--- schema_version: "1" id: 1cd747df6f3cdfc0c20530ea4151f7f5edf4ebdd54b616f4b318e619e3d6afab title: eCDN Logpush collection: developer version: current locale: en-us portal_url: https://docs.salesforce.com/developer/current/en-us/commerce-cloud/commerce-api/guides/cdn-zones-logpush.md canonical_url: https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/cdn-zones-logpush.html source_site: developer.salesforce.com content_type: documentation content_hash: 8be8a4bea1a7199517b2ba64ccec0e7a92962792c8f8b1234f56afdba60b53a1 products: - Composable Storefront - Salesforce APIs --- # eCDN Logpush eCDN Logpush delivers eCDN logs in batches to specified destinations. eCDN logs contain valuable information, such as the client IP address, the requested URL, the user agent string, and details about firewall events such as blocked requests, firewall rule triggers, and more. When creating a Logpush job through eCDN Logpush, view the list of available fields for [http_requests](https://developer.salesforce.com/docs/commerce/commerce-api/guide/cdn-zones-logpush-log-field.html#http-requests-log-fields), [firewall](https://developer.salesforce.com/docs/commerce/commerce-api/guide/cdn-zones-logpush-log-field.html#firewall-event-log-fields), and [pageshield](https://developer.salesforce.com/docs/commerce/commerce-api/guide/cdn-zones-logpush-log-field.html#page-shield-log-event-fields) events. Also specify which log types to deliver, including HTTP requests and firewall events, and specify different destination types: - [Create Logpush job for Amazon S3](#create-amazon-s3-bucket-logpush-job) bucket (Requires ownership verification step) - [Create Logpush job for Google Cloud Storage](#create-google-cloud-storage-gcs-logpush-job) (Requires ownership verification step) - [Create Logpush job for Azure](#create-azure-logpush-job) - [Create Logpush job for Datadog](#create-datadog-logpush-job) - [Create Logpush job for Splunk](#create-splunk-logpush-job) - [Create Logpush job for HTTPS](#create-https-logpush-job) - [Create Logpush job for Kinesis](#create-kinesis-logpush-job) ## Create Amazon S3 Bucket Logpush Job ### Prerequisites Enable log push for an Amazon S3 destination: - Create an S3 bucket. For details, see [AWS S3](https://docs.aws.amazon.com/quickstarts/latest/s3backup/step-1-create-bucket.html) documentation. - In the Amazon S3 console, navigate to **S3** \> **Bucket** \> **Permissions** \> **Bucket Policy**, and edit and paste the policy, replacing the Resource value with your own bucket path. The AWS Principal is owned by the CDN provider and must not be changed. ```json { "Id": "PutObjPolicy", "Version": "2012-10-17", "Statement": [ { "Sid": "AllowObjectFromeCDNLogpush", "Action": [ "s3:PutObject" ], "Effect": "Allow", "Resource": "arn:aws:s3:::example-bucket/*", "Principal": { "AWS": [ "arn:aws:iam::391854517948:user/cloudflare-logpush" ] } } ] } ``` **note:** To avoid incomplete files and minimize storage costs, use the `AbortIncompleteMultipartUpload` action when setting up a rule for S3 multipart uploads with eCDN Logpush. For details, see [Uploading and copying objects using multipart upload\_](https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuoverview.html#mpu-abort-incomplete-mpu-lifecycle-config). ### Create Amazon S3 Bucket Ownership Token eCDN Logpush supports pushing eCDN logs directly to Amazon S3 through [CDN-API Logpush API](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=Summary). However, before you can create an eCDN Logpush job to directly push logs to an AWS S3 bucket, you must demonstrate ownership of the S3 bucket. You do this by writing the ownership token file to the bucket destination. You must also create a unique