# Cloudflare Integration problem with delayed ingestion

**URL:** <https://discuss.elastic.co/t/cloudflare-integration-problem-with-delayed-ingestion/317381>\
**Category:** Elastic Agent\
**Created:** [October 25, 2022, 8:24am UTC](https://discuss.elastic.co/t/cloudflare-integration-problem-with-delayed-ingestion/317381 "2022-10-25T08:24:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)\
**Post date:** [October 25, 2022, 8:24am UTC](https://discuss.elastic.co/t/cloudflare-integration-problem-with-delayed-ingestion/317381/1 "2022-10-25T08:24:31Z")

</div>

Hi everybody,  
using Cloduflare integration I noticed that if the machine where the elastic agent is installed falls for a certain period, Elastic is not able to recover the accumulated ingestion delay.

I'm talking about 1000 logs per hour so a minimum flow.

I tried to change the interval of the PULL, but apparently the interval is both the frequency with which the PULL is performed and the maximum interval of logs taken.

Example:  
If i put an interval of 1 hour, it retrieves logs only between 5.00 to 6.00. Then after an hour it retrieve from 6.00 to 7.00, but if i have a delay of two hour it never recovers this delay and considering 1000 logs per hour i don't think it's an ingestion problem.

I'm using Elastic Cloud 8.3.3

Thank you.  
Regards.

---

<div class="post-metadata">

**Author:** ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)\
**Post date:** [October 26, 2022, 12:53pm UTC](https://discuss.elastic.co/t/cloudflare-integration-problem-with-delayed-ingestion/317381/2 "2022-10-26T12:53:36Z")

</div>

Hi,  
an update, for the moment I solved by restarting the elastic agent every 5 minutes.

Thank you  
Regards

---

<div class="post-metadata">

**Author:** ![jamie.hynds](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamie.hynds/32/84205_2.png) [@jamie.hynds](https://discuss.elastic.co/u/jamie.hynds)\
**Post date:** [November 1, 2022, 5:04pm UTC](https://discuss.elastic.co/t/cloudflare-integration-problem-with-delayed-ingestion/317381/3 "2022-11-01T17:04:39Z")

</div>

Hi @yago82 - I assume you are using the Cloudflare Logpull integration? If so, we recently shipped a new [Cloudflare Logpush integration](https://docