Cloudflare Instant Logs: What It Can and Can't Do
Instant Logs is one of Cloudflare’s most useful debugging tools. Open it in the dashboard and you watch HTTP requests hit your zone in real time, with filters for status code, path, country, and more.
It’s easy to assume it solves the log history problem. It doesn’t, and knowing why saves you from a nasty surprise during an incident.
Who can use Instant Logs?
| Plan | Instant Logs |
|---|---|
| Free | No |
| Pro | No |
| Business | Yes |
| Enterprise | Yes |
The limits that matter
From Cloudflare’s documentation:
- Maximum session time is 60 minutes.
- If you stop listening to the socket for more than five minutes, the stream stops automatically.
Instant Logs is a live tail. It shows traffic that happens while you’re watching. It gives you no way to go back and view requests from before you opened the session.
The trap: An alert fires at 3 AM. You open Instant Logs at 9 AM. You see everything from 9 AM onward, and nothing about the incident.
What Instant Logs is great for
- Deploy verification — watch for 5xx errors as a release rolls out
- Rule testing — confirm a new WAF or redirect rule matches what you expect
- Live incidents — see attack traffic while it’s still happening
- Debugging a single client — filter by IP and reproduce the issue
What it can’t do
- Answer “when did this start?” for anything before your session
- Show trends over days or weeks
- Provide evidence for a post-mortem or audit after the fact
- Help on Free or Pro plans at all
For those questions you need history, and history means the data was stored before you needed it.
Where history comes from instead
| Need | Tool | Plan |
|---|---|---|
| Live stream | Instant Logs | Business, Enterprise |
| Raw logs, short buffer | Logpull (3–7 days) | Enterprise |
| Raw logs to your storage | Logpush | Enterprise |
| Aggregated analytics | GraphQL Analytics API | All plans (limits vary) |
On every plan, the analytics API has retention limits you can check. Once data ages past them, it’s gone.
Pair live debugging with long-term history
Instant Logs tells you what’s happening now. MetricKeeper keeps what already happened: it connects with a read-only token and archives your Cloudflare analytics on a schedule, so the timeline before your session is still there.