Skip to content
Observability

Logs field reference

Use this reference to find the fields available for each log source. Query id, timestamp, event_message, and source as top-level columns. Other structured fields are keys in the log_attributes map: drop the metadata. prefix shown in the source schema and keep the rest of the dotted path.

For example, the schema path metadata.request.cf.country is queried as log_attributes['request.cf.country']. See Query and filter logs for complete ClickHouse examples.

Schema pathClickHouse query fieldType
event_messageevent_messagestring
ididstring
identifieridentifierstring
metadata.load_balancer_redirect_identifierlog_attributes['load_balancer_redirect_identifier']string
metadata.request.cf.asnlog_attributes['request.cf.asn']number
metadata.request.cf.asOrganizationlog_attributes['request.cf.asOrganization']string
metadata.request.cf.botManagement.corporateProxylog_attributes['request.cf.botManagement.corporateProxy']boolean
metadata.request.cf.botManagement.detectionIdslog_attributes['request.cf.botManagement.detectionIds']number[]
metadata.request.cf.botManagement.ja3Hashlog_attributes['request.cf.botManagement.ja3Hash']string
metadata.request.cf.botManagement.scorelog_attributes['request.cf.botManagement.score']number
metadata.request.cf.botManagement.staticResourcelog_attributes['request.cf.botManagement.staticResource']boolean
metadata.request.cf.botManagement.verifiedBotlog_attributes['request.cf.botManagement.verifiedBot']boolean
metadata.request.cf.citylog_attributes['request.cf.city']string
metadata.request.cf.clientTcpRttlog_attributes['request.cf.clientTcpRtt']number
metadata.request.cf.clientTrustScorelog_attributes['request.cf.clientTrustScore']number
metadata.request.cf.cololog_attributes['request.cf.colo']string
metadata.request.cf.continentlog_attributes['request.cf.continent']string
metadata.request.cf.countrylog_attributes['request.cf.country']string
metadata.request.cf.edgeRequestKeepAliveStatuslog_attributes['request.cf.edgeRequestKeepAliveStatus']number
metadata.request.cf.httpProtocollog_attributes['request.cf.httpProtocol']string
metadata.request.cf.latitudelog_attributes['request.cf.latitude']string
metadata.request.cf.longitudelog_attributes['request.cf.longitude']string
metadata.request.cf.metroCodelog_attributes['request.cf.metroCode']string
metadata.request.cf.postalCodelog_attributes['request.cf.postalCode']string
metadata.request.cf.regionlog_attributes['request.cf.region']string
metadata.request.cf.timezonelog_attributes['request.cf.timezone']string
metadata.request.cf.tlsCipherlog_attributes['request.cf.tlsCipher']string
metadata.request.cf.tlsClientAuth.certPresentedlog_attributes['request.cf.tlsClientAuth.certPresented']string
metadata.request.cf.tlsClientAuth.certRevokedlog_attributes['request.cf.tlsClientAuth.certRevoked']string
metadata.request.cf.tlsClientAuth.certVerifiedlog_attributes['request.cf.tlsClientAuth.certVerified']string
metadata.request.cf.tlsExportedAuthenticator.clientFinishedlog_attributes['request.cf.tlsExportedAuthenticator.clientFinished']string
metadata.request.cf.tlsExportedAuthenticator.clientHandshakelog_attributes['request.cf.tlsExportedAuthenticator.clientHandshake']string
metadata.request.cf.tlsExportedAuthenticator.serverFinishedlog_attributes['request.cf.tlsExportedAuthenticator.serverFinished']string
metadata.request.cf.tlsExportedAuthenticator.serverHandshakelog_attributes['request.cf.tlsExportedAuthenticator.serverHandshake']string
metadata.request.cf.tlsVersionlog_attributes['request.cf.tlsVersion']string
metadata.request.headers.cf_connecting_iplog_attributes['request.headers.cf_connecting_ip']string
metadata.request.headers.cf_ipcountrylog_attributes['request.headers.cf_ipcountry']string
metadata.request.headers.cf_raylog_attributes['request.headers.cf_ray']string
metadata.request.headers.hostlog_attributes['request.headers.host']string
metadata.request.headers.refererlog_attributes['request.headers.referer']string
metadata.request.headers.x_client_infolog_attributes['request.headers.x_client_info']string
metadata.request.headers.x_forwarded_protolog_attributes['request.headers.x_forwarded_proto']string
metadata.request.headers.x_real_iplog_attributes['request.headers.x_real_ip']string
metadata.request.hostlog_attributes['request.host']string
metadata.request.methodlog_attributes['request.method']string
metadata.request.pathlog_attributes['request.path']string
metadata.request.protocollog_attributes['request.protocol']string
metadata.request.searchlog_attributes['request.search']string
metadata.request.urllog_attributes['request.url']string
metadata.response.headers.cf_cache_statuslog_attributes['response.headers.cf_cache_status']string
metadata.response.headers.cf_raylog_attributes['response.headers.cf_ray']string
metadata.response.headers.content_locationlog_attributes['response.headers.content_location']string
metadata.response.headers.content_rangelog_attributes['response.headers.content_range']string
metadata.response.headers.content_typelog_attributes['response.headers.content_type']string
metadata.response.headers.datelog_attributes['response.headers.date']string
metadata.response.headers.sb_gateway_versionlog_attributes['response.headers.sb_gateway_version']string
metadata.response.headers.transfer_encodinglog_attributes['response.headers.transfer_encoding']string
metadata.response.headers.x_kong_proxy_latencylog_attributes['response.headers.x_kong_proxy_latency']string
metadata.response.origin_timelog_attributes['response.origin_time']number
metadata.response.status_codelog_attributes['response.status_code']number
timestamptimestampdatetime