---
title: "Create LogForwarder"
method: POST
path: "/delivery/v2.1/global/workspaces/{workspaceUUID}/logforwarders"
tags: ["CDN and DNS (v2.1)"]
---

# Create LogForwarder

`POST /delivery/v2.1/global/workspaces/{workspaceUUID}/logforwarders`

Creates a new LogForwarder object in the specified workspace with the provided configuration.

## Path parameters

- `workspaceUUID` string, required

## Request body

- V2LogForwarder
  - `apiVersion` 'delivery/v2' | 'delivery/v2.1', required — Version identifier of the API schema
  - `kind` 'LogForwarder', required — The string value 'LogForwarder' that identifies the schema
  - `metadata` V2ObjectMeta, required — Standard resource metadata fields
    - `creationTimestamp` string, date-time, required
    - `labels` object, required — Labels are key-value pairs attached to resources for organization and categorization
    - `name` string, required — User-provided name that uniquely identifies the resource within its workspace
    - `namespace` string, required — Namespace is the namespace in which the resource exists
    - `uid` string, required — System-generated unique identifier for the resource
  - `spec` V1LogForwarderSpec, required — Desired configuration for the LogForwarder
    - `constraints` array[] — Specifies the constraints to filter request logs before forwarding them to the sink.
      - V1LogForwarderConstraint[]
        - `args` V1LogForwarderConstraintArgs, nullable — Constraint based on query parameters.
          - `expected` string[], required — Query string values used for comparison.
          - `name` string, required — Name of the target query string.
          - `operator` string, required — Specifies the comparison operator for the query strings. One of: equals, contains, starts_with, ends_with, matches, exists.
        - `asn` V1LogForwarderConstraintASN, nullable — Constraint based on the ASN.
          - `expected` integer[], required — ASN values used for comparison.
          - `operator` string, required — Specifies the comparison operator for ASN. One of: equals, lesser, greater.
        - `cache_status` V1LogForwarderConstraintCacheStatus, nullable — Constraint based on the cache status of the request.
          - `expected` string[], required — Cache status values used for comparison.
          - `operator` string, required — Specifies the comparison operator for the cache status. One of: equals.
        - `cookie` V1LogForwarderConstraintCookie, nullable — Constraint based on cookie values.
          - `expected` string[], required — Cookie values used for comparison.
          - `name` string, required — Name of the target cookie.
          - `operator` string, required — Specifies the comparison operator for the cookie. One of: equals, contains, starts_with, ends_with, matches, exists.
        - `country` V1LogForwarderConstraintCountry, nullable — Constraint based on the request’s country.
          - `expected` string[], required — Country codes used for comparison.
          - `operator` string, required — Specifies the comparison operator for the country. One of: equals.
        - `header` V1LogForwarderConstraintHeader, nullable — Constraint based on HTTP headers.
          - `expected` string[], required — Header values used for comparison.
          - `name` string, required — Name of the target header.
          - `operator` string, required — Specifies the comparison operator for the header. One of: equals, contains, starts_with, ends_with, matches, exists.
        - `host` V1LogForwarderConstraintHost, nullable — Constraint based on the request host.
          - `expected` string[], required — Host values used for comparison.
          - `operator` string, required — Specifies the comparison operator for the host. One of: equals, contains, starts_with, ends_with, matches.
        - `http_version` V1LogForwarderConstraintHTTPVersion, nullable — Constraint based on the HTTP version.
          - `expected` string[], required — HTTP version values used for comparison.
          - `operator` string, required — Specifies the comparison operator for the HTTP version. One of: equals.
        - `ip` V1LogForwarderConstraintIP, nullable — Constraint based on IP addresses.
          - `expected` string[], required — IP addresses used for comparison.
          - `operator` string, required — Specifies the comparison operator for IP addresses. One of: ip_matches.
        - `known_bots` V1LogForwarderConstraintKnownBots, nullable — Constraint targeting known bot traffic.
          - `expected` boolean, required — Indicates whether the request is from a known bot.
          - `operator` string, required — Specifies the comparison operator for known bots. One of: equals.
        - `method` V1LogForwarderConstraintMethod, nullable — Constraint based on the HTTP method.
          - `expected` string[], required — Method values used for comparison.
          - `operator` string, required — Specifies the comparison operator for the method. One of: equals.
        - `negate` boolean — Indicates whether to invert the constraint condition.
        - `path` V1LogForwarderConstraintPath, nullable — Constraint based on the request path.
          - `expected` string[], required — Path values used for comparison.
          - `operator` string, required — Specifies the comparison operator for the path. One of: equals, contains, starts_with, ends_with, matches.
        - `port` V1LogForwarderConstraintPort, nullable — Constraint based on the request port.
          - `expected` string[], required — Port values used for comparison.
          - `operator` string, required — Specifies the comparison operator for the port. One of: equals.
        - `status` V1LogForwarderConstraintStatus, nullable — Constraint based on the status of the request.
          - `expected` string[], required — Status values used for comparison.
          - `operator` string, required — Specifies the comparison operator for the status. One of: equals.
        - `tls` V1LogForwarderConstraintTLS, nullable — Constraint based on TLS attributes.
          - `expected` boolean, required — Indicates whether TLS should be enabled.
          - `operator` string, required — Specifies the comparison operator for TLS. One of: equals.