ownership challenge token for each destination path within the same bucket. You can use the special string `{DATE}` in the destination path to separate logs into daily subdirectories. For example, `s3://customer-bucket/logs/{DATE}?region=us-east-1\&sse=AES256`. When the logs are stored, the name of the directory is replaced with the date in `YYYYMMDD` format, for example: `20230215`. Example request: Use the [B2C CLI](https://developer.salesforce.com/docs/commerce/b2c-commerce/guides/b2c-developer-tooling.md): ```bash # Required scopes: sfcc.cdn-zones, sfcc.cdn-zones.rw export SFCC_CLIENT_ID='your-account-manager-client-id' export SFCC_CLIENT_SECRET='your-account-manager-client-secret' export SFCC_SHORTCODE='your-short-code' npx @salesforce/b2c-cli ecdn logpush ownership \ --tenant-id abcd_stg --zone stg-abcd-example-com.cc-ecdn.net \ --destination-path 's3://example-bucket/log?region=us-east-1' ``` Alternatively, use the API: ```bash curl "https://{shortCode}.api.commercecloud.salesforce.com/cdn/zones/v1/organizations/f_ecom_bcxj_prd/zones/{zoneId}/logpush/ownership" \ --request POST \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data-raw '{ "destinationPath": "s3://example-bucket/log?region=us-east-1" }' ``` Example response: `{ "data": { "destinationPath": "s3://example-bucket/log?region=us-east-1", "fileName": "log/ownership-challenge-072fd6be.txt" } }` ### Create Logpush Job API Call for Amazon S3 Populate the \`ownershipChallengeToken\` based on the call made in the previous section. The `destinationPath` must be the same as the one specified while generating the ownership token. For details, see the [Parameters](#parameters), [Optional Parameters](#optional-parameters) and [Limitations](#limitations) sections. Example Logpush job API call: Use the [B2C CLI](https://developer.salesforce.com/docs/commerce/b2c-commerce/guides/b2c-developer-tooling.md): ```bash npx @salesforce/b2c-cli ecdn logpush jobs create \ --tenant-id abcd_stg --zone stg-abcd-example-com.cc-ecdn.net \ --name ExampleLogPushJob \ --destination-path 's3://example-bucket/log?region=us-east-1' \ --ownership-token 'your-ownership-challenge-token' \ --log-type http_requests \ --log-fields CacheCacheStatus,ClientRequestHost,ClientRequestPath,EdgeResponseStatus,EdgeStartTimestamp ``` Alternatively, use the API: ```bash curl "https://{shortCode}.api.commercecloud.salesforce.com/cdn/zones/v1/organizations/f_ecom_bcxj_prd/zones/{zoneId}/logpush/jobs" \ --request POST \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data-raw '{ "name": "ExampleLogPushJob", "destinationPath": "s3://example-bucket/log?region=us-east-1", "logType": "http_requests", "ownershipChallengeToken": "Put your ownership challenge token here", "logFields": [ "CacheCacheStatus", "CacheResponseBytes", "ClientRequestPath", "ClientRequestBytes", "ClientRequestHost", "ClientRequestUserAgent", "EdgeResponseStatus", "EdgeResponseBytes", "EdgeStartTimestamp", "EdgeTimeToFirstByteMs" ] }' ``` Example API call response: 201 status code ```json {"data": {"jobId": 213543,"name": "ExampleLogPushJob","logType": "http_requests","logFields": ["CacheCacheStatus","CacheResponseBytes","ClientRequestPath","ClientRequestBytes","ClientRequestHost", "ClientRequestUserAgent","EdgeResponseStatus","EdgeResponseBytes","EdgeStartTimestamp","EdgeTimeToFirstByteMs"],"destinationPath":"s3://example-bucket/log?region=us-east-1","enabled": false,"createdOn":"2023-04-18T17:18:43Z"}} ``` ## Create Google Cloud Storage (GCS) Logpush Job ### Prerequisites Enable log push for a GCS destination: - Create a GCS bucket. - Cloudflare uses Google Cloud Identity and Access Management (IAM) to gain access to your Google Cloud Storage