Logs Uploader exports CDN request and cache logs to a configured destination in batches at regular intervals. When Origin Shielding is enabled and the policy includes those logs, the export also contains requests processed by mid-tier cache servers.
To export logs, create a policy that defines what to export, connect a target that receives the logs, then create a configuration that links them to CDN resources.
Accounts that already use the hourly Raw Logs export to Amazon Simple Storage Service (S3), File Transfer Protocol (FTP), or SSH File Transfer Protocol (SFTP) can keep that configuration. Use Logs Uploader for new setups. A new Amazon S3 destination uses the S3 Amazon target. To migrate an existing Raw Logs export, contact CDB Support.
📝
Logs Uploader must be enabled for the account before the configuration UI is available. Contact CDB Support or use Contact support on the Logs Uploader page in the CDB Technical Web Portal.
Create a policy
A policy selects the log fields, the file name format, and how often files rotate. The Time interval is 5–60 minutes and defaults to 5. If no requests arrive during an interval and Include empty logs is selected, Logs Uploader still sends an empty batch. For a file-based target, the resulting empty log file is about 20 bytes.
In the Customer Portal, open CDN → Logs → Logs Uploader, then Policies, and click Add policy.
1. Enter a name.
2. Leave Include empty logs cleared to skip empty intervals, or select it to confirm delivery when there is no traffic.
3. Select Include logs from origin shielding when Origin Shielding is enabled and those mid-tier requests should appear in the export.
4. Select the log fields. The field table lists each field and its meaning.
5. Set delimiter, separator, file name format, time interval, and file size limit. The file size limit applies before compression — a compressed file can be up to 99% smaller.
6. Click Add policy.
To change an existing policy, open it by name. The same settings apply; click Save changes when done.
Create a target
A target is the destination. Authentication complete means Logs Uploader can reach and authenticate to that destination — it does not mean a batch has arrived.
On the Targets tab, click Add target, enter a name, and configure one destination:
Optionally, specify an existing folder inside the bucket.
Generic S3-compatible object storage
Select HTTP or HTTPS and specify the Endpoint.
Enter the Access Key ID and Secret Access Key.
Enter the storage region and an existing bucket.
Optionally, specify an existing folder inside the bucket.
⚠️
FTP transmits credentials and log data without transport encryption. Use SFTP or HTTPS when logs contain IP addresses, cookies, or request URLs.
Enter the Hostname, Login, and Password.
Optionally, specify an existing destination directory.
Enter the Hostname and Login.
Authenticate with a Password, or with a Private Key and Passphrase.
Optionally, specify an existing destination folder.
⚠️
Plain HTTP transmits log data without transport encryption. Use HTTPS when logs contain IP addresses, cookies, or request URLs.
Select POST or PUT, then HTTP or HTTPS, and specify the Endpoint.
Add custom headers if the receiver requires them.
Turn on Authentication for token-based header auth, and Use compression to gzip the JSON body (up to 99% smaller).
Click Add target. A green Authentication complete status confirms the destination is reachable. Click the refresh icon next to the status to run the check again.
To change an existing target, open it by name. The same connection settings apply.
Create a configuration
A configuration links one policy and one target to CDN resources and starts delivery.
On the Configurations tab, click Add configuration.
1. Enter a name.
2. Cover All Resources (including resources created later) or select Specific Resource(s) from the list.
3. Select the policy and the target.
4. Leave Enable configuration on to start delivery, or turn it off to save the setup inactive.
5. Click Add configuration.
The Status column repeats the linked target's authentication state. To change an existing configuration, open it by name — the same resource, policy, and target settings apply.
Verify delivery
Generate traffic to a CDN resource covered by the configuration. After one full time interval, check the destination for a delivered batch and confirm the expected fields. For a file-based target, check for a new file. For HTTP(S), confirm the configured POST or PUT request. For SLS, check the configured logstore. Authentication complete is not proof that a batch arrived — see Troubleshooting if the destination stays empty.
Disable or delete a setup
Use ⋯ on a configuration to Disable delivery without deleting the setup, or Enable it again. The same switch is in the configuration form.
Delete the configuration first. A policy or target that is still linked to a configuration cannot be deleted. Then delete the unused target or policy from ⋯ on its row.
Export CDN resource logs by creating a policy, a target, and a configuration that links them. Logs Uploader must be enabled for the account — a disabled account returns HTTP 403. A CDN resource ID is visible in the Customer Portal under CDN → CDN Resources, or from the List CDN resources API call.
Create a policy (rotate_interval_minutes is 5–60), an HTTP target, and a configuration for one CDN resource. Other storage_type values include s3_gcore, s3_amazon, s3_oss, s3_other, ftp, sftp, and sls. An HTTP receiver must return 2xx, or Logs Uploader retries the batch. Target validation starts asynchronously — the first status is in_progress.
Generate traffic to the CDN resource, then wait one rotate_interval_minutes period and check the destination. A target status of in_progress means destination validation is still running. Authentication complete confirms that the destination is reachable and authentication succeeded, but it does not mean that a batch has arrived. Available policy field names come from GET /docs/cdn/logs_uploader/policies/fields.