        - `type` string, required — Specifies the constraint type. One of: asn, cookie, country, header, ip, host, port, method, uri, path, args, http_version, tls, known_bots, status, upstream_status, cache_status, user_agent, upstream_address.
        - `upstream_address` V1LogForwarderConstraintUpstreamAddress, nullable — Constraint based on the upstream address of the request.
          - `expected` string[], required — Upstream address values used for comparison.
          - `operator` string, required — Specifies the comparison operator for the upstream address. One of: ip_matches.
        - `upstream_status` V1LogForwarderConstraintUpstreamStatus, nullable — Constraint based on the status of the request from the upstream.
          - `expected` string[], required — Upstream status values used for comparison.
          - `operator` string, required — Specifies the comparison operator for the upstream status. One of: equals.
        - `uri` V1LogForwarderConstraintURI, nullable — Constraint based on the request URI.
          - `expected` string[], required — URI values used for comparison.
          - `operator` string, required — Specifies the comparison operator for the URI. One of: equals, contains, starts_with, ends_with, matches.
        - `user_agent` V1LogForwarderConstraintUserAgent, nullable — Constraint based on the user agent of the request.
          - `expected` string[], required — User agent values used for comparison.
          - `operator` string, required — Specifies the comparison operator for the user agent. One of: equals, contains, starts_with, ends_with, matches.
    - `enabled` boolean, required — Enable or disable the log forwarder.
    - `encryption` V1Encryption, nullable — Specifies the encryption to apply to the forwarded logs.
      - `enabled` boolean, required — Specifies if the encryption is enabled.
      - `key` string, required — Specifies the encryption key to use. must be 16 bytes long.
      - `mode` string, required — Specifies the encryption mode to use. supported modes are AES-128-CFB, AES-128-OFB, AES-128-CTR-LE.
    - `headerFilter` V1HeaderFilter, nullable — The request and response headers filter to apply while forwarding the logs in order to include or exclude specified headers from log entries.
      - `includeAllRequest` boolean, required — Specifies if all request headers should be included in the log entries.
      - `includeAllResponse` boolean, required — Specifies if all response headers should be included in the log entries.
      - `request` string[] — Specifies the request headers to include in the log entries.
      - `response` string[] — Specifies the response headers to include in the log entries.
    - `ratelimit` V1Ratelimit, nullable — Specifies the rate limit to apply to the forwarded logs.
      - `enabled` boolean, required — Specifies if the rate limit is enabled.
      - `period` string, required — Duration in Go format (e.g., '5s', '1h30m', '100ms')
      - `rate` integer, required — Specifies the rate of access logs per period.
    - `selector` V1Selector, nullable, required — Specifies the selector to associate the log forwarder with specific CDN.
      - `name` string, required — Specifies the name of the CDN to associate the log forwarder with.
      - `namespace` string, required — Specifies the namespace of the CDN to associate the log forwarder with.
    - `sink` V1Sink, nullable, required — Specifies the sink to send the logs to.
      - `amqp` V1AmqpOpts, nullable — Specifies the AMQP options to send the logs to.
        - `address` string, required — Specifies the AMQP address to send the logs to.
        - `exchange` string, required — Specifies the AMQP exchange to send the logs to.
        - `host` string, required — Specifies the AMQP host to send the logs to.
        - `name` string, required — Specifies the AMQP queue name to send the logs to.
        - `password` string — Specifies the AMQP password to use.
        - `port` integer, required — Specifies the AMQP port to send the logs to.
        - `scheme` string, required — Specifies the AMQP scheme to use. supported schemes are amqp, amqps.
        - `username` string — Specifies the AMQP username to use.
      - `elastic` V1ElasticOpts, nullable — Specifies the Elasticsearch options to send the logs to.
        - `addresses` string[], required — Specifies the Elasticsearch addresses to send the logs to.
        - `compatibilityMode` boolean — Specifies if the Elasticsearch compatibility mode is enabled.
        - `index` string, required — Specifies the Elasticsearch index to send the logs to.
        - `password` string — Specifies the Elasticsearch password to send the logs to.
        - `username` string — Specifies the Elasticsearch username to send the logs to.
      - `kafka` V1KafkaOpts, nullable — Specifies the Kafka options to send the logs to.
        - `bootstrapServers` string[], required — Specifies the Kafka bootstrap servers to use.
        - `topic` string, required — Specifies the Kafka topic to send the logs to.
      - `kind` string, required — Specifies the kind of the sink to send the logs to. supported kinds are Kafka, Amqp, Websocket, Elastic, Loki.
      - `loki` V1LokiOpts, nullable — Specifies the Loki options to send the logs to.
        - `compression` string, required — Specifies the Loki compression to use. supported compressions are gzip, none, snappy, zlib, zstd.
        - `endpoint` string, required — Specifies the Loki endpoint to send the logs to.
        - `password` string — Specifies the Loki password to send the logs to.
        - `path` string, required — Specifies the Loki path to send the logs to.
        - `tenant_id` string, required — Specifies the Loki tenant ID to send the logs to.
        - `username` string — Specifies the Loki username to send the logs to.
      - `websocket` V1WebsocketOpts, nullable — Specifies the WebSocket options to send the logs to.
        - `address` string, required — Specifies the WebSocket address to send the logs to.
        - `headers` V1WebsocketHeader[]
          - `name` string, required — Specifies the WebSocket header name to send the logs to.
          - `value` string, required — Specifies the WebSocket header value to send the logs to.
  - `status` V1LogForwarderStatus, required — Current observed state of the LogForwarder
    - `buffer` string, required — Specifies the buffered logs.
    - `status` string — Specifies the status of the log forwarder.

