🐛 cfRay is missing from proxied request logs (newHTTPLogger discards the zerolog context)
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 82/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- go
- Domain
- observability
Research direction
Start in proxy/logger.go, in newHTTPLogger, where the cfRay and lbProbe context calls discard their return values. Assign the results back to ctx, then add a regression test in the proxy package that checks cfRay and lbProbe appear in the logged fields. Done when that test fails on the current code and passes with the change.
Written by the indexing model from the issue text.
Description
Describe the bug
The per-request log lines emitted by the proxy never include the cfRay field (nor lbProbe for load balancer health probes), even when the request carries a Cf-Ray header. This affects the origin request error line (logRequestError) and the debug request/response lines (logHTTPRequest / logOriginHTTPResponse), so a cloudflared log line can't be correlated with the same request in Cloudflare's edge logs (Logpush RayID) or in origin access logs.
Root cause: newHTTPLogger in proxy/logger.go calls ctx.Str / ctx.Bool without assigning the result. zerolog.Context methods have value receivers and return the updated context, so both fields are dropped:
if cfRay != "" {
ctx.Str(logFieldCFRay, cfRay) // returned context is discarded
}
if lbProbe {
ctx.Bool(logFieldLBProbe, lbProbe) // returned context is discarded
}
https://github.com/cloudflare/cloudflared/blob/2026.10.0/proxy/logger.go#L35-L40
This came in with 971360d5e0b97c41f1cffd4b79c79a05e6a5e91b (TUN-8238: Refactor proxy logging), first released in 2024.2.1. Before that, the same error line did include it, e.g. in #1012: error="Incoming request ended abruptly: context canceled" cfRay=7e0bcd892f8d4dc8-SIN event=1 originService=....
To Reproduce
Steps to reproduce the behavior:
- Run a tunnel with any HTTP ingress rule, with JSON logs to make the fields easy to see:
cloudflared tunnel --output json run <TUNNEL> - Send a request through the tunnel that fails at the origin (for example, a client that disconnects before the origin responds, or an ingress rule pointing at a port with nothing listening).
- Look at the
"event":1log line for that request: there is nocfRayfield.
With --loglevel debug, the "event":1 request and response lines are missing cfRay as well.
If it's an issue with Cloudflare Tunnel:
4. Tunnel ID : not tunnel-specific, reproducible with any tunnel
5. cloudflared config: any HTTP ingress rule
Expected behavior
Per-request log lines include "cfRay":"<ray id>" (and "lbProbe":true for load balancer health probes), as newHTTPLogger intends.
Environment and versions
- OS: Linux (Kubernetes,
cloudflare/cloudflaredcontainer image) - Architecture: AMD64 and ARM64
- Version: 2026.10.0 (affects every release since 2024.2.1)
Logs and errors
Origin request error line from 2026.10.0 (hostname anonymised):
{"connIndex":1,"error":"Incoming request ended abruptly: context canceled","event":1,"ingressRule":9,"level":"error","originService":"https://origin.example.com","time":"2026-10-08T09:44:53Z"}
connIndex, originService and ingressRule from the same logger context are present; cfRay is not.
Additional context
The fix is a two-line change (ctx = ctx.Str(...) / ctx = ctx.Bool(...)). I'll open a PR with it and a regression test that fails on master and passes with the change.
- Dominant language
- Go
- Stars
- 16k
- Forks
- 1.5k
- PR merge metrics
- No merged PRs in 30d
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from cloudflare/cloudflared
-
🐛 --output json writes invalid JSON lines when events are logged concurrentlyPossibly taken @akasakariko claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
cloudflare/cloudflared#1761 · 1 comment ·
-
🐛 After SIGTERM, `cloudflared tunnel run` uses 100% of one CPU core for the whole graceful-shutdown periodPossibly taken @cyphercodes claimed this 2 days ago. OpenPriority: Normal Type: Bug
Difficulty 1/5 Under an hour Newbie friendliness 88/100
cloudflare/cloudflared#1753 · 3 comments ·
-
tunnel route ip show: --filter-network-is-subset-of sends the superset filterPossibly taken @wangyusheng1985 claimed this 2 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 92/100
cloudflare/cloudflared#1750 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
cloudflare/cloudflared#1748 ·
-
🐛 QUIC Hijack() skips the status-written check that HTTP/2 enforcesPossibly taken @Asthenia0412 claimed this 12 days ago. OpenPriority: Normal Type: Bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
cloudflare/cloudflared#1747 ·
All issues in cloudflare/cloudflared
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
prime-radiant-inc/evener#4223 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
open-telemetry/opentelemetry-go-compile-instrumentation#1467 ·
Maintainers usually reply within 3 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
yetone/magpie#1490 · 1 comment ·
Maintainers usually reply within 1 day
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
modelcontextprotocol/go-sdk#1367 · 1 comment ·
Maintainers usually reply within 1 day