bucket. The Cloudflare IAM service account needs admin permission for the bucket. Add the member `logpush@cloudflare-data.iam.gserviceaccount.com` with Storage Object Admin permission. This makes sure that Cloudflare can push the ownership verification and logs to the GCS bucket. ### Create GCS Ownership Token eCDN Logpush supports pushing eCDN logs directly to Google Cloud Storage (GCS) through the [CDN Logpush API](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=Summary). However, before you can create an eCDN Logpush job for pushing logs to a GCS bucket, you must demonstrate ownership of the GCS bucket. You do this by writing the ownership token file to the bucket destination. You must also create a unique ownership challenge token for each destination path within the same bucket. You can use the special string `{DATE}` in the destination path to separate logs into daily subdirectories. For example `gs://customer-bucket/logs/{DATE}`. When the logs are stored, the name of the directory is replaced with the date in `YYYYMMDD` format, for example: `20230215`. Example request:` ```bash curl "https://{shortCode}.api.commercecloud.salesforce.com/cdn/zones/v1/organizations/f_ecom_bcxj_prd/zones/{zoneId}/logpush/ownership" \ --request POST \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data-raw '{ "destinationPath": "gs://cflogpushtest/http_requests/{DATE}" }' ``` Example response: `{ "data": { "destinationPath": "gs://cflogpushtest/http_requests/20251008", "fileName": "http_requests/20251008/ownership-challenge-072fd6be.txt" } }` ### Create Logpush Job API Call for GCS Populate the `ownershipChallengeToken` based on the call made in the previous section. The \`destinationPath\` must be the same as one specified while generating the ownership token. For details, see the [Parameters](#parameters), [Optional Parameters](#optional-parameters) and [Limitations](#limitations) sections. Example logpush job API call: ```bash curl "https://{shortCode}.api.commercecloud.salesforce.com/cdn/zones/v1/organizations/f_ecom_bcxj_prd/zones/{zoneId}/logpush/jobs" \ --request POST \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data-raw '{ "name": "ExampleLogPushJob", "destinationPath": "gs://cflogpushtest/http_requests/{DATE}", "logType": "http_requests", "ownershipChallengeToken": "Put your ownership challenge token here", "logFields": [ "CacheCacheStatus", "CacheResponseBytes", "ClientRequestPath", "ClientRequestBytes", "ClientRequestHost", "ClientRequestUserAgent", "EdgeResponseStatus", "EdgeResponseBytes", "EdgeStartTimestamp", "EdgeTimeToFirstByteMs" ] }' ``` Example API call response: 201 status code ```json {"data": {"jobId": 213543,"name": "ExampleLogPushJob","logType": "http_requests","logFields": ["CacheCacheStatus","CacheResponseBytes","ClientRequestPath","ClientRequestBytes","ClientRequestHost", "ClientRequestUserAgent","EdgeResponseStatus","EdgeResponseBytes","EdgeStartTimestamp","EdgeTimeToFirstByteMs"],"destinationPath":"gs://cflogpushtest/http_requests/{DATE}","enabled": false,"createdOn":"2023-04-18T17:18:43Z"}} ``` ## Create Azure Logpush Job ### Prerequisites Enable log push for an Azure destination: - Create a Blob Storage container. For details, see [instructions from Azure ↗](https://docs.microsoft.com/en-us/azure/storage/blobs/storage-quickstart-blobs-portal). - Create a [shared access signature (SAS) ↗](https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview) to secure and restrict access to your blob storage container. - Use [Storage Explorer ↗](https://learn.microsoft.com/en-us/azure/storage/storage-explorer/vs-azure-tools-storage-manage-with-storage-explorer) to navigate to your container and right click on the container to create a signature. Set the signature to expire at least five years from the current date and only provide write permission. - Provide the SAS URL as part of your `destinationPath` attribute. - Logpush stops pushing logs if your SAS token expires, which is why an expiration period of at least five years is needed. Example destination configuration for Azure: ```text “azure://cflogpushtest.blob.core.windows.net//cflogpush/{DATE}?sv=2024-11-04&ss=b&srt=o&sp=wactf&se=2030-09-23T22:27:16Z&st=2025-09-23T14:12:16Z&spr=https&sig=abcdefgh%3D” ``` Cloudflare makes a test call to push test data to the Azure destination specified. If successful, the logpush job is created. If not, the logpush job creation fails. ### Create Logpush Job API call for Azure The following example creates a logpush job with an Azure destination path. For details, see the [Parameters](#parameters), [Optional Parameters](#optional-parameters) and [Limitations](#limitations) sections. ```bash curl "https://{shortCode}.api.commercecloud.salesforce.com/cdn/zones/v1/organizations/f_ecom_bcxj_prd/zones/{zoneId}/logpush/jobs" \ --request POST \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data-raw '{ "name": "ExampleLogPushJob", "destinationPath": "azure://cflogpush.blob.core.windows.net//cflogpush/{DATE}?sv=2024-11-04&ss=b&srt=o&sp=wactf&se=2030-01-01T00:00:00Z&st=2025-01-01T00:00:00Z&spr=https&sig=abcdefghIJKLMNOP%3D", "logType": "http_requests", "logFields": [ "CacheCacheStatus", "CacheResponseBytes", "ClientRequestPath", "ClientRequestBytes", "ClientRequestHost", "ClientRequestUserAgent", "EdgeResponseStatus", "EdgeResponseBytes", "EdgeStartTimestamp", "EdgeTimeToFirstByteMs" ] }' ``` Example API call response: 201 status code ```json {"data": {"jobId": 213543,"name": "ExampleLogPushJob","logType": "http_requests","logFields": ["CacheCacheStatus","CacheResponseBytes","ClientRequestPath","ClientRequestBytes","ClientRequestHost", "ClientRequestUserAgent","EdgeResponseStatus","EdgeResponseBytes","EdgeStartTimestamp","EdgeTimeToFirstByteMs"],"destinationPath":"azure://cflogpush.blob.core.windows.net//cflogpush/{DATE}?sv=2024-11-04&ss=b&srt=o&sp=wactf&se=2030-01-01T00:00:00Z&st=2025-01-01T00:00:00Z&spr=https&sig=abcdefghIJKLMNOP%3D","enabled": false,"createdOn":"2023-04-18T17:18:43Z"}} ``` ## Create Datadog Logpush Job ### Prerequisites Enable log push for a Datadog destination: - Specify your destination configuration hostname as either `http-intake.logs.datadoghq.com/v1/input` or `http-intake.logs.datadoghq.com/api/v2/logs` - Retrieve the Datadog API Key using the [Datadog documentation](https://docs.datadoghq.com/account_management/api-app-keys/#add-an-api-key-or-client-token). This is a **required** field. - You can set the service, host name, Datadog `ddsource` field, and `ddtags` fields as URL parameters. While these parameters are **_optional_**, they can be useful for indexing or processing logs. For details, see the [Logs section ↗](https://docs.datadoghq.com/api/latest/logs/) in Datadog's documentation. Note that the values of these parameters can contain special characters, which should be URL encoded. Example destination configuration for Datadog: ```json "datadog://?header_DD-API-KEY=&ddsource=cloudflare&service=&host=&ddtags=” ``` Cloudflare makes a test call to push test data to the specified Datadog destination configuration. If successful, the logpush job is created. If not, the logpush job creation fails. ### Create Logpush Job API call for Datadog This example creates a logpush job with a Datadog destination path. For details, see the [Parameters](#parameters), [Optional Parameters](#optional-parameters) and [Limitations](#limitations) sections. ```bash