## Response `201`

The logForwarder was successfully created and is being provisioned. 
The response contains the complete logForwarder details including the assigned unique identifier.

- V2LogForwarder
  - `apiVersion` 'delivery/v2' | 'delivery/v2.1', required — Version identifier of the API schema
  - `kind` 'LogForwarder', required — The string value 'LogForwarder' that identifies the schema
  - `metadata` V2ObjectMeta, required — Standard resource metadata fields
    - `creationTimestamp` string, date-time, required
    - `labels` object, required — Labels are key-value pairs attached to resources for organization and categorization
    - `name` string, required — User-provided name that uniquely identifies the resource within its workspace
    - `namespace` string, required — Namespace is the namespace in which the resource exists
    - `uid` string, required — System-generated unique identifier for the resource
  - `spec` V1LogForwarderSpec, required — Desired configuration for the LogForwarder
    - `constraints` array[] — Specifies the constraints to filter request logs before forwarding them to the sink.
      - V1LogForwarderConstraint[]
        - `args` V1LogForwarderConstraintArgs, nullable — Constraint based on query parameters.
          - `expected` string[], required — Query string values used for comparison.
          - `name` string, required — Name of the target query string.
          - `operator` string, required — Specifies the comparison operator for the query strings. One of: equals, contains, starts_with, ends_with, matches, exists.
        - `asn` V1LogForwarderConstraintASN, nullable — Constraint based on the ASN.
          - `expected` integer[], required — ASN values used for comparison.
          - `operator` string, required — Specifies the comparison operator for ASN. One of: equals, lesser, greater.
        - `cache_status` V1LogForwarderConstraintCacheStatus, nullable — Constraint based on the cache status of the request.
          - `expected` string[], required — Cache status values used for comparison.
          - `operator` string, required — Specifies the comparison operator for the cache status. One of: equals.
        - `cookie` V1LogForwarderConstraintCookie, nullable — Constraint based on cookie values.
          - `expected` string[], required — Cookie values used for comparison.
          - `name` string, required — Name of the target cookie.
          - `operator` string, required — Specifies the comparison operator for the cookie. One of: equals, contains, starts_with, ends_with, matches, exists.
        - `country` V1LogForwarderConstraintCountry, nullable — Constraint based on the request’s country.
          - `expected` string[], required — Country codes used for comparison.
          - `operator` string, required — Specifies the comparison operator for the country. One of: equals.
        - `header` V1LogForwarderConstraintHeader, nullable — Constraint based on HTTP headers.
          - `expected` string[], required — Header values used for comparison.
          - `name` string, required — Name of the target header.
          - `operator` string, required — Specifies the comparison operator for the header. One of: equals, contains, starts_with, ends_with, matches, exists.
        - `host` V1LogForwarderConstraintHost, nullable — Constraint based on the request host.
          - `expected` string[], required — Host values used for comparison.
          - `operator` string, required — Specifies the comparison operator for the host. One of: equals, contains, starts_with, ends_with, matches.
        - `http_version` V1LogForwarderConstraintHTTPVersion, nullable — Constraint based on the HTTP version.
          - `expected` string[], required — HTTP version values used for comparison.
          - `operator` string, required — Specifies the comparison operator for the HTTP version. One of: equals.
        - `ip` V1LogForwarderConstraintIP, nullable — Constraint based on IP addresses.
          - `expected` string[], required — IP addresses used for comparison.
          - `operator` string, required — Specifies the comparison operator for IP addresses. One of: ip_matches.
        - `known_bots` V1LogForwarderConstraintKnownBots, nullable — Constraint targeting known bot traffic.
