages": [],
  "result": {
    "id": <JOB_ID>,
    "dataset": "http_requests",
    "kind": "",
    "enabled": true,
    "name": null,
    "output_options": {
      "field_names": ["ClientIP", "ClientRequestHost", "ClientRequestMethod", "ClientRequestURI", "EdgeEndTimestamp","EdgeResponseBytes", "EdgeResponseStatus", "EdgeStartTimestamp", "RayID"],
      "timestamp_format": "rfc3339"
    },
    "destination_conf": "s3://<BUCKET_PATH>?region=us-west-2",
    "last_complete": "2021-12-14T20:02:19Z",
    "last_error": null,
    "error_message": null
  },
  "success": true
}

这篇文档对您有帮助吗？