curl "https://{shortCode}.api.commercecloud.salesforce.com/cdn/zones/v1/organizations/f_ecom_bcxj_prd/zones/{zoneId}/logpush/jobs" \ --request POST \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data-raw '{ "name": "ExampleLogPushJob", "destinationPath": "datadog://?header_DD-API-KEY=&ddsource=cloudflare&service=&host=&ddtags=", "logType": "http_requests", "logFields": [ "CacheCacheStatus", "CacheResponseBytes", "ClientRequestPath", "ClientRequestBytes", "ClientRequestHost", "ClientRequestUserAgent", "EdgeResponseStatus", "EdgeResponseBytes", "EdgeStartTimestamp", "EdgeTimeToFirstByteMs" ] }' ``` Example API call response: 201 status code ```json {"data": {"jobId": 213543,"name": "ExampleLogPushJob","logType": "http_requests","logFields": ["CacheCacheStatus","CacheResponseBytes","ClientRequestPath","ClientRequestBytes","ClientRequestHost", "ClientRequestUserAgent","EdgeResponseStatus","EdgeResponseBytes","EdgeStartTimestamp","EdgeTimeToFirstByteMs"],"destinationPath":"datadog://?header_DD-API-KEY=&ddsource=cloudflare&service=&host=&ddtags=","enabled": false,"createdOn":"2023-04-18T17:18:43Z"}} ``` ## Create Splunk Logpush Job ### Prerequisites Configure a Splunk destination with these values: - : The Splunk raw HTTP Event Collector URL with the port. For example: `splunk.cf-analytics.com:8088/services/collector/raw`. - Cloudflare expects the Splunk endpoint to be `/services/collector/raw` while configuring and setting up the Logpush job. - : The Splunk source type, for example: `cloudflare:json`. - : The Splunk authorization token that is URL-encoded, for example: `Splunk%20e6d94e8c-5792-4ad1-be3c-29bcaee0197d`. - Make sure that you have enabled HEC in Splunk. For details, see [Splunk Analytics Integrations](https://developers.cloudflare.com/analytics/analytics-integrations/splunk/). - API requests fail with a 504 error if you add an incorrect URL. Typically, the Splunk Cloud endpoint URL includes text like `http-inputs-` before the hostname. - : A unique channel ID. This is a random GUID that you can generate by using: - An online tool like the [GUID generator ↗](https://www.guidgenerator.com/). - The command line, for example: `python \-c 'import uuid; print(uuid.uuid4())'`. - : A boolean value. Cloudflare recommends setting this value to `false`, because setting this value to `true` is equivalent to using the `-k` option with curl as shown in Splunk examples and is **not** recommended unless HEC uses a self-signed certificate. Example destination configuration for Splunk: ```json "splunk://?channel=&insecure-skip-verify=&sourcetype=&header_Authorization=" ``` Cloudflare makes a test call to push test data to the endpoint specified. If successful, the logpush job is created. If not, the logpush job creation fails. ### Create Logpush Job API call for Splunk This example creates a logpush job with a Splunk destination path. For details, see the [Parameters](#parameters), [Optional Parameters](#optional-parameters) and [Limitations](#limitations) sections. ```bash curl "https://{shortCode}.api.commercecloud.salesforce.com/cdn/zones/v1/organizations/f_ecom_bcxj_prd/zones/{zoneId}/logpush/jobs" \ --request POST \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data-raw '{ "name": "ExampleLogPushJob", "destinationPath": "splunk://?channel=&insecure-skip-verify=&sourcetype=&header_Authorization=", "logType": "http_requests", "logFields": [ "CacheCacheStatus", "CacheResponseBytes", "ClientRequestPath", "ClientRequestBytes", "ClientRequestHost", "ClientRequestUserAgent", "EdgeResponseStatus", "EdgeResponseBytes", "EdgeStartTimestamp", "EdgeTimeToFirstByteMs" ] }' ``` Example API call response: 201 status code ```json {"data": {"jobId": 