Cloudflare
Traffic, errors, latency and everything else the edge knows — with the retention caveats stated plainly.
Cloudflare sees every request before your origin does, which makes it the best available answer to "what are users actually experiencing" — including the requests that never reached you.
Setup
Settings → Datasources → Cloudflare. You need:
| API token | With read access to Analytics, Load Balancing and DNS as needed |
| Account tag | Required for account-scoped features such as load balancers |
| Zones | Which zones to pull |
The account tag is easy to miss and its absence is not obvious: zone-level pages work and account-level ones are simply empty.
Pages
The overview
Requests, bandwidth, cached share, status mix, threats, top paths, top countries — per zone or rolled up across zones.
Two things about the numbers:
cf_metrics is the timeline; the warehouse is the analytics. They are
different datasets with different granularity and different retention. A number
on a chart and the same number in a breakdown can differ legitimately — the page
says which source it used.
Top 404 paths comes from a 404-only dataset, not from filtering the general path list. Filtering "all statuses" for 404s gives you the paths that are busy, not the paths that are broken.
Retention differs by dataset
Cloudflare's datasets are not all kept for the same time. The HTTP dataset is retained far longer than the load-balancing one, which on this plan is about three days.
Where a range reaches past what a dataset can serve, the page says so and says what it actually covered. It does not quietly show a subset — see Load balancing, where this caused a panel to silently degrade for weeks.
Alerting
| Rule kind | Where |
|---|---|
| Zone-wide error rate, traffic, threats | Cloudflare rules |
| Per-endpoint error rate with learned baselines | Endpoint guard |
| Origin/pool health | Load balancing |
Rules are dimension-aware: a rule can be scoped to a host, a path, a country or a status class rather than the whole zone.
Multi-zone
Several zones roll up into one view. The rollup honours host and path dimensions; anything it could not apply is reported as unapplied rather than being silently ignored — an unapplied filter that looks applied is a number nobody can trust.
Exports and digests
CSV export from any view, and a daily Slack digest of the zone's traffic and error picture.
Where this behaviour lives: backend/internal/integration/cloudflare.go, frontend/src/app/cloudflare/. If the code and this page disagree, the code is right — please fix the page.
Part of Monitor — Everything that watches something and reports what it saw.