[Logs] Update Log fields

[soheiokamoto]

Summary

This updates Log fields.

They are synced from internal entities repo's fields templates.

Changelog file is added manually.

Documentation checklist

• Is there a changelog entry (guidelines)? If you don't add one for something awesome and new (however small) — how will our customers find out? Changelogs are automatically posted to RSS feeds, the Discord, and X.
• The change adheres to the documentation style guide.
• If a larger change - such as adding a new page- an issue has been opened in relation to any incorrect or out of date information that this PR fixes.
• Files which have changed name or location have been allocated redirects.

[github-actions]

This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:

Pattern	Owners
/src/content/changelog/	@cloudflare/pm-changelogs, @cloudflare/pcx-technical-writing
/src/content/docs/logs/	@soheiokamoto, @angelampcosta, @rianvdm, @cloudflare/pcx-technical-writing

[github-actions]

Preview URL: https://16c32c57.preview.developers.cloudflare.com
Preview Branch URL: https://sohei-update-log-fields.preview.developers.cloudflare.com

Files with changes (up to 15)

Original Link	Updated Link
https://developers.cloudflare.com/changelog/2026-03-09-log-fields-updated/	https://sohei-update-log-fields.preview.developers.cloudflare.com/changelog/2026-03-09-log-fields-updated/

[soheiokamoto]

Changelog file is added manually.

[irvinebroque]

/bonk review this changelog entry and recommend how it could be improved

[ask-bonk]

Here is my review of the changelog entry with specific recommendations for improvement:

---

Changelog Review: 2026-02-12-log-fields-updated.mdx

What works

• Required frontmatter fields (title, description, date) are all present
• The date format is correct
• The file naming convention follows the YYYY-MM-DD-short-description.mdx pattern
• The file is in the correct directory (src/content/changelog/logs/)

Recommendations

1. Title is too generic — communicate the benefit

The current title "Log fields updated in Cloudflare Logs" tells users something changed but not what or why. Good changelog titles help users quickly decide if the entry is relevant to them. Consider something like:

New MCP Portal Logs dataset and new fields across 10 Logpush datasets

or at minimum:

New log fields added across multiple Logpush datasets

2. Description is essentially the same as the title

The description field appears in RSS feeds and social media embeds — it should add context beyond the title. The current description ("Cloudflare has updated log fields in Cloudflare Logs.") is redundant. Suggestion:

New MCP Portal Logs dataset is now available, along with new fields for HTTP Requests, DEX, Gateway, Network Analytics, and other Logpush datasets.

3. Body lacks context — what can users do with these fields?

The entry is a bare list of field names with no explanation. Compare this to the well-written examples in the style guide which explain the why alongside the what. At minimum:

• Briefly describe what the MCP Portal Logs dataset is, since it is entirely new. A user reading this changelog has no idea what MCP Portal Logs are or why they should care.
• Group fields thematically (e.g., "DEX datasets", "Zero Trust / Gateway", "Zone-level datasets") with brief context for each group rather than listing them flat.
• Add a link to the relevant documentation. For example: For the full list of available fields, refer to [Logpush datasets](/logs/logpush/logpush-job/datasets/).

4. Missing link to documentation

Every good changelog entry ends with a "learn more" link. This entry has none. Add something like:

For a complete list of available fields for each dataset, refer to [Logpush datasets](/logs/logpush/logpush-job/datasets/).

5. The email_security_alerts changes are not mentioned

The PR modifies email_security_alerts.md (+6/-6 — field updates) but the changelog entry does not mention Email Security Alerts. Either the changelog should list it, or there is a reason to omit it (e.g., the changes are purely corrections/renames rather than new fields). Worth confirming.

6. Minor style nit: comma before "and" in a two-item list

Line 14: DNSQueryName, and DNSQueryType — the serial comma ("and") is unnecessary when there are only two items. It should be DNSQueryName and DNSQueryType (no comma).

---

Suggested rewrite

---
title: New MCP Portal Logs dataset and new fields across multiple Logpush datasets
description: A new MCP Portal Logs dataset is now available, along with new fields for HTTP Requests, DEX, Gateway, Network Analytics, and other Logpush datasets.
date: 2026-02-12
---

Cloudflare has added new fields across multiple [Logpush datasets](/logs/logpush/logpush-job/datasets/):

### New dataset

- **[MCP Portal Logs](/logs/logpush/logpush-job/datasets/account/mcp_portal_logs/)**: A new dataset with fields including `ClientCountry`, `ClientIP`, `ColoCode`, `Datetime`, `Error`, `Method`, `PortalAUD`, `PortalID`, `PromptGetName`, `ResourceReadURI`, `ServerAUD`, `ServerID`, `ServerResponseDurationMs`, `ServerURL`, `SessionID`, `Success`, `ToolCallName`, `UserEmail`, and `UserID`.

### New fields in existing datasets

- **HTTP Requests**: `FraudEmailRisk`, `FraudUserID`, and `PayPerCrawlStatus`.
- **Firewall Events**: `FraudUserID`.
- **Network Analytics Logs**: `DNSQueryName` and `DNSQueryType`.
- **Gateway HTTP**: `ApplicationStatuses`.
- **Gateway DNS**: `InternalDNSDurationMs`.
- **DEX Application Tests**: `HTTPRedirectEndMs`, `HTTPRedirectStartMs`, `HTTPResponseBody`, and `HTTPResponseHeaders`.
- **DEX Device State Events**: `ExperimentalExtra`.
- **WARP Toggle Changes**: `UserEmail`.
- **WARP Config Changes**: `UserEmail`.

