[Logs] Update Logpush dataset field definitions (2026-06-24)#31674
[Logs] Update Logpush dataset field definitions (2026-06-24)#31674soheiokamoto wants to merge 1 commit into
Conversation
|
/bonk please review this automated sync of Logpush dataset field definitions. Focus on the following:
|
Review⏸️ Automatic reviews for this PR are paused. This PR has already received 2 automatic reviews. To run another review, a codeowner can comment
Code ReviewThis code review is in beta and may not always be helpful — use your judgment. Warnings (2)
Style Guide Review✅ No style-guide issues found. CommandsOnly codeowners can run commands. Post a comment with the command to trigger it.
|
|
This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:
|
![ask-bonk[bot]](https://avatars.githubusercontent.com/in/2454580?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review Summary
This PR adds two new Logpush datasets (Firewall events and WebSocket Analytics, both account- and zone-scoped), updates the Email Security Alerts dataset with five new fields, and adds a changelog entry. The changes follow the established code-generator pattern.
Issues that need attention
-
Changelog duplication — the "New datasets" section lists WebSocket Analytics twice (lines 12 and 13). This should be deduplicated; one entry is enough even though the dataset is available in both scopes.
-
Grammar issues in field descriptions — The new
account/firewall_events.mdcontains several awkward or grammatically incorrect descriptions. Because these files are code-generated, the fixes need to be applied in the internal source YAML so they are not overwritten by future syncs. The same issues also exist in the zone-scoped file, so fixing upstream will improve both. -
Changelog title length — The title is quite long and repeats "in Cloudflare Logs" at the end. Consider shortening it (for example, "New Logpush datasets and updated fields").
Please address the duplication in the changelog before merging.
|
|
||
| - **Firewall events**: A new dataset with fields including `AISecurityInjectionScore`, `AISecurityPIICategories`, `AISecurityTokenCount`, `AISecurityUnsafeTopicCategories`, `Action`, `ClientASN`, `ClientASNDescription`, `ClientCountry`, `ClientIP`, `ClientIPClass`, `ClientRefererHost`, `ClientRefererPath`, `ClientRefererQuery`, `ClientRefererScheme`, `ClientRequestHost`, `ClientRequestMethod`, `ClientRequestPath`, `ClientRequestProtocol`, `ClientRequestQuery`, `ClientRequestScheme`, `ClientRequestUserAgent`, `ContentScanObjResults`, `ContentScanObjSizes`, `ContentScanObjTypes`, `Datetime`, `Description`, `EdgeColoCode`, `EdgeResponseStatus`, `FirewallForAIInjectionScore`, `FirewallForAIPIICategories`, `FirewallForAITokenCount`, `FirewallForAIUnsafeTopicCategories`, `FraudUserID`, `Kind`, `LeakedCredentialCheckResult`, `MatchIndex`, `Metadata`, `OriginResponseStatus`, `OriginatorRayID`, `RayID`, `Ref`, `RuleID`, `Source`, and `ZoneName`. | ||
| - **WebSocket Analytics**: A new dataset with fields including `BytesReceivedClient`, `BytesReceivedOrigin`, `BytesSentClient`, `BytesSentOrigin`, `ClientASN`, `ClientIP`, `ClientRequestHost`, `ClientRequestPath`, `ClientRequestUserAgent`, `ColoCode`, `ConnectionCloseReason`, `ConnectionCloseSource`, `ConnectionID`, `ConnectionTransportCloseCode`, `EdgeEndTimestamp`, `EdgeStartTimestamp`, and `RayID`. | ||
| - **WebSocket Analytics**: A new dataset with fields including `BytesReceivedClient`, `BytesReceivedOrigin`, `BytesSentClient`, `BytesSentOrigin`, `ClientASN`, `ClientIP`, `ClientRequestHost`, `ClientRequestPath`, `ClientRequestUserAgent`, `ColoCode`, `ConnectionCloseReason`, `ConnectionCloseSource`, `ConnectionID`, `ConnectionTransportCloseCode`, `EdgeEndTimestamp`, `EdgeStartTimestamp`, and `RayID`. |
There was a problem hiding this comment.
Duplicate entry: WebSocket Analytics is already listed on line 12. This appears to be a code-generator bug — the dataset exists in both account and zone scopes, but the changelog should only list it once under "New datasets."
|
|
||
| Type: `string` | ||
|
|
||
| The ASN of the visitor as string. |
There was a problem hiding this comment.
