Is it possible to filter the logs that are pulled via the LogPull API based on particular fields? The last time we were under DDoS, most of the traffic was blocked due to a country block rule that we had in place, but the large number of block logs ended up overwhelming our log ingestion system.
Sorry for the delay in responding back here. Logpull API fields can be customized by specifying them in the API call (e.g.):
curl -s -X GET 'https://api.cloudflare.com/client/v4/zones/{{zoneID}}/logs/received?start=1584357300&end=1584357900&fields=CacheCacheStatus,CacheResponseBytes,CacheResponseStatus,ClientASN,ClientCountry,ClientDeviceType,ClientIP,ClientIPClass,ClientRequestBytes,ClientRequestHost,ClientRequestMethod,ClientRequestProtocol,ClientRequestReferer,ClientRequestURI,ClientRequestUserAgent,ClientSSLCipher,ClientSSLProtocol,ClientSrcPort,EdgeColoID,EdgeEndTimestamp,EdgePathingSrc,EdgePathingOp,EdgePathingStatus,EdgeResponseBytes,EdgeResponseCompressionRatio,EdgeResponseStatus,EdgeStartTimestamp,OriginIP,OriginResponseBytes,OriginResponseHTTPExpires,OriginResponseHTTPLastModified,OriginResponseStatus,OriginResponseTime,RayID,SecurityLevel,WAFAction,WAFFlags,WAFMatchedVar,WAFProfile,WAFRuleID,WAFRuleMessage,ZoneID' \