          - `expected` boolean, required — Indicates whether the request is from a known bot.
          - `operator` string, required — Specifies the comparison operator for known bots. One of: equals.
        - `method` V1LogForwarderConstraintMethod, nullable — Constraint based on the HTTP method.
          - `expected` string[], required — Method values used for comparison.
          - `operator` string, required — Specifies the comparison operator for the method. One of: equals.
        - `negate` boolean — Indicates whether to invert the constraint condition.
        - `path` V1LogForwarderConstraintPath, nullable — Constraint based on the request path.
          - `expected` string[], required — Path values used for comparison.
          - `operator` string, required — Specifies the comparison operator for the path. One of: equals, contains, starts_with, ends_with, matches.
        - `port` V1LogForwarderConstraintPort, nullable — Constraint based on the request port.
          - `expected` string[], required — Port values used for comparison.
          - `operator` string, required — Specifies the comparison operator for the port. One of: equals.
        - `status` V1LogForwarderConstraintStatus, nullable — Constraint based on the status of the request.
          - `expected` string[], required — Status values used for comparison.
          - `operator` string, required — Specifies the comparison operator for the status. One of: equals.
        - `tls` V1LogForwarderConstraintTLS, nullable — Constraint based on TLS attributes.
          - `expected` boolean, required — Indicates whether TLS should be enabled.
          - `operator` string, required — Specifies the comparison operator for TLS. One of: equals.
        - `type` string, required — Specifies the constraint type. One of: asn, cookie, country, header, ip, host, port, method, uri, path, args, http_version, tls, known_bots, status, upstream_status, cache_status, user_agent, upstream_address.
        - `upstream_address` V1LogForwarderConstraintUpstreamAddress, nullable — Constraint based on the upstream address of the request.
          - `expected` string[], required — Upstream address values used for comparison.
          - `operator` string, required — Specifies the comparison operator for the upstream address. One of: ip_matches.
        - `upstream_status` V1LogForwarderConstraintUpstreamStatus, nullable — Constraint based on the status of the request from the upstream.
          - `expected` string[], required — Upstream status values used for comparison.
          - `operator` string, required — Specifies the comparison operator for the upstream status. One of: equals.
        - `uri` V1LogForwarderConstraintURI, nullable — Constraint based on the request URI.
          - `expected` string[], required — URI values used for comparison.
          - `operator` string, required — Specifies the comparison operator for the URI. One of: equals, contains, starts_with, ends_with, matches.
        - `user_agent` V1LogForwarderConstraintUserAgent, nullable — Constraint based on the user agent of the request.
          - `expected` string[], required — User agent values used for comparison.
          - `operator` string, required — Specifies the comparison operator for the user agent. One of: equals, contains, starts_with, ends_with, matches.
    - `enabled` boolean, required — Enable or disable the log forwarder.
    - `encryption` V1Encryption, nullable — Specifies the encryption to apply to the forwarded logs.
      - `enabled` boolean, required — Specifies if the encryption is enabled.
      - `key` string, required — Specifies the encryption key to use. must be 16 bytes long.
      - `mode` string, required — Specifies the encryption mode to use. supported modes are AES-128-CFB, AES-128-OFB, AES-128-CTR-LE.
    - `headerFilter` V1HeaderFilter, nullable — The request and response headers filter to apply while forwarding the logs in order to include or exclude specified headers from log entries.
      - `includeAllRequest` boolean, required — Specifies if all request headers should be included in the log entries.
      - `includeAllResponse` boolean, required — Specifies if all response headers should be included in the log entries.
      - `request` string[] — Specifies the request headers to include in the log entries.
