网络防火墙日志过滤器

您可以将日志过滤器应用于 Logpush 任务，以仅导出特定的 Cloudflare 网络防火墙事件。以下示例展示了使用 Logpush API 的常见过滤器配置。每个过滤器使用 JSON 结构，其中 where 子句包含 key（要过滤的日志字段）、operator（比较运算符，例如 eq 表示等于，!eq 表示不等于）和 value（要匹配的值）。

本指南中的过滤器使用以下日志字段：

MitigationSystem — 标识对数据包进行采样的 Cloudflare 系统。对于网络防火墙事件，此值为 magic-firewall。
RulesetID — 包含匹配数据包的规则的受管理规则集的唯一标识符（如有）。空字符串表示没有受管理规则集匹配。
Outcome — Cloudflare 系统对数据包采取的操作（pass 或 drop）。
Verdict — Cloudflare 系统确定应对数据包采取的操作（pass 或 drop）。对于已禁用的规则，Verdict 可能与 Outcome 不同，因为规则评估了数据包但未强制执行其操作。

按已启用或已禁用规则过滤

使用以下过滤器示例过滤您的 Cloudflare 网络防火墙流量，以显示已启用或已禁用规则的事件。

以下示例创建一个 Logpush 任务，该任务仅显示与 Cloudflare 网络防火墙相关的字段，且过滤器仅显示已禁用规则的事件。

Required API token permissions

At least one of the following token permissions is required:

Logs Write

Create Logpush jobbash

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/logpush/jobs" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"destination_conf": "<DESTINATION_CONF>",
		"output_options": {
				"field_names": [
						"ColoName",
						"Datetime",
						"Direction",
						"IPDestinationAddress",
						"IPDestinationSubnet",
						"IPProtocol",
						"IPSourceAddress",
						"IPSourceSubnet",
						"Outcome",
						"RuleID",
						"RulesetID",
						"SampleInterval",
						"Verdict"
				]
		},
		"filter": "{\"where\":{\"or\":[{\"and\":[{\"key\":\"MitigationSystem\",\"operator\":\"eq\",\"value\":\"magic-firewall\"},{\"key\":\"RulesetID\",\"operator\":\"!eq\",\"value\":\"\"},{\"key\":\"Outcome\",\"operator\":\"eq\",\"value\":\"pass\"},{\"key\":\"Verdict\",\"operator\":\"eq\",\"value\":\"drop\"}]}]}}"
	}'

以下示例创建一个 Logpush 任务，该任务仅显示与 Cloudflare 网络防火墙相关的字段，且过滤器仅显示已启用规则的事件。

Required API token permissions

At least one of the following token permissions is required:

Logs Write

Create Logpush jobbash

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/logpush/jobs" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"destination_conf": "<DESTINATION_CONF>",
		"output_options": {
				"field_names": [
						"ColoName",
						"Datetime",
						"Direction",
						"IPDestinationAddress",
						"IPDestinationSubnet",
						"IPProtocol",
						"IPSourceAddress",
						"IPSourceSubnet",
						"Outcome",
						"RuleID",
						"RulesetID",
						"SampleInterval",
						"Verdict"
				]
		},
		"filter": "{\"where\":{\"or\":[{\"and\":[{\"key\":\"MitigationSystem\",\"operator\":\"eq\",\"value\":\"magic-firewall\"},{\"key\":\"RulesetID\",\"operator\":\"!eq\",\"value\":\"\"},{\"or\":[{\"key\":\"Outcome\",\"operator\":\"eq\",\"value\":\"drop\"},{\"key\":\"Verdict\",\"operator\":\"eq\",\"value\":\"pass\"}]}]}]}}"
	}'

按允许或阻止的流量过滤

使用以下过滤器示例过滤您的 Cloudflare 网络防火墙流量，以显示允许或阻止流量的事件。

以下示例创建一个 Logpush 任务，该任务仅显示与 Cloudflare 网络防火墙相关的字段，且过滤器仅显示未采取明确操作的事件——即数据包通过防火墙时未匹配任何规则。默认情况下，Cloudflare 网络防火墙允许未匹配的流量通过。这通过空的 RulesetID 来标识。

Required API token permissions

At least one of the following token permissions is required:

Logs Write

Create Logpush jobbash

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/logpush/jobs" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"destination_conf": "<DESTINATION_CONF>",
		"output_options": {
				"field_names": [
						"ColoName",
						"Datetime",
						"Direction",
						"IPDestinationAddress",
						"IPDestinationSubnet",
						"IPProtocol",
						"IPSourceAddress",
						"IPSourceSubnet",
						"Outcome",
						"RuleID",
						"RulesetID",
						"SampleInterval",
						"Verdict"
				]
		},
		"filter": "{\"where\":{\"and\":[{\"key\":\"MitigationSystem\",\"operator\":\"eq\",\"value\":\"magic-firewall\"},{\"key\":\"RulesetID\",\"operator\":\"eq\",\"value\":\"\"}]}}"
	}'

以下示例创建一个 Logpush 任务，该任务仅显示与 Cloudflare 网络防火墙相关的字段，且过滤器仅显示采取了明确操作的事件。该示例同时包含已启用和已禁用的 Cloudflare 网络防火墙规则。

Required API token permissions

At least one of the following token permissions is required:

Logs Write

Create Logpush jobbash

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/logpush/jobs" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"destination_conf": "<DESTINATION_CONF>",
		"output_options": {
				"field_names": [
						"ColoName",
						"Datetime",
						"Direction",
						"IPDestinationAddress",
						"IPDestinationSubnet",
						"IPProtocol",
						"IPSourceAddress",
						"IPSourceSubnet",
						"Outcome",
						"RuleID",
						"RulesetID",
						"SampleInterval",
						"Verdict"
				]
		},
		"filter": "{\"where\":{\"and\":[{\"key\":\"MitigationSystem\",\"operator\":\"eq\",\"value\":\"magic-firewall\"},{\"key\":\"RulesetID\",\"operator\":\"!eq\",\"value\":\"\"}]}}"
	}'

仅过滤网络防火墙事件

如果您的 Logpush 任务包含来自多个 Cloudflare 缓解系统的事件，请使用以下过滤器仅包含 Cloudflare 网络防火墙事件。以下示例创建一个 Logpush 任务，该任务按 MitigationSystem 进行过滤，仅包含网络防火墙流量。

Required API token permissions

At least one of the following token permissions is required:

Logs Write

Create Logpush jobbash

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/logpush/jobs" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"destination_conf": "<DESTINATION_CONF>",
		"output_options": {
				"field_names": [
						"ColoName",
						"Datetime",
						"Direction",
						"IPDestinationAddress",
						"IPDestinationSubnet",
						"IPProtocol",
						"IPSourceAddress",
						"IPSourceSubnet",
						"Outcome",
						"RuleID",
						"RulesetID",
						"SampleInterval",
						"Verdict"
				]
		},
		"filter": "{\"where\":{\"key\":\"MitigationSystem\",\"operator\":\"eq\",\"value\":\"magic-firewall\"}}"
	}'