Ingest Field Selection Now Available

Cloudflare Log Explorer has introduced Ingest Field Selection, a new capability that gives users precise control over which data fields are captured and stored when working with log datasets. This addresses a previous limitation where enabling logs meant accepting all available fields regardless of actual need.

Key Capabilities

• Granular control: Select only specific fields needed for each dataset, reducing noise and focusing on relevant metrics
• Dynamic field management: Update field selections for existing, already-enabled logstreams at any time without re-ingestion
• Historical query consistency: Previously captured fields remain queryable even after being disabled
• Data integrity: Core fields like Timestamp are automatically retained to ensure logs remain searchable and chronologically accurate

How It Works

Users can define field selections via the dashboard or API when configuring a dataset. For example, you might select only Timestamp, ClientRequestHost, ClientIP, Action, and response status fields instead of ingesting the entire field set. The Timestamp field is mandatory to ensure proper data indexability.

Use Cases

This capability is particularly valuable for organizations looking to:

• Reduce storage costs by ingesting only relevant fields
• Improve query performance by focusing on important security and performance metrics
• Maintain compliance and data governance by controlling what gets captured
• Iterate on monitoring strategy without full re-ingestion cycles

For detailed implementation guidance, refer to the Log Explorer documentation.