https://cloudflare-log-collector.munchbox.cc/docs/index.htmlGuides, architecture, and reference for the Cloudflare analytics collector. Architecture Interactive diagram showing the data flow from Cloudflare's API through the collector into Loki, Prometheus, and Tempo. README Full project documentation: configuration, deployment, metrics, Loki streams, and project structure. Grafana Dashboard Pre-built dashboard for monitoring poll health, firewall events, HTTP traffic, and Loki push status. Changelog Release history and notable changes across all versions.Hugoen-ushttps://cloudflare-log-collector.munchbox.cc/docs/architecture/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://cloudflare-log-collector.munchbox.cc/docs/architecture/index.htmlData flow from Cloudflare's GraphQL API through the collector into the observability stack flowchart TD CF["Cloudflare GraphQL API"] POLL["Poll Scheduler"] FW["Firewall Collector"] HTTP["HTTP Collector"] METRICS["Metrics Exporter"] LOKIC["Loki Client"] TRACE["Trace Context"] SLOG["Structured Logger"] LOKI["Loki"] PROM["Prometheus"] TEMPO["Tempo"] GRAFANA["Grafana"] CF -->|"GraphQL queries"| POLL POLL --> FW POLL --> HTTP FW -->|"JSON log lines"| LOKIC HTTP -->|"JSON log lines"| LOKIC HTTP -->|"gauge updates"| METRICS FW -->|"event counters"| METRICS LOKIC -->|"POST /loki/api/v1/push"| LOKI METRICS -->|"/metrics"| PROM TRACE -->|"OTLP gRPC"| TEMPO SLOG -->|"trace_id injection"| TRACE LOKI --> GRAFANA PROM --> GRAFANA TEMPO --> GRAFANA classDef source fill:#0c2d48,stroke:#38bdf8,color:#e0f2fe classDef collector fill:#1e293b,stroke:#334155,color:#e2e8f0 classDef sink fill:#132a1f,stroke:#22c55e,color:#dcfce7 classDef viz fill:#2d2513,stroke:#f97316,color:#fef3c7 class CF source class POLL,FW,HTTP,METRICS,LOKIC,TRACE,SLOG collector class LOKI,PROM,TEMPO sink class GRAFANA viz Data Flow Poll Cycle The poll scheduler triggers on a configurable interval (default 5 minutes) Two collectors run in parallel within each cycle: Firewall collector queries firewallEventsAdaptive for individual WAF events HTTP collector queries httpRequestsAdaptiveGroups for aggregated traffic stats Each collector is wrapped in an OpenTelemetry span for end-to-end trace visibility Firewall Events Each event becomes a JSON log line pushed to Loki under {job="cloudflare", type="firewall"} Event counts are tracked as Prometheus counters broken down by action type (block, challenge, allow) Fields captured: action, client IP, host, method, path, query, ray name, rule ID, source, user agent, country HTTP Traffic Aggregated groups are pushed to Loki under {job="cloudflare", type="http_traffic"} as JSON Request counts are exposed as Prometheus gauges labeled by method, status code, and country Edge response bytes are tracked as a separate gauge Observability Prometheus: 9 metric families covering poll health, firewall events, HTTP traffic, Loki push status, and build info Loki: Two structured log streams with distinct label sets for filtering Tempo: Full trace per poll cycle with child spans for each API call and Loki push Log-trace correlation: A custom slog handler injects trace_id and span_id into every log line, enabling one-click navigation between logs and traces in Grafana Resilience Both Cloudflare and Loki clients retry on transient failures (HTTP 429, 502, 503, 504) with exponential backoff up to 3 attempts Retry-After headers are honored when present On startup, the collector backfills up to the configured window (default 1 hour) to catch events from while it was downhttps://cloudflare-log-collector.munchbox.cc/docs/readme/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://cloudflare-log-collector.munchbox.cc/docs/readme/index.htmlA lightweight Go service that polls the Cloudflare GraphQL Analytics API for firewall events and HTTP traffic statistics, ships them into a self-hosted observability stack, and traces every poll cycle with OpenTelemetry. Firewall events are pushed to Loki as structured JSON log lines for querying in Grafana HTTP traffic stats are exposed as Prometheus gauges (by method, status, and country) and also pushed to Loki for raw detail Every poll cycle gets its own OpenTelemetry trace with child spans for API calls and Loki pushes, exported to Tempo via OTLP gRPC Log-trace correlation is automatic — trace_id and span_id are injected into every structured log line via a custom slog handler, enabling one-click navigation between Loki logs and Tempo traces in Grafana Cloudflare GraphQL API | v +---------------------------+ | cloudflare-log-collector | +---------------------------+ | | | v v v Loki Prometheus Tempo (events) (metrics) (traces) \ | / '--- Grafana ------' Table of Contents Datasets Prometheus Metrics Loki Streams Configuration Deployment Development Project Structure Datasets Firewall Events (firewallEventsAdaptive) Individual WAF/firewall events with full request detail. Each event becomes a JSON log line in Loki under {job="cloudflare", type="firewall", zone="munchbox.cc"}.https://cloudflare-log-collector.munchbox.cc/docs/grafana/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://cloudflare-log-collector.munchbox.cc/docs/grafana/index.htmlPre-built Grafana dashboard for monitoring Cloudflare analytics collection The dashboard tracks the full collection pipeline at a glance. Poll health panels show success/failure rates, latency histograms, and last-poll timestamps for each dataset and zone. Firewall events are broken down by action type (block, challenge, allow) with trending counters. HTTP traffic panels display request counts by method, status code, and country alongside edge response byte gauges. Loki push panels monitor push success rates and latency to catch delivery issues early. Build info and version metadata round out the overview.https://cloudflare-log-collector.munchbox.cc/docs/changelog/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://cloudflare-log-collector.munchbox.cc/docs/changelog/index.htmlAll notable changes to this project are documented in this file. [0.1.12] - 2026-03-16 Fixed Fix service graph visibility in Tempo (#18) Fix service graph visibility in Tempo by using CLIENT span kind Improved update CHANGELOG.md for v0.1.11 (#16) Other Move logo above title in README and reorder header elements added logo to readme [0.1.11] - 2026-03-15 Added Add Hugo documentation site (#13) Add Hugo documentation site Improved update CHANGELOG.md for v0.1.10 (#11) Other Polish documentation site: landing cards, page headers, logo sizing (#15) Polish documentation site: landing cards, page headers, logo sizing [0.1.10] - 2026-03-15 Improved update CHANGELOG.md for v0.1.9 (#10) Other general repo housekeeping/setup [0.1.8] - 2026-03-15 Added add multi-zone support Fixed fix timing rejection issue (#7) fix timing rejection issue Fix reliability issues and improve Go best practices (#5) (#6) Fix reliability issues and improve Go best practices (#5) Improved updated image Other setting up release functionality for repo to match other go projects … (#8) setting up release functionality for repo to match other go projects I have dashboard fix Feat: added grafana dashboard and some code changes to make the dashboardd better. put an image of it on the readme Ship HTTP traffic to Loki, add country metrics, CI/CD and project docs Initial commit: Cloudflare analytics collector