      - `response` string[] — Specifies the response headers to include in the log entries.
    - `ratelimit` V1Ratelimit, nullable — Specifies the rate limit to apply to the forwarded logs.
      - `enabled` boolean, required — Specifies if the rate limit is enabled.
      - `period` string, required — Duration in Go format (e.g., '5s', '1h30m', '100ms')
      - `rate` integer, required — Specifies the rate of access logs per period.
    - `selector` V1Selector, nullable, required — Specifies the selector to associate the log forwarder with specific CDN.
      - `name` string, required — Specifies the name of the CDN to associate the log forwarder with.
      - `namespace` string, required — Specifies the namespace of the CDN to associate the log forwarder with.
    - `sink` V1Sink, nullable, required — Specifies the sink to send the logs to.
      - `amqp` V1AmqpOpts, nullable — Specifies the AMQP options to send the logs to.
        - `address` string, required — Specifies the AMQP address to send the logs to.
        - `exchange` string, required — Specifies the AMQP exchange to send the logs to.
        - `host` string, required — Specifies the AMQP host to send the logs to.
        - `name` string, required — Specifies the AMQP queue name to send the logs to.
        - `password` string — Specifies the AMQP password to use.
        - `port` integer, required — Specifies the AMQP port to send the logs to.
        - `scheme` string, required — Specifies the AMQP scheme to use. supported schemes are amqp, amqps.
        - `username` string — Specifies the AMQP username to use.
      - `elastic` V1ElasticOpts, nullable — Specifies the Elasticsearch options to send the logs to.
        - `addresses` string[], required — Specifies the Elasticsearch addresses to send the logs to.
        - `compatibilityMode` boolean — Specifies if the Elasticsearch compatibility mode is enabled.
        - `index` string, required — Specifies the Elasticsearch index to send the logs to.
        - `password` string — Specifies the Elasticsearch password to send the logs to.
        - `username` string — Specifies the Elasticsearch username to send the logs to.
      - `kafka` V1KafkaOpts, nullable — Specifies the Kafka options to send the logs to.
        - `bootstrapServers` string[], required — Specifies the Kafka bootstrap servers to use.
        - `topic` string, required — Specifies the Kafka topic to send the logs to.
      - `kind` string, required — Specifies the kind of the sink to send the logs to. supported kinds are Kafka, Amqp, Websocket, Elastic, Loki.
      - `loki` V1LokiOpts, nullable — Specifies the Loki options to send the logs to.
        - `compression` string, required — Specifies the Loki compression to use. supported compressions are gzip, none, snappy, zlib, zstd.
        - `endpoint` string, required — Specifies the Loki endpoint to send the logs to.
        - `password` string — Specifies the Loki password to send the logs to.
        - `path` string, required — Specifies the Loki path to send the logs to.
        - `tenant_id` string, required — Specifies the Loki tenant ID to send the logs to.
        - `username` string — Specifies the Loki username to send the logs to.
      - `websocket` V1WebsocketOpts, nullable — Specifies the WebSocket options to send the logs to.
        - `address` string, required — Specifies the WebSocket address to send the logs to.
        - `headers` V1WebsocketHeader[]
          - `name` string, required — Specifies the WebSocket header name to send the logs to.
          - `value` string, required — Specifies the WebSocket header value to send the logs to.
  - `status` V1LogForwarderStatus, required — Current observed state of the LogForwarder
    - `buffer` string, required — Specifies the buffered logs.
    - `status` string — Specifies the status of the log forwarder.

## Other responses

- `400` — Bad Request - invalid request payload or parameters
- `401` — Unauthorized - invalid or expired authentication token
- `403` — Forbidden - insufficient permissions
- `409` — Conflict - resource with the same name already exists

---

[API](https://skmtc.dev/sotoon/apis/sotoon-api.md) · [All operations](https://skmtc.dev/sotoon/apis/sotoon-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/sotoon/sotoon-api/revisions/c937cd9861c5/schema)