213543,"name": "ExampleLogPushJob","logType": "http_requests","logFields": ["CacheCacheStatus","CacheResponseBytes","ClientRequestPath","ClientRequestBytes","ClientRequestHost", "ClientRequestUserAgent","EdgeResponseStatus","EdgeResponseBytes","EdgeStartTimestamp","EdgeTimeToFirstByteMs"],"destinationPath":"splunk://?channel=&insecure-skip-verify=&sourcetype=&header_Authorization=","enabled": false,"createdOn":"2023-04-18T17:18:43Z"}} ``` ## Create HTTPS Logpush Job ### Prerequisites Configure the HTTPS destination: - Make sure that the file upload to validate the destination accepts a gzipped `test.txt.gz` file with compressed content `{"content":"tests"}`. Otherwise, it returns an error, for example: `error validating destination: error writing object: error uploading`. - Specify "header\_\*" URL parameters for setting request headers. - The HTTPS endpoint cannot have custom URL parameters that conflict with any "header\_\*" URL parameters you have set. - These parameters must be properly URL-encoded, for example: use "%20" for a whitespace. Otherwise, some special characters can be decoded incorrectly. - For destination*conf , specify URL parameters in addition to special "header*\*" parameters. - Non URL-encoded special characters are encoded when uploaded. Example destination configuration for HTTPS endpoint: ```text https://logs.example.com?header_Authorization=Basic%20REDACTED&tags=host:salesforce.com,dataset:http_requests ``` Cloudflare makes a test call to push test data to the endpoint specified. If successful, the logpush job is created. If not, the logpush job creation fails. ### Create Logpush Job API call for HTTPS Endpoint This example creates a logpush job with an HTTPS destination endpoint. For details, see the [Parameters](#parameters), [Optional Parameters](#optional-parameters) and [Limitations](#limitations) sections. ```bash curl "https://{shortCode}.api.commercecloud.salesforce.com/cdn/zones/v1/organizations/f_ecom_bcxj_prd/zones/{zoneId}/logpush/jobs" \ --request POST \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data-raw '{ "name": "ExampleLogPushJob", "destinationPath": "https://logs.example.com?header_Authorization=Basic%20REDACTED&tags=host:salesforce.com,dataset:http_requests", "logType": "http_requests", "logFields": [ "CacheCacheStatus", "CacheResponseBytes", "ClientRequestPath", "ClientRequestBytes", "ClientRequestHost", "ClientRequestUserAgent", "EdgeResponseStatus", "EdgeResponseBytes", "EdgeStartTimestamp", "EdgeTimeToFirstByteMs" ] }' ``` Example API call response: 201 status code ```json {"data": {"jobId": 213543,"name": "ExampleLogPushJob","logType": "http_requests","logFields": ["CacheCacheStatus","CacheResponseBytes","ClientRequestPath","ClientRequestBytes","ClientRequestHost", "ClientRequestUserAgent","EdgeResponseStatus","EdgeResponseBytes","EdgeStartTimestamp","EdgeTimeToFirstByteMs"],"destinationPath":"https://logs.example.com?header_Authorization=Basic%20REDACTED&tags=host:salesforce.com,dataset:http_requests","enabled": false,"createdOn":"2023-04-18T17:18:43Z"}} ``` ## Create Kinesis Logpush Job ### Prerequisites Configure the Kinesis destination: - Create an IAM Role for Cloudflare Logpush to Assume with this trust relationship: ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": [ "arn:aws:iam::391854517948:user/cloudflare-logpush" ] }, "Action": "sts:AssumeRole" } ] } ``` - Make sure that the IAM role has permissions to perform the `PutRecord` action on your Kinesis stream. - Replace , and with your values: ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "kinesis:PutRecord", "Resource": "arn:aws:kinesis:::stream/ } ] } ``` - (Optional) When using the STS Assume Role, include `sts-external-id` as a `destination_conf` parameter in your Logpush job's requests. For details, see [Securely Using External ID for Accessing AWS Accounts Owned by Others ↗](https://aws.amazon.com/blogs/apn/securely-using-external-id-for-accessing-aws-accounts-owned-by-others/) for more information. Example destination configuration for setting up logpush to AWS Kinesis: `kinesis://?region=&sts-assume-role-arn=arn:aws:iam:::role/` ### Create Logpush Job API call for Kinesis This example creates a logpush job with Kinesis. For details, see the [Parameters](#parameters), [Optional Parameters](#optional-parameters) and [Limitations](#limitations) sections. ```bash curl "https://{shortCode}.api.commercecloud.salesforce.com/cdn/zones/v1/organizations/f_ecom_bcxj_prd/zones/{zoneId}/logpush/jobs" \ --request POST \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data-raw '{ "name": "ExampleLogPushJob", "destinationPath": "kinesis://?region=&sts-assume-role-arn=arn:aws:iam:::role/", "logType": "http_requests", "logFields": [ "CacheCacheStatus", "CacheResponseBytes", "ClientRequestPath", "ClientRequestBytes", "ClientRequestHost", "ClientRequestUserAgent", "EdgeResponseStatus", "EdgeResponseBytes", "EdgeStartTimestamp", "EdgeTimeToFirstByteMs" ] }' ``` Example API call response: 201 status code ```json {"data": {"jobId": 213543,"name": "ExampleLogPushJob","logType": "http_requests","logFields": ["CacheCacheStatus","CacheResponseBytes","ClientRequestPath","ClientRequestBytes","ClientRequestHost", "ClientRequestUserAgent","EdgeResponseStatus","EdgeResponseBytes","EdgeStartTimestamp","EdgeTimeToFirstByteMs"],"destinationPath":"kinesis://?region=&sts-assume-role-arn=arn:aws:iam:::role/","enabled": false,"createdOn":"2023-04-18T17:18:43Z"}} ``` ### Parameters - Name: Your site name, which can't be changed after the job is created. - Destination Path: The destination path for receiving logs. The prerequisites information for each destination type describes how to get the `destinationPath` attribute. - Ownership Challenge Token: This attribute is required for AWS S3 and Google Cloud Storage destinations. It isn't required for other destinations such as HTTPS, Datadog, Azure, Splunk, or Kinesis. - Log Type: The type of logs you want to receive in your S3 bucket. Currently, the available types are `http_requests`, `firewall_events`, and `page_shield_events`. - Log Fields: The available log fields, which vary depending on the type of logs. For details, see [eCDN Logpush Log Fields](https://developer.salesforce.com/docs/commerce/commerce-api/guide/cdn-zones-logpush-log-field.html). ### Optional Parameters - Filter: Use filters to select specific types of events to include in your logs or remove events irrelevant to your analysis. By applying filters to your logs, focus on the most important data and avoid unnecessary noise. For details, see [eCDN Logpush Filter](https://developer.salesforce.com/docs/commerce/commerce-api/guide/cdn-zones-logpush-filter.html). ### Limitations You can create a maximum of _two_ Logpush jobs per zone. ## Enable Logpush Job An eCDN Logpush Job isn't enabled upon creation. You must enable the Logpush Job to start receiving logs. For additional details, see [CDN Zones API Overview](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=Summary). Use the [B2C CLI](https://developer.salesforce.com/docs/commerce/b2c-commerce/guides/b2c-developer-tooling.md): ```bash npx @salesforce/b2c-cli ecdn logpush jobs update \ --tenant-id abcd_stg --zone stg-abcd-example-com.cc-ecdn.net \ --job-id 213543 --enabled ``` Alternatively, use the API: ```bash curl "https://{shortCode}.api.commercecloud.salesforce.com/cdn/zones/v1/organizations/f_ecom_bcxj_prd/zones/{zoneId}/logpush/jobs/{jobId}" \ --request PUT \ --header 'Authorization: Bearer {access_token}' \ --header 'Content-Type: application/json' \ --data-raw '{ "enabled": true }' ``` ### Example Request ```json { "enabled": true } ``` ### Successful Response A successful response returns 200. ```json { "data": { "jobId": 213543, "name": "ExampleLogPushJob", "logType": "http_requests", "logFields": [ "CacheCacheStatus", "CacheResponseBytes", "ClientRequestPath", "ClientRequestBytes", "ClientRequestHost", "ClientRequestUserAgent", "EdgeResponseStatus", "EdgeResponseBytes", "EdgeStartTimestamp", "EdgeTimeToFirstByteMs" ], "destinationPath": "s3://example-bucket/log?region=us-east-1", "enabled": true, "createdOn": "2023-04-18T17:18:43Z" } } ``` ## eCDN Logpush Logs JSON Output Data This example shows JSON log output from an eCDN Logpush job. ```json { "CacheCacheStatus": "dynamic", "CacheResponseBytes": 12191, "ClientRequestPath": "/404", "ClientRequestBytes": 2161, "ClientRequestHost": "edge01.sfcc-ecdn-test5.net", "ClientRequestUserAgent": "Fuzz Faster U Fool v1.5.0-dev", "EdgeResponseStatus": 410, "EdgeResponseBytes": 39065, "EdgeStartTimestamp": "2023-04-18T17:29:16Z", "EdgeTimeToFirstByteMs": 504, "ClientRequestSource":"eyeball" } ``` ## List Logpush Jobs For details, see [CDN Zones API Overview](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=Summary). Use the [B2C CLI](https://developer.salesforce.com/docs/commerce/b2c-commerce/guides/b2c-developer-tooling.md): ```bash npx @salesforce/b2c-cli ecdn logpush jobs list \ --tenant-id abcd_stg --zone stg-abcd-example-com.cc-ecdn.net ``` Alternatively, use the API: ```bash curl "https://{shortCode}.api.commercecloud.salesforce.com/cdn/zones/v1/organizations/f_ecom_bcxj_prd/zones/{zoneId}/logpush/jobs" \ --request GET \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' ``` ### **Successful Response** A successful response returns 200. ```json { "data": [ { "jobId": 213543, "name": "ExampleLogPushJob", "logType": "http_requests", "logFields": [ "CacheCacheStatus", "CacheResponseBytes", "ClientRequestPath", "ClientRequestBytes", "ClientRequestHost", "ClientRequestUserAgent", "EdgeResponseStatus", "EdgeResponseBytes", "EdgeStartTimestamp", "EdgeTimeToFirstByteMs" ], "destinationPath": "s3://example-bucket/log?region=us-east-1", "enabled": true, "createdOn": "2023-04-18T17:18:43Z" } ] } ``` ## Delete Logpush Job For details, see [CDN Zones API Overview](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=Summary). ```bash curl "https://{shortCode}.api.commercecloud.salesforce.com/cdn/zones/v1/organizations/f_ecom_bcxj_prd/zones/{zoneId}/logpush/jobs/{jobId}" \ --request DELETE \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' ``` ### **Successful Response** A successful response returns 204. ## eCDN Logpush FAQ - The Logpush job was accidentally turned off, and we missed some logs for a certain time period. Is there a way to retrieve those missed logs? - No, eCDN Logpush pushes the logs into the S3 bucket as soon as they become available and isn't able to backfill the missing logs. - Can I adjust how often logs are pushed? - No, eCDN Logpush pushes the logs in batches to the destination specified at the earliest possible time. - I created an ownership token, but I don’t see the file in my S3 bucket. - Check your S3 bucket policy for allowing eCDN Logpush to write a file to your bucket. Edit and paste the policy into **S3 \> Bucket \> Permissions \> Bucket Policy**, replacing the **Resource** value as shown in the [Enable eCDN Logpush to Amazon S3](https://developer.salesforce.com/docs/commerce/commerce-api/guide/cdn-zones-logpush.html#enable-ecdn-logpush-to-amazon-s3) section.