Cloudflare opens Logpush and SQL log Transformers to Free, Pro and Business plans

The promise in the post is narrower than the pledge behind it. Cloudflare's guarantee covers features that reached general availability this week ^[3]. Enterprise-only features from before this week are moving one product at a time. The company wrote that it has not yet met the goal its CTO, Dane Knecht, set a year ago ^[1][5].

Plans are now supposed to differ by usage. "Where our plans differ, it's in how much you can use, not what you can use," the company wrote ^[4]. I think that is the right boundary for a platform with this many small customers. It also moves the point where a team finds out it has outgrown its plan. A locked feature is visible on the pricing page during evaluation. A usage limit appears when traffic grows.

Logpush is the clearest case. It sends Cloudflare logs to storage, security and analytics destinations ^[12]. Until this week, a team that wanted those logs in its own tools needed the tier Cloudflare originally built for invoices, custom contracts and dedicated support ^[2][6]. It now gets them through self-service pay-as-you-go pricing ^[6]. The post does not include the rates. Cloudflare has also added account-scoped firewall events, WebSocket analytics and per-zone post-quantum visibility to the datasets Logpush exports ^[7]. Custom Dashboards are open to all customers as well ^[9].

Transformers is the better piece of engineering. It runs SQL over the log stream to filter records, redact sensitive fields, enrich events and reformat output before delivery. A customer therefore does not have to run a separate ETL pipeline ^[8]. The source is the right place for that filter. A field redacted there never reaches the third-party store. The savings depend on how the destination bills. If a SIEM charges by ingested volume, every record dropped upstream is a record it never bills. If it charges a flat rate, the saving is the ETL job the team no longer has to build and run.

The access-control work matters more as a team grows. Nearly all Cloudflare products now have RBAC roles at account and zone level. Workers has joined R2 and Access in having roles on individual resources ^[10]. Cloudflare's own argument is that fine-grained roles still leave a few super administrators deciding who gets access to what. It says that becomes a bottleneck for customers running hundreds or thousands of zones ^[13]. Its answer is more accounts. The New Account button, launched last month, is the first way users can create additional accounts directly from the dashboard ^[11]. It is a button, and Cloudflare says thousands of customers a week are using it ^[11].