Cloudflare Observability Platform: Unified Telemetry, SQL Querying, and Custom Dashboards

Streamlining Distributed Telemetry Across Edge Infrastructure

Debugging modern edge applications often requires correlation across disjointed signals. A sudden spike in HTTP 5xx errors, for instance, might originate from a Cloudflare Worker execution failure, an unhandled origin connection drop, or a regional network degradation. Previously, diagnosing these issues required context-switching between product-specific interfaces and query tools.

To address this complexity, Cloudflare is consolidating its logging, tracing, metrics, custom alerting, dashboards, and exporting tools into a single observability platform. By establishing standard data interfaces, standardized SQL querying, and OpenTelemetry integration, this platform provides unified visibility across all traffic processing layers.

1. Centralized Log Exploration Across Cloudflare Datasets

The updated central Logs home combines Workers Observability (used for debugging Workers and connected resources) with Log Explorer (used for evaluating security events). Technical teams can analyze telemetry across several core datasets within a single unified workspace, including:

• HTTP request events
• Firewall and security events
• Cloudflare Workers execution logs
• Cloudflare Containers events
• Cloudflare R2 object storage operations
• AI Gateway requests

Investigative workflows allow users to start from macro-level metrics—such as an unexplained latency spike—group results by data center or hostname, narrow down affected URL paths, and inspect specific request executions using their unique Ray ID. Queries can be constructed directly using raw SQL or built-in filter tools. Additionally, natural language capabilities allow teams to generate chart visualizations directly from text prompts to evaluate detected anomalies.

2. End-to-End Tracing via OpenTelemetry Standards

Currently in open beta, Cloudflare Traces provides request-level execution visibility across the platform lifecycle. Traces capture performance spans and execution decisions made by Cloudflare products, including:

• Security rule evaluations
• Header and URL transformations
• Cache decision logic
• Edge routing decisions
• Workers execution
• Origin handling response times

Teams can establish a continuous baseline sampling rate for broad coverage, and subsequently deploy targeted Trace Rules during active investigations. Trace Rules enable high-density sampling targeted at specific hostnames, paths, incoming client IP addresses, or request headers. Individual traces can be retrieved via Ray ID and analyzed directly inside the dashboard. To maintain compatibility with external telemetry stacks, traces support export over OpenTelemetry, alongside W3C trace context propagation to accept and pass trace headers to origin servers.

3. Unified SQL API, CLI Tooling, MCP Server, and Native Worker Bindings

To reduce integration overhead for developers and automated AI agents, Cloudflare has introduced a unified SQL API (currently in beta). Instead of maintaining individual integration models for Workers logs, Containers security events, HTTP logs, and analytics, all telemetry datasets share a single authentication model, API pattern, and SQL dialect.

Command-line users and automated agents can query this data using the new Cloudflare CLI tool, cf, or connect using Cloudflare’s Observability Model Context Protocol (MCP) server. Schema definitions, dataset fields, and pre-built query examples are documented to streamline automated query generation.

Furthermore, Cloudflare Workers now feature a native SQL binding interface. This native execution capability allows Workers to directly execute telemetry queries without external API configuration. Practical use cases include:

• Querying Workers Analytics Engine datasets to meter tenant usage for real-time billing workflows
• Powering customer-facing embedded analytics dashboards
• Generating real-time health and uptime reports
• Automating incident containment workflows directly inside worker scripts

4. Volume-Based Ingestion and Storage Pricing Model

Cloudflare is shifting from event-count pricing to a volume-based subscription model calculated on gigabytes ingested and stored. Effective December 1, 2026 (and upon plan renewal for Enterprise customers), this pricing structure covers all ingestion across the Developer Platform—including Workers, Containers, AI Gateway, and tracing data.

5. SQL-Driven Custom Alerts and Anomaly Monitoring

Cloudflare’s notification engine has been upgraded to Alerts (in beta). Teams can write custom alert rules using SQL queries executed against HTTP request logs, Workers events, Workers Analytics Engine datasets, traces, and security events.

Alert configurations support thresholds, statistical anomalies, and Service Level Objectives (SLOs) evaluated across custom time windows. For example, teams can trigger alerts when origin 5xx response rates exceed acceptable levels over a 5-minute window, when a Container enters a crash loop, or when error rates jump following a Workers deployment.

Alert destinations include chat platforms, incident management tools, and webhooks (which are now accessible across all plan tiers, including Free). Webhook support enables automated notifications to be routed directly to automated remediation services or AI agents for immediate investigation.

6. Consolidated 30-Day Domain Analytics

Domain-level analytics now aggregate traffic, performance, security, caching, origin connections, and DNS data into a unified dashboard. This consolidated view allows engineers to verify whether latency regressions stem from a regional Cloudflare data center, an individual hostname configuration, or upstream origin failure.

All account tiers—including Free plans—now include 30 days of data retention for domain analytics. This extended context simplifies historical trend analysis, day-over-day performance comparisons, and anomaly verification.

7. Custom Dashboards for Multi-Product Monitoring

To eliminate query duplication during incident responses, Custom Dashboards enable users to pull metrics across Cloudflare products into a shared workspace. Engineers can place domain traffic, Workers performance logs, container health metrics, and blocked firewall events side-by-side.

Key performance indicators available for custom dashboard widgets include total request volumes, system error rates, latency distribution, storage utilization, and security drop rates.

8. Self-Serve Logpush Expansion and SQL Transformers

Logpush—previously restricted to Enterprise plans—is now available across all self-serve plan levels, enabling automated export of Cloudflare logs to external SIEMs, object stores, and analytics tools. Additionally, Logpush Transformers is now Generally Available (GA), offering inline SQL data transformation, filtering, field redaction, and schema reshaping before logs leave Cloudflare’s network.

Platform Roadmap

Cloudflare’s observability roadmap includes additional standardizations and retention expansions:

• Extended Retention: Options to retain logs and traces for up to one year to support long-term auditing and trend identification.
• OpenTelemetry API Expansion in Workers: Support for appending custom span attributes and extracting W3C trace context inside Workers code.
• OpenTelemetry Metrics Export: Direct export capabilities for Cloudflare operational metrics to standard OpenTelemetry collectors.

Primary reference: Review the original announcement for exact release details. This article is an independent explanation and does not reproduce the source text.