Cloudflare Logpush

Agent Analytics can ingest your zone's HTTP request logs through Cloudflare Logpush. Cloudflare posts gzip-compressed batches to GeoGenie's access-log API so you can see AI bot activity alongside your other GeoGenie metrics — without deploying a Worker or changing how your origin serves traffic.

How it works

Create a Logpush job on the HTTP requests dataset and set the destination to GeoGenie's HTTP endpoint. Each record includes host, path, method, query string, client IP, user agent, referer, response status, and bytes sent. GeoGenie classifies those requests and stores page views (static assets such as scripts, styles, and images are skipped).

Logs are sent to https://logs-api.geogenie.ai/cloudflare/logpush. Cloudflare has no separate header field for destinations; custom headers are encoded as header_* query parameters on the destination URL. Your site's ingest token travels as header_X-API-Key; Cloudflare turns that into the X-API-Key request header.

Delivery is not request-by-request. Logpush processes batches about once a minute (sometimes more often) and there is no minimum batch size, so a push can be a single line. After GeoGenie accepts a batch, page views can take up to a minute to appear in the console log check. Daily charts update a few minutes later.

Worker or Logpush

Use Cloudflare Logpush when you want zone-wide HTTP logs without running middleware. Use the Cloudflare Worker when you prefer a per-request Worker on a specific route. Do not run both on the same host — every request would be counted twice.

Prerequisites

• A Cloudflare zone for the host you want to measure
• Permission to create a Logpush job with an HTTP destination
• A GeoGenie workspace with Agent Analytics bot tracking configured for that host, using Cloudflare Logpush as the provider

Get your destination URL

GeoGenie shows the destination URL with your ingest token already encoded. Open Agent Analytics bot tracking setup, add the site host, choose Cloudflare Logpush as the provider, and copy the URL. Keep it exactly as shown. A typical URL looks like:

https://logs-api.geogenie.ai/cloudflare/logpush?header_X-API-Key=YOUR_API_KEY

Create the Logpush job

In the Cloudflare dashboard:

1. Open your zone, then go to Analytics & Logs → Logpush → Create a Logpush job.
2. Choose HTTP destination and paste the URL from GeoGenie. Cloudflare sends a small gzipped test upload ({"content":"tests"}); GeoGenie accepts that probe so the job can be saved.
3. Select the HTTP requests dataset.
4. Include the fields listed below. Extra fields are ignored; missing required fields cause those records to be dropped.
5. Leave output as NDJSON (the default). Timestamp format RFC3339 or unix nanoseconds both work.

After the job is enabled, generate a page-view on the site (not only static assets), wait about a minute, then use the log check in Agent Analytics in the console to confirm events are arriving.

Required log fields

Include these HTTP requests fields:

• EdgeStartTimestamp
• ClientRequestHost
• ClientRequestMethod
• ClientRequestPath
• ClientRequestURI
• ClientIP
• ClientRequestUserAgent
• ClientRequestReferer
• EdgeResponseStatus
• EdgeResponseBytes

Create the job with the Cloudflare API

The GeoGenie console also shows a ready-to-paste curl. The same job looks like this (replace the zone, token, and API key):

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/logpush/jobs" \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --json '{
  "name": "geogenie-access-logs",
  "dataset": "http_requests",
  "destination_conf": "https://logs-api.geogenie.ai/cloudflare/logpush?header_X-API-Key=YOUR_API_KEY",
  "output_options": {
    "field_names": [
      "EdgeStartTimestamp",
      "ClientRequestHost",
      "ClientRequestMethod",
      "ClientRequestPath",
      "ClientRequestURI",
      "ClientIP",
      "ClientRequestUserAgent",
      "ClientRequestReferer",
      "EdgeResponseStatus",
      "EdgeResponseBytes"
    ],
    "timestamp_format": "rfc3339"
  },
  "max_upload_records": 5000,
  "enabled": true
}'

Troubleshooting

• Confirm the destination URL includes header_X-API-Key and that the key matches the Cloudflare Logpush host in the GeoGenie console. The value must be URL-encoded if it contains reserved characters.
• If Cloudflare cannot save the job, the destination probe failed. The endpoint must be HTTPS with a trusted certificate and must return 2xx for the gzipped {"content":"tests"} upload.
• Confirm the job uses the HTTP requests dataset and includes the required fields above.
• Static asset URLs (for example .js, .css, images) are dropped. Generate an HTML page view, then run the log check again.
• If a Worker is also sending logs for this host, disable one of the two sources so visits are not double-counted.