Skip to content

[cloudflare_logpush] update ECS to 9.3.0 and add new fields across multiple data streams#18685

Merged
brijesh-elastic merged 6 commits into
elastic:cloudflare_logpush-enhancementfrom
brijesh-elastic:cloudflare_logpush-1.45.0-preview01
May 8, 2026
Merged

[cloudflare_logpush] update ECS to 9.3.0 and add new fields across multiple data streams#18685
brijesh-elastic merged 6 commits into
elastic:cloudflare_logpush-enhancementfrom
brijesh-elastic:cloudflare_logpush-1.45.0-preview01

Conversation

@brijesh-elastic
Copy link
Copy Markdown
Contributor

Proposed commit message

cloudflare_logpush: update ECS to 9.3.0 and add new fields across multiple data streams

Enhancements:
- Bump ECS version to `git@v9.3.0` and `format_version` to `3.3.2`.
- Replace deprecated `agent.yml` with `beats.yml` and use `external: ecs` in `base-fields.yml` across
  all 21 data streams.
- Add new fields with corresponding ingest pipeline processors:
  - `device_posture` (RegistrationID)
  - `firewall_event` (FraudUserID)
  - `gateway_dns` (12 fields including InternalDNS*, QueryApplication*, RequestContext*)
  - `gateway_http` (AppControlInfo, ApplicationStatuses, RedirectTargetURI, RegistrationID)
  - `gateway_network` (RegistrationID)
  - `http_request` (11 fields including Fraud*, WebAssets*, WorkerScriptName)
  - `network_analytics` (DNSQueryName, DNSQueryType, PFPCustomTag)
  - `network_session` (InitialOriginIP, RegistrationID, ResolvedFQDN, SNI)
  - `workers_trace` (CPUTimeMs, WallTimeMs)

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

  • Clone integrations repo.
  • Install elastic package locally.
  • Start elastic stack using elastic-package.
  • Move to integrations/packages/cloudflare_logpush directory.
  • Run the following command to run tests.

elastic-package test -v

@brijesh-elastic brijesh-elastic self-assigned this Apr 29, 2026
@brijesh-elastic brijesh-elastic added the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label Apr 29, 2026
@brijesh-elastic brijesh-elastic requested a review from a team as a code owner April 29, 2026 03:29
@brijesh-elastic brijesh-elastic added enhancement New feature or request Integration:cloudflare_logpush Cloudflare Logpush Category: Integration quality Category: Quality used for SI planning Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] labels Apr 29, 2026
@infra-vault-gh-plugin-prod
Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 29, 2026

