Documented steps

Create an API token with 'Logs Write'. The zone-scoped `http_requests` dataset uses /zones/{zone_id}/logpush/...; account-scoped datasets use /accounts/{account_id}/logpush/... .
Discover selectable fields: GET https://api.cloudflare.com/client/v4/zones/{zone_id}/logpush/datasets/http_requests/fields (or .../fields/default) with `Authorization: Bearer $TOKEN`.
Request an ownership challenge where required: POST https://api.cloudflare.com/client/v4/zones/{zone_id}/logpush/ownership with body {"destination_conf":"s3://<BUCKET_PATH>?region=us-west-2"}. Cloudflare writes a challenge file to the bucket; result.filename gives its path. Open that file and copy the token.
Create the job: POST https://api.cloudflare.com/client/v4/zones/{zone_id}/logpush/jobs with body {"name":"<job-name>","destination_conf":"...","dataset":"http_requests","output_options":{"field_names":["ClientIP","ClientRequestHost","ClientRequestMethod","ClientRequestURI","EdgeEndTimestamp","EdgeResponseBytes","EdgeResponseStatus","EdgeStartTimestamp","RayID"],"timestamp_format":"rfc3339"},"ownership_challenge":"<TOKEN>"}. `dataset` cannot be changed after creation.
For R2, destination_conf takes the form r2://<BUCKET_PATH>?account-id=<ACCOUNT_ID>&access-key-id=<R2_KEY>&secret-access-key=<R2_SECRET>; for S3, s3://bucket/[dir]?region=<REGION>[&sse=AES256]. Both support a {DATE} placeholder in the path that expands to YYYYMMDD.
Optionally add a filter: "filter":"{\"where\":{\"and\":[{\"key\":\"ClientRequestPath\",\"operator\":\"contains\",\"value\":\"/static\"}]}}" using operators eq, !eq, lt, leq, gt, geq, startsWith, endsWith, !startsWith, !endsWith, contains, !contains, in, !in under a required top-level `where` key.
Save result.id from the create response. New jobs are created with "enabled": false.
Enable delivery: PUT https://api.cloudflare.com/client/v4/zones/{zone_id}/logpush/jobs/{job_id} with body {"enabled": true} — and resend the complete output_options object in the same call (see gotchas).
Verify: GET https://api.cloudflare.com/client/v4/zones/{zone_id}/logpush/jobs/{job_id} and watch result.last_complete for the timestamp of the last delivered batch; result.last_error / error_message surface delivery failures. Docs: https://developers.cloudflare.com/logs/logpush/logpush-job/api-configuration/ , .../logpush-ownership-challenge/ , .../filters/ , .../datasets/ , https://developers.cloudflare.com/logs/logpush/logpush-job/enable-destinations/r2/

Known gotchas

Updating a job via PUT replaces `output_options` entirely — any previously set field omitted from the payload resets to its default (for example timestamp_format silently reverts to unixnano). Always resend the full output_options object, even when you are only flipping `enabled`.
The ownership challenge is required for some destinations and not others: AWS S3, Google Cloud Storage, Azure Blob Storage and Sumo Logic require it, while S3-compatible storage, HTTP endpoints, Datadog, Splunk and New Relic do not. Cloudflare's own R2 tutorial omits ownership_challenge when authenticating with embedded R2 access keys.
Changing destination_conf on an existing job requires a fresh ownership challenge token; enabling/disabling or editing output_options does not.
The `filter` field is capped at roughly 30 operators and 1000 bytes, and filtering is not supported on object or array[object] field types.
Account-scoped and zone-scoped datasets use different base paths; calling the ownership or jobs endpoint at the wrong scope fails. Check the Datasets page for which scope a dataset belongs to.
New jobs default to enabled:false, so a job that looks correctly configured may simply never have been switched on. On low-traffic zones the first batch can take hours to appear in last_complete.

Create and manage a Cloudflare Logpush job via the API to ship HTTP request logs to an R2 or S3 destination

Documented steps

Known gotchas

Related routes

Give your agent this knowledge — and 15,900+ more routes

Need this verified for your stack — or a route we don't have yet?