Cloudflare R2 and Logpush: A Practical Setup Walkthrough

Last updated: October 6, 2026

Cloudflare R2 is the company's S3-compatible object storage product, and the headline feature is zero egress fees. That makes it a natural destination for log archives—data that accumulates continuously but gets read sporadically. Cloudflare Logpush is the pipeline that moves logs from the Cloudflare edge to a storage destination, and R2 is now one of those destinations.

This guide walks through setting up Cloudflare R2 Logpush from scratch.

Quick take

• Cloudflare R2 is S3-compatible object storage with no egress fees.
• Cloudflare Logpush can write HTTP request logs into an R2 bucket.
• Setup requires an R2 bucket, API tokens, and a Logpush job.
• The same workflow works from the dashboard or the API.
• Output can be split into daily folders using a `DATE` parameter.

What R2 and Logpush are actually for

R2 is storage. Logpush is the export pipeline. Putting them together means HTTP request logs from Cloudflare's edge end up in an R2 bucket, organized by date, and readable from any S3-compatible client. Use cases include long-term retention for compliance, security analysis, traffic pattern work, and feeding logs into a data lake for analytics.

The reason R2 fits this workload is pricing. Log archives are stored continuously but read infrequently, and standard S3 egress makes that expensive. R2's zero-egress model changes the math.

Step 1: create the R2 bucket and API token

From the Cloudflare dashboard, go to R2 and create a bucket with a meaningful name. Then go to "Manage R2 API Tokens" and create a token with R2 write and Logshare edit permissions. Save the Access Key ID and Secret Access Key somewhere safe; they are only shown once.

The same level of access can be granted through a Cloudflare API token with the right zone and account scopes. The API-token path scales better for automation because keys can be issued through the API rather than copied from a dashboard.

Step 2: enable Logpush to R2

In the Cloudflare dashboard, pick the domain or account, go to Analytics & Logs, and click Logs. Select "Add Logpush job" and choose the dataset to send to storage. Pick the fields to include—the field set can be adjusted later. Select R2 as the destination, enter the bucket path, the Access Key ID, and the Secret Access Key, and validate the connection. Save and start pushing.

Step 3: drive the same job from the API

For automation, the equivalent is a POST to the Logpush jobs endpoint. The body specifies a name, a destination configuration string, a dataset, and the log fields to include. The destination configuration string for R2 follows the format:

`r2:///DATE?account-id=&access-key-id=&secret-access-key=`

The `DATE` parameter organizes logs into daily subfolders inside the bucket, which makes retention policies and lookups easier. Without it, everything lands in the bucket root.

Our analysis

Logpush to R2 is a clean integration, and the zero-egress pricing is what makes it worth considering. For teams running multiple domains through Cloudflare, log storage costs add up differently than they would on standard object storage—the egress bill never arrives.

The tradeoff is operational complexity. R2 tokens, Cloudflare API tokens, and Logpush scopes are three different permission systems, and the documentation does not clearly map how they interact. The cleanest path is a dedicated R2 API token with minimum required scope, rotated on a schedule that matches your security posture.

What to watch: Cloudflare has historically expanded R2's feature set incrementally. If you're evaluating this for a data lake or analytics pipeline, check the current API capabilities before committing to a workflow.

Who should care

Bottom line

The Cloudflare R2 Logpush integration is the right tool for long-term log retention when zero egress changes the cost math. Set up the bucket and token first, then either use the dashboard for a quick setup or drive the job from the API if you are managing multiple domains.