Grammar issue (fix in upstream YAML): "The ASN of the visitor as string." → should be "as a string."
|
|
||
| Type: `string` | ||
|
|
||
| The referer query-string was requested by the visitor. |
There was a problem hiding this comment.
Grammar issue (fix in upstream YAML): "The referer query-string was requested by the visitor." is awkward. Suggest "The referer query string requested by the visitor."
|
|
||
| Type: `string` | ||
|
|
||
| The query-string was requested by the visitor. |
There was a problem hiding this comment.
Grammar issue (fix in upstream YAML): "The query-string was requested by the visitor." is awkward. Suggest "The query string requested by the visitor."
|
|
||
| Type: `int` | ||
|
|
||
| HTTP response status code returned to browser. |
There was a problem hiding this comment.
Grammar issue (fix in upstream YAML): "HTTP response status code returned to browser." → should be "returned to the browser."
|
|
||
| Type: `int` | ||
|
|
||
| HTTP origin response status code returned to browser. |
There was a problem hiding this comment.
Grammar issue (fix in upstream YAML): "HTTP origin response status code returned to browser." → should be "returned to the browser."
|
I've completed the review of PR #31674. Labels appliedAdded Summary of changesThe PR is an automated sync that introduces:
Issues flaggedI submitted a REQUEST CHANGES review with inline comments pointing out:
These issues are minor but the duplication in the changelog is worth fixing before merge. |
|
Preview URL: https://58253702.preview.developers.cloudflare.com Files with changes (up to 15) |
…dictory Firewall events update - Remove duplicate WebSocket Analytics new-dataset bullet (appeared twice, one per scope). - Remove redundant `Firewall events (added): ZoneName` updated-fields entry — `ZoneName` is already listed in the new account-scope Firewall events dataset. Fixes issues flagged in #31674 (comment)
soheiokamoto
force-pushed
the
sync/log-fields-2026-06-24
branch
from
fe305f1 to
5825370
Compare
2 participants
Summary
Automated sync of Logpush dataset field definitions from data/entities.
New datasets
AISecurityInjectionScore,AISecurityPIICategories,AISecurityTokenCount,AISecurityUnsafeTopicCategories,Action,ClientASN,ClientASNDescription,ClientCountry,ClientIP,ClientIPClass,ClientRefererHost,ClientRefererPath,ClientRefererQuery,ClientRefererScheme,ClientRequestHost,ClientRequestMethod,ClientRequestPath,ClientRequestProtocol,ClientRequestQuery,ClientRequestScheme,ClientRequestUserAgent,ContentScanObjResults,ContentScanObjSizes,ContentScanObjTypes,Datetime,Description,EdgeColoCode,EdgeResponseStatus,FirewallForAIInjectionScore,FirewallForAIPIICategories,FirewallForAITokenCount,FirewallForAIUnsafeTopicCategories,FraudUserID,Kind,LeakedCredentialCheckResult,MatchIndex,Metadata,OriginResponseStatus,OriginatorRayID,RayID,Ref,RuleID,Source, andZoneName.BytesReceivedClient,BytesReceivedOrigin,BytesSentClient,BytesSentOrigin,ClientASN,ClientIP,ClientRequestHost,ClientRequestPath,ClientRequestUserAgent,ColoCode,ConnectionCloseReason,ConnectionCloseSource,ConnectionID,ConnectionTransportCloseCode,EdgeEndTimestamp,EdgeStartTimestamp, andRayID.BytesReceivedClient,BytesReceivedOrigin,BytesSentClient,BytesSentOrigin,ClientASN,ClientIP,ClientRequestHost,ClientRequestPath,ClientRequestUserAgent,ColoCode,ConnectionCloseReason,ConnectionCloseSource,ConnectionID,ConnectionTransportCloseCode,EdgeEndTimestamp,EdgeStartTimestamp, andRayID.Updated fields in existing datasets
BCC,DKIMResult,DMARCPolicy,DMARCResult, andSPFResult.ZoneName.Files changed
src/content/docs/logs/logpush/logpush-job/datasets/account/— dataset pagessrc/content/docs/logs/logpush/logpush-job/datasets/zone/— dataset pagessrc/content/changelog/logs/2026-06-24-log-fields-updated.mdx— changelogDocumentation checklist