Export & Reference

Learn how to export Instant Logs data and review query, export, retention, and log behavior limits.

Instant Logs allows you to export the complete result set matching your current filters and time range, up to the applicable export limit. This page also provides an example log entry, interface limits, and usage notes for interpreting Instant Logs data.

Exporting Logs

Select Export in the page header to open the export panel.

The export includes all records matching the current filters and time range, not only the rows currently displayed in the log table. Before the export begins, the panel displays the total number of matching rows.

The export panel: matching row count, format choice and the downloadable parts.

Two export formats are available:

• CSV -- Comma-separated data with one header row and one row per request.

• JSON (NDJSON) -- Newline-delimited JSON with one JSON object per line.

Exports are delivered in parts rather than as a single file:

• 10,000 rows per part.

• Up to 20 parts per export.

• Up to 200,000 rows per export.

You can download individual parts or download all available parts in sequence.

When more than one source is available, the export panel provides a source selector. Select a single source or All sources. When All sources is selected, Instant Logs exports each source separately and generates one set of files per source.

If the result set exceeds 200,000 rows, the export is truncated after the first 200,000 rows. Reduce the selected time range or apply additional filters when you need a smaller result set.

For continuous or bulk delivery of logs to your own storage or SIEM system, use Logpush instead of Instant Logs export.

Example Log Entry

The following example shows the structure of an Instant Logs record:

{
  "timestamp": "2026-08-06T11:43:02.000Z",
  "request_id": "4cf6103583ff66578fa4466a074095d6",
  "request_method": "GET",
  "request_uri": "/wp-content/uploads/assets/demo/image.svg",
  "status": "200",
  "proxy_cache_status": "HIT",
  "bytes_sent": "1674",
  "body_bytes_sent": "1412",
  "country_code": "TR",
  "asn": "47331",
  "isp": "Turk Telekom",
  "request_time": 0.012,
  "upstream_response_time": 0
}

Limits

Limit	Value
Maximum time range per query	7 days
Rows returned per request	1,000
Rows per page in the table	25 / 50 / 100 / 200
Filterable fields	35, plus content_type on Cloudflare
Fields with distribution statistics	32, plus content_type on Cloudflare
Sources per query	10
Rows per export part	10,000
Parts per export	20
Rows per export, total	200,000

Two additional limits depend on your Instant Logs plan:

• Log retention period.

• Number of CDN sources you can connect.

A query cannot access data older than the applicable retention period, even when the selected time range extends beyond that period.

Usage Notes

• Time zones -- Timestamps in the log table and exported data use UTC. The Log Volume chart displays its time axis using the local time zone configured in your browser. As a result, chart times and log timestamps can differ by your local UTC offset.

• Cached responses report near-zero timings -- A response served directly from the edge cache commonly reports a request_time value close to 0.000 because the request does not require origin processing. Non-zero values usually indicate that the request reached the origin.

• Cache invalidation appears in logs -- PURGE requests are handled by the edge and recorded in Instant Logs like other requests. On resources with frequent cache invalidation, PURGE requests can represent a significant share of the recorded request methods. Apply request_method is not PURGE to focus on visitor traffic.

• A cached 404 is expected behavior -- Negative responses can be cached. A 404 response with a proxy_cache_status value of HIT indicates that the edge served a cached not-found response instead of requesting the object from the origin again.

• Empty fields are expected -- A field with no value for a request, or a field that the source CDN does not provide, is returned empty rather than omitted. This keeps records from different sources aligned in the shared schema.

• Storage capacity affects available history -- When the included storage capacity is reached, Instant Logs removes the oldest logs to make space for new records. No storage overage charge is applied, but removed logs are no longer available for queries. To retain all log records independently of the Instant Logs storage limit, use Logpush to deliver logs to your own storage.