How to export Cloudflare Workers Logs?

[rxliuli]

Recently, I noticed that the usage of the D1 database has increased strangely. I want to check if it has been attacked, but I cannot analyze requests based on IP aggregation, nor have I found any documentation about downloading logs. So is this an unsupported feature?

[emily-shen]

cc @Ankcorn

[adiprmx]

you can get the logs tbh, just not as one download button in the dashboard.

fastest way is wrangler tail, it streams live logs from your worker to your terminal, and you can filter by ip or status. for the attack check, run it for a bit and eyeball which ips are hammering you, or pipe it to a file and aggregate.

for longer analysis, logpush is the export path. it pushes worker logs to r2 or s3 or bigquery on a schedule, then you can query them properly, group by ip, count requests, all that. check if your plan supports it, its the only real bulk export.

one honest note btw, workers logs dont stick around long. tail is live only and dashboard logs have short retention, so if you want history, set up logpush now, you cant backfill what already scrolled past.

for your d1 spike, cross check the d1 metrics in the dashboard too. if one ip is doing a ton of reads, thats your attacker. block it with a waf rule or rate limiting once you have the ip.