For the complete field definitions for each dataset, refer to [Logpush datasets](/logs/logpush/logpush-job/datasets/).

This version:

• Has a more descriptive title and description for RSS/social
• Separates the new dataset from field additions to existing datasets
• Links to the documentation (both inline and at the end)
• Puts the highest-impact items (new dataset, zone-level fields) first
• Fixes the two-item serial comma issue
• Uses H3 headings to organize the content

github run

[soheiokamoto]

Updated based on the review.

Updated based on the latest internal repo, too.

[ask-bonk]

Review Summary

The changelog is well-structured after the earlier review round — good improvements there. The field additions across the dataset files look correct and are properly placed in alphabetical order within each file. The new MCP Portal Logs dataset file is well-formed. The Email Security Alerts capitalization fixes and the ProxyEndpoint type/description fix in gateway_http.md are good cleanups.

A few issues to address:

1. Bare URLs in dex_application_tests.md (inconsistency)

The two new fields HTTPRedirectEndMs and HTTPRedirectStartMs use bare URLs:

Refer to https://developer.mozilla.org/en-US/docs/Web/API/Resource_Timing_API/Using_the_Resource_Timing_API for more details.

Every other field in the same file uses a proper markdown link:

Refer to [Resource timing](https://developer.mozilla.org/en-US/docs/Web/API/Resource_Timing_API/Using_the_Resource_Timing_API) for more details.

These should be updated to use [Resource timing](URL) for consistency.

2. Use "for example" instead of "e.g."

The Cloudflare docs style guide prefers "for example" over "e.g." Two new field descriptions use "e.g.":

• network_analytics_logs.md → DNSQueryType: "The DNS query type (e.g., A, AAAA, MX, TXT)"
• http_requests.md → PayPerCrawlStatus: "Pay Per Crawl outcome, when applicable (e.g. request enabled for charging...)"

These should be changed to "for example" for style guide compliance. (Note: I understand these are synced from an internal repo's templates, so this may need to be fixed at the source.)

3. Minor: note on code-generated files

Since these files are marked # Code generator. DO NOT EDIT., the bare URL and "e.g." issues likely originate from the internal templates. If fixing at the source is not feasible, it would still be worth patching them here so the published docs are consistent.

Everything else looks good — the changelog covers all the new fields accurately, the field ordering is correct, and the frontmatter is valid.

[ask-bonk]

Review posted on PR #28296. Here's a summary of what I found:

Overall: The PR is in good shape. The changelog was improved well based on the earlier review. The new MCP Portal Logs dataset and all field additions are correctly structured and alphabetically ordered. The Email Security capitalization fixes and ProxyEndpoint type/description fix are good cleanups.

3 issues flagged with inline suggestions:

1. Bare URLs in dex_application_tests.md — HTTPRedirectEndMs and HTTPRedirectStartMs use raw URLs instead of [Resource timing](URL) markdown links, which is inconsistent with every other field in the same file.

2. "e.g." in network_analytics_logs.md — DNSQueryType description uses "e.g." instead of "for example" per the style guide.

3. "e.g." in http_requests.md — PayPerCrawlStatus description uses "e.g." instead of "for example" per the style guide.

All three have concrete suggestion blocks that the author can apply directly from the GitHub UI. Since these files are code-generated from internal templates, I noted that the fixes may need to be applied at the source as well.

github run

[soheiokamoto]

Updated based on bonk suggestion.

Updated to the latest from the internal repo.

Updated changelog with the new date.

[ask-bonk]

All previously flagged issues have been addressed in the latest update:

1. Bare URLs in dex_application_tests.md — Fixed. HTTPRedirectEndMs and HTTPRedirectStartMs now use [Resource timing](URL) markdown links, consistent with the rest of the file.
2. "e.g." → "for example" — Fixed in network_analytics_logs.md (DNSQueryType), http_requests.md (PayPerCrawlStatus), dex_device_state_events.md (3 fields), and dlp_forensic_copies.md (DataPhase).
3. Email Security capitalization — Fixed across email_security_alerts.md.
4. ProxyEndpoint type/description in gateway_http.md — Fixed (now has string type and a proper description).

The changelog is well-structured, accurately lists all new fields and the new MCP Portal Logs dataset, and includes a link to the full dataset documentation. The new mcp_portal_logs.md file is properly formatted with fields in alphabetical order and consistent frontmatter.

New fields added in this update (AppControlInfo, PFPCustomTag, SNI, etc.) are also reflected in the changelog. The changes beyond the previous review round (additional fields from the latest internal repo sync, updated changelog date to 2026-03-09) all look correct.

LGTM.

[ask-bonk]

Review posted and PR approved. Here's a summary of what I found:

All 4 previously flagged issues have been resolved:

1. Bare URLs in dex_application_tests.md are now proper markdown links
2. "e.g." replaced with "for example" across multiple files (network_analytics_logs.md, http_requests.md, dex_device_state_events.md, dlp_forensic_copies.md)
3. Email Security capitalization fixed in email_security_alerts.md
4. ProxyEndpoint in gateway_http.md now has a proper type (string) and description

No new issues found. The changelog is accurate and well-structured, the new MCP Portal Logs dataset file is properly formatted, all fields are in alphabetical order, and frontmatter is consistent with the existing files. The PR is in good shape to merge.

github run