Pricing and managing usage

Last updated Oct 15, 2026 Log Explorer (Legacy) is billed on the volume of logs ingested and stored, measured in gigabytes (GB). Your charges scale with the amount of log data you choose to retain.

Unlike query-based billing models, charges are not based on how often you search or scan your data. Once logs are ingested and stored, you can query them without additional cost.

Availability

Log Explorer is available as a paid add-on for any Application Services or Zero Trust purchase. There is no free version or trial available at this time.

Billable usage

Billing is strictly consumption-based, calculated by the GBs ingested and stored.

Attack traffic

Because these datasets are used for forensics, attack traffic is considered valuable data for analysis and is included in your billable usage.

Note

Logs generated from Layer 7 (L7) DDoS attack traffic are not ingested by default and do not count toward your usage.

Estimate usage

To estimate your usage, review your request volumes in Analytics for specific Cloudflare log datasets.

Record size by dataset

The following table provides average and maximum record sizes for each dataset to help you estimate potential storage needs:

Dataset Average Record Size Maximum Record Size
audit_logs 2.69 kB 172 kB
email_security_alerts 6.74 kB 74.9 kB
firewall_events 1.36 kB 47.2 kB
audit_logs_v2 1.73 kB 28.5 kB
zaraz_events 7.30 kB 11.7 kB
http_requests 1.56 kB 9.76 kB
gateway_dns 1.44 kB 6.23 kB
dex_application_tests 3.29 kB 5.67 kB
casb_findings 2.67 kB 3.80 kB
gateway_http 1.47 kB 2.60 kB
dex_device_state_events 1.98 kB 2.57 kB
page_shield_events 443 B 2.02 kB
network_analytics_logs 1.31 kB 1.87 kB
zero_trust_network_sessions 1.21 kB 1.52 kB
gateway_network 877 B 1.17 kB
device_posture_results 730 B 944 B
spectrum_events 685 B 925 B
sinkhole_http_logs 705 B 705 B
access_requests 446 B 541 B
dns_firewall_logs 387 B 469 B
dns_logs 199 B 409 B
magic_ids_detections 334 B 349 B
warp_toggle_changes 327 B 335 B
ipsec_logs 207 B 260 B
nel_reports 204 B 224 B

Monitor usage

Cloudflare provides three primary ways to track your consumption and maintain financial oversight:

  • In-product quick indicator: View your current month's usage at the top of the Log Search and Manage Datasets sections.
  • Account-level billing: Access a detailed view of current and previous months' cumulative usage under Manage Account > Billing.
  • Usage alerts: Set up automated notifications to trigger when billable usage exceeds a defined threshold.

Configure a usage alert

  1. Log in to the Cloudflare dashboard ↗︎ and select Manage account.
  2. Go to Notifications > Add.
  3. Select Usage-based Billing.
  4. Define your threshold and the notification destination (email, PagerDuty, or webhooks).

Deactivate Log Explorer

To stop using Log Explorer and end associated charges, you must complete both of the following steps:

1. Stop log ingestion

Disabling datasets stops additional ingestion charges immediately.

  1. Go to the Manage datasets ↗︎ page at the account level.
  2. Use the toggle to turn off each dataset you no longer need.
  3. Select Stop ingesting logs to confirm.

2. Cancel the subscription

This prevents the subscription from renewing at the next billing cycle.

  1. Go to the Billing ↗︎ page.
  2. In the Subscriptions tab, find the Log Explorer subscription and select Cancel.

Was this helpful?

YesNo

On this page

Pricing and managing usage - 图1Docs

{"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/observability/logs/log-explorer/pricing/#page","headline":"Pricing and managing usage","description":"Understand Log Explorer billing and usage.","url":"https://developers.cloudflare.com/observability/logs/log-explorer/pricing/","inLanguage":"en","image":"https://developers.cloudflare.com/observability/logs/log-explorer/pricing/og.png?v=f9f78a676d93cc7a","dateModified":"2026-10-15","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}}

description: Review SQL syntax supported by Log Explorer. title: SQL queries supported image: https://developers.cloudflare.com/observability/logs/log-explorer/sql-queries/og.png?v=f0e05bb544df8935

Skip to content

Documentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/observability/llms.txt
Use this file to discover all available pages before exploring further.