List policies, targets, and configs
List each object type, or retrieve one configuration by ID.
from gcore import CDB
client = CDB()
for policy in client.cdn.logs_uploader.policies.list(limit=10):
print(policy.id, policy.name)
for target in client.cdn.logs_uploader.targets.list(limit=10):
print(target.id, target.name, target.storage_type)
for config in client.cdn.logs_uploader.configs.list(limit=10):
print(config.id, config.name, config.enabled)
config = client.cdn.logs_uploader.configs.get(434)
print(config.id, config.policy, config.target)
package main
import (
"context"
"fmt"
gcore "github.com/G-Core/gcore-go"
"github.com/G-Core/gcore-go/cdn"
)
func main() {
client := gcore.NewClient()
ctx := context.Background()
policies, err := client.CDN.LogsUploader.Policies.List(ctx, cdn.LogsUploaderPolicyListParams{})
if err != nil {
panic(err)
}
for _, policy := range policies.Results {
fmt.Println(policy.ID, policy.Name)
}
targets, err := client.CDN.LogsUploader.Targets.List(ctx, cdn.LogsUploaderTargetListParams{})
if err != nil {
panic(err)
}
for _, target := range targets.Results {
fmt.Println(target.ID, target.Name, target.StorageType)
}
configs, err := client.CDN.LogsUploader.Configs.List(ctx, cdn.LogsUploaderConfigListParams{})
if err != nil {
panic(err)
}
for _, config := range configs.Results {
fmt.Println(config.ID, config.Name, config.Enabled)
}
config, err := client.CDN.LogsUploader.Configs.Get(ctx, 434)
if err != nil {
panic(err)
}
fmt.Println(config.ID, config.Policy, config.Target)
}
curl -X GET "https://api.cdb-staging.cdn.orange.com/cdn/logs_uploader/policies?limit=10" \
-H "Authorization: APIKey $GCORE_API_KEY"
curl -X GET "https://api.cdb-staging.cdn.orange.com/cdn/logs_uploader/targets?limit=10" \
-H "Authorization: APIKey $GCORE_API_KEY"
curl -X GET "https://api.cdb-staging.cdn.orange.com/cdn/logs_uploader/configs?limit=10" \
-H "Authorization: APIKey $GCORE_API_KEY"
curl -X GET "https://api.cdb-staging.cdn.orange.com/cdn/logs_uploader/configs/434" \
-H "Authorization: APIKey $GCORE_API_KEY"
Delete the configuration first. A delete request against a policy or target that is still assigned returns HTTP 400. After the configuration is gone, delete the target and the policy. A successful delete returns HTTP 204.
from gcore import CDB
client = CDB()
client.cdn.logs_uploader.configs.delete(434)
client.cdn.logs_uploader.targets.delete(501)
client.cdn.logs_uploader.policies.delete(370)
A successful delete returns HTTP 204 with an empty body.
Export CDN request logs for one CDN resource with the Terraform provider. Apply creates a policy, an HTTP target, and a configuration that posts JSON batches to that target on the policy interval. Logs Uploader must already be enabled for the account, or apply returns HTTP 403.
Create the logs export
The policy selects the fields and the JSON format. The target posts each batch to an HTTP endpoint that returns a 2xx status, because any other status is retried. The configuration attaches both to the CDN resource already declared in the same file, so the export covers that resource.
Generate traffic to the CDN resource. After one rotate interval, the HTTP endpoint receives a POST whose body contains the selected fields. A reachable target confirms contact with the endpoint, so check the destination for the batch itself.
Stop delivery
Set enabled to false and run terraform apply to stop delivery while the policy and the target stay in place. Set enabled to true and run terraform apply to start delivery again.
Remove the three resource blocks and run terraform apply. Terraform deletes the Logs Uploader configuration first, then the policy and the target, and leaves the CDN resource in place.
The exported log schema includes standard CDN request fields, internal status codes, and a sample log line.
WAAP log fields
When a CDN resource has WAAP enabled, Logs Uploader appends WAAP security event fields to each request log line. CDN access data and the matching WAAP verdict share one entry — no separate file and no extra Logs Uploader setup. When a policy override suppresses a finding, the entry includes policy_override with the override ID, target type, and target references. The field is omitted when no override matched.
WAAP fields appear only when WAAP Status is Active on CDN → CDN resources. The toggle is in that resource's Security settings. After WAAP is enabled, the next exported batch includes the new fields at the end of the line, so positional parsers keep working. Parsers that reject unknown columns must accept the WAAP fields first. The v field in HTTP(S) payloads increments when the schema changes.
📝
DDoS protection logs are not exported through Logs Uploader. Only per-request WAAP security events are included. DDoS attack analytics remain available through the WAAP API and dashboard.
Troubleshooting
Authentication complete confirms that Logs Uploader can reach the destination. It does not mean a batch has arrived.
Batches are delivered at the end of the policy Time interval (minimum 5 minutes). Wait at least one full interval after generating CDN traffic.
If the covered resources receive no requests during an interval and Include empty logs is off, no batch is delivered. Turn the option on in the policy to confirm delivery without traffic. For a file-based target, an empty log file is about 20 bytes.
For S3, FTP, SFTP, and SLS, the bucket, directory, or logstore must already exist — Logs Uploader does not create missing paths. The credentials must allow writes: s3:PutObject (and often s3:GetBucketLocation) on S3, write access to the FTP/SFTP directory, or Write on an SLS logstore.
An HTTP(S) receiver must return 2xx before the request times out. Any other status is a delivery failure and is retried. If compression is on, the receiver must accept Content-Encoding: gzip.
A configuration limited to Specific Resources only exports those resources. All Resources includes resources created later.
Delivery error details are not shown in the portal. Contact CDB Support for delivery logs for a target or time range.