Vale Linting Results

Summary: 100 warnings, 8 suggestions found

⚠️ Warnings (100)
File Line Rule Message
packages/cloudflare_logpush/docs/README.md 108 Elastic.DontUse Don't use 'please'.
packages/cloudflare_logpush/docs/README.md 112 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 119 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.
packages/cloudflare_logpush/docs/README.md 131 Elastic.DontUse Don't use 'just'.
packages/cloudflare_logpush/docs/README.md 139 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.
packages/cloudflare_logpush/docs/README.md 150 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.
packages/cloudflare_logpush/docs/README.md 151 Elastic.DontUse Don't use 'Please'.
packages/cloudflare_logpush/docs/README.md 152 Elastic.DontUse Don't use 'please'.
packages/cloudflare_logpush/docs/README.md 192 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.
packages/cloudflare_logpush/docs/README.md 348 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/cloudflare_logpush/docs/README.md 350 Elastic.QuotesPunctuation Place punctuation inside closing quotation marks.
packages/cloudflare_logpush/docs/README.md 351 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 352 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 500 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/cloudflare_logpush/docs/README.md 502 Elastic.QuotesPunctuation Place punctuation inside closing quotation marks.
packages/cloudflare_logpush/docs/README.md 503 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 504 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 673 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/cloudflare_logpush/docs/README.md 675 Elastic.QuotesPunctuation Place punctuation inside closing quotation marks.
packages/cloudflare_logpush/docs/README.md 676 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 677 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 844 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/cloudflare_logpush/docs/README.md 846 Elastic.QuotesPunctuation Place punctuation inside closing quotation marks.
packages/cloudflare_logpush/docs/README.md 847 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 848 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 949 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'that is' instead of 'i.e'.
packages/cloudflare_logpush/docs/README.md 951 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/cloudflare_logpush/docs/README.md 953 Elastic.QuotesPunctuation Place punctuation inside closing quotation marks.
packages/cloudflare_logpush/docs/README.md 954 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 955 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 1078 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/cloudflare_logpush/docs/README.md 1080 Elastic.QuotesPunctuation Place punctuation inside closing quotation marks.
packages/cloudflare_logpush/docs/README.md 1081 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 1082 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 1232 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.
packages/cloudflare_logpush/docs/README.md 1243 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/cloudflare_logpush/docs/README.md 1245 Elastic.QuotesPunctuation Place punctuation inside closing quotation marks.
packages/cloudflare_logpush/docs/README.md 1246 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 1247 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 1464 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/cloudflare_logpush/docs/README.md 1466 Elastic.QuotesPunctuation Place punctuation inside closing quotation marks.
packages/cloudflare_logpush/docs/README.md 1467 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 1468 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 1696 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/cloudflare_logpush/docs/README.md 1698 Elastic.QuotesPunctuation Place punctuation inside closing quotation marks.
packages/cloudflare_logpush/docs/README.md 1699 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 1700 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 2033 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/cloudflare_logpush/docs/README.md 2035 Elastic.QuotesPunctuation Place punctuation inside closing quotation marks.
packages/cloudflare_logpush/docs/README.md 2036 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 2037 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 2274 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'eg'.
packages/cloudflare_logpush/docs/README.md 2303 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.
packages/cloudflare_logpush/docs/README.md 2319 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/cloudflare_logpush/docs/README.md 2321 Elastic.QuotesPunctuation Place punctuation inside closing quotation marks.
packages/cloudflare_logpush/docs/README.md 2322 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 2323 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 2530 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.
packages/cloudflare_logpush/docs/README.md 2541 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/cloudflare_logpush/docs/README.md 2543 Elastic.QuotesPunctuation Place punctuation inside closing quotation marks.
packages/cloudflare_logpush/docs/README.md 2544 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 2545 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 2974 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/cloudflare_logpush/docs/README.md 2976 Elastic.QuotesPunctuation Place punctuation inside closing quotation marks.
packages/cloudflare_logpush/docs/README.md 2977 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 2978 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 3141 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/cloudflare_logpush/docs/README.md 3143 Elastic.QuotesPunctuation Place punctuation inside closing quotation marks.
packages/cloudflare_logpush/docs/README.md 3144 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 3145 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 3255 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/cloudflare_logpush/docs/README.md 3257 Elastic.QuotesPunctuation Place punctuation inside closing quotation marks.
packages/cloudflare_logpush/docs/README.md 3258 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 3259 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 3597 Elastic.BritishSpellings Use American English spelling 'acknowledgment' instead of British English 'Acknowledgement'.
packages/cloudflare_logpush/docs/README.md 3616 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/cloudflare_logpush/docs/README.md 3618 Elastic.QuotesPunctuation Place punctuation inside closing quotation marks.
packages/cloudflare_logpush/docs/README.md 3619 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 3620 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 3875 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.
packages/cloudflare_logpush/docs/README.md 3894 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/cloudflare_logpush/docs/README.md 3896 Elastic.QuotesPunctuation Place punctuation inside closing quotation marks.
packages/cloudflare_logpush/docs/README.md 3897 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 3898 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 4016 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/cloudflare_logpush/docs/README.md 4018 Elastic.QuotesPunctuation Place punctuation inside closing quotation marks.
packages/cloudflare_logpush/docs/README.md 4019 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 4020 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 4228 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/cloudflare_logpush/docs/README.md 4230 Elastic.QuotesPunctuation Place punctuation inside closing quotation marks.
packages/cloudflare_logpush/docs/README.md 4231 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 4232 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 4426 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/cloudflare_logpush/docs/README.md 4428 Elastic.QuotesPunctuation Place punctuation inside closing quotation marks.
packages/cloudflare_logpush/docs/README.md 4429 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 4430 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 4579 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/cloudflare_logpush/docs/README.md 4581 Elastic.QuotesPunctuation Place punctuation inside closing quotation marks.
packages/cloudflare_logpush/docs/README.md 4582 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/cloudflare_logpush/docs/README.md 4583 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
💡 Suggestions (8)
File Line Rule Message
packages/cloudflare_logpush/docs/README.md 5 Elastic.Semicolons Use semicolons judiciously.
packages/cloudflare_logpush/docs/README.md 5 Elastic.Semicolons Use semicolons judiciously.
packages/cloudflare_logpush/docs/README.md 5 Elastic.Semicolons Use semicolons judiciously.
packages/cloudflare_logpush/docs/README.md 182 Elastic.WordChoice Consider using 'refer to if it's a document, view if it's a UI element' instead of 'See', unless the term is in the UI.
packages/cloudflare_logpush/docs/README.md 664 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/cloudflare_logpush/docs/README.md 1660 Elastic.WordChoice Consider using 'top-level' instead of 'first-class', unless the term is in the UI.
packages/cloudflare_logpush/docs/README.md 2285 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/cloudflare_logpush/docs/README.md 2970 Elastic.Wordiness Consider using 'whether' instead of 'Whether or not'.

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

Comment thread packages/cloudflare_logpush/data_stream/gateway_dns/fields/fields.yml Outdated
@brijesh-elastic brijesh-elastic changed the base branch from main to cloudflare_logpush-enhancement May 7, 2026 12:49
@elastic-vault-github-plugin-prod
Copy link
Copy Markdown

elastic-vault-github-plugin-prod Bot commented May 7, 2026

🚀 Benchmarks report

Package cloudflare_logpush 👍(24) 💚(13) 💔(5)

Expand to view
Data stream Previous EPS New EPS Diff (%) Result
access_request 5524.86 3300.33 -2224.53 (-40.26%) 💔
workers_trace 14705.88 9900.99 -4804.89 (-32.67%) 💔
audit 6172.84 5128.21 -1044.63 (-16.92%) 💔
device_posture 5649.72 4329 -1320.72 (-23.38%) 💔
dns_firewall 6622.52 4464.29 -2158.23 (-32.59%) 💔

To see the full report comment with /test benchmark fullreport

@brijesh-elastic
Copy link
Copy Markdown
Contributor Author

/test benchmark fullreport

@brijesh-elastic brijesh-elastic requested review from efd6 and kcreddy May 7, 2026 18:06
Copy link
Copy Markdown
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, but please wait for @kcreddy

Copy link
Copy Markdown
Contributor

@kcreddy kcreddy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thanks!

name: cloudflare_logpush
title: Cloudflare Logpush
version: "1.44.1"
version: "1.45.0-preview01"
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not blocker - to be updated to 1.45.0 before merging into main.

@elasticmachine
Copy link
Copy Markdown

💚 Build Succeeded

History

cc @brijesh-elastic

@brijesh-elastic brijesh-elastic merged commit 94b22b3 into elastic:cloudflare_logpush-enhancement May 8, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Category: Integration quality Category: Quality used for SI planning documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Integration:cloudflare_logpush Cloudflare Logpush Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants