Cloudflare R2 Integration via API

Creating Access Key and Secret Key

1. Log in to: https://dash.cloudflare.com/
2. Go to “My Profile” in the top right corner and navigate to the “API Tokens” tab.
3. At the bottom of the page, under “API Keys,” you’ll see the R2 API Tokens section.
4. Click “Create API Token” and choose “Custom Token.”

Set the following permissions:

Account → R2 Storage → Read (and Write if needed)

Once the token is created, you will be shown the Access Key ID and Secret Access Key.

Make sure to save them, as they will not be shown again.

Finding the Account ID From the Cloudflare dashboard (https://dash.cloudflare.com/), navigate to the R2 section from the left menu. The R2 Bucket list will appear in the top-right area.

The Account ID is usually visible in the URL or at the top of the page.

Alternatively, you can find it under Account Home → Overview.

Bucket Name and Prefix (Folder) Information You will see the list of buckets you’ve created in the R2 panel.

Example: logs, network-events The prefix refers to the subfolders within the bucket.

For example, if your folder structure looks like this:

logs/
├── 2025/
    ├── 07/
        ├── 25/
            └── firewall.json.gz

Then the prefix can be entered as: logs

Logsign lists only the objects whose names start with the prefix and continues from the last object it has read. Enter the folder that receives new log files, not a folder for a single day. A prefix such as logs/2025/07/25 only covers that day, so files written to logs/2025/07/26 and later are not collected.

If Cloudflare Logpush writes each dataset to its own folder in the same bucket (for example cf/audit_log, cf/firewall_events and cf/http_requests), enter the same bucket name once for each prefix. Logsign keeps a separate read position for each bucket and prefix pair.

Cloudflare R2 follows the same logic as AWS S3. Everything is treated as an object, so the prefix acts like a folder.

Adding the Source to Logsign

Go to Settings > Data Collection > API, then select the relevant product (Cloudflare R2).

On the screen that appears, fill in the required fields using the information you previously gathered from the Cloudflare dashboard (as outlined in the steps above).

Important Notes for This Integration:

You must specify both the bucket name and the prefix. The bucket name is already created and known to you. The prefix (e.g., logs) must also be known and correctly entered. You can add multiple buckets and prefixes as comma-separated lists, but be sure to align them in the same order (bucket1 → prefix1, bucket2 → prefix2, etc.). The two lists must have the same number of entries, otherwise the source does not collect logs.

The Logpush ownership validation file (test.txt.gz) is skipped automatically and is not ingested.

After Submission:

Once the information is entered correctly, add the source and wait for the logs to start coming in. For Log Start Date, you can go back up to 1 month, but not further.

Each collection run reads log files for about 60 seconds in total. This time is shared equally between the configured bucket and prefix pairs. Logsign saves its position after each file, so a large backlog is collected over several runs instead of in one long run. If a file cannot be downloaded, Logsign stops at that file and retries it in the next run. If the bucket receives more data than the configured EPS limit can process, collection may fall behind the newest files.