Run a log query

client.logs.logExplorer.query.sql(, ?): SinglePage<QuerySqlResponse>

POST/{accounts_or_zones}/{account_or_zone_id}/logs/explorer/query/sql

Run a SQL query against account or zone-level datasets.

Timestamp fields are RFC3339 strings. Filter with: WHERE {timestamp_field} >= now() - INTERVAL ‘30’ DAY WHERE {timestamp_field} >= ‘2026-04-01T00:00:00Z’ WHERE {timestamp_field} BETWEEN ‘2026-04-01T00:00:00Z’ AND ‘2026-04-30T23:59:59Z’

List configured account or zone datasets to see enabled account or zone-level datasets. Zone-level datasets will not appear here. List available account or zone datasets to inspect their schemas and timestamp fields.

For more information about the datasets, and the meaning of each field, check out https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

Accepted Permissions (at least one required)

Logs WriteLogs Read

ParametersExpand Collapse

params: QuerySqlParams { body, account_id, zone_id }

body: Uploadable

Body param: SQL query to execute.

account_id?: string

Path param: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

zone_id?: string

Path param: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

ReturnsExpand Collapse

QuerySqlResponse = Record<string, unknown>

Run a log query

import fs from 'fs';
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

// Automatically fetches more pages as needed.
for await (const querySqlResponse of client.logs.logExplorer.query.sql({
  body: fs.createReadStream('path/to/file'),
  account_id: 'account_id',
})) {
  console.log(querySqlResponse);
}

{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    "string"
  ],
  "success": true,
  "result": [
    {
      "foo": "bar"
    }
  ]
}

Returns Examples

{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    "string"
  ],
  "success": true,
  "result": [
    {
      "foo": "bar"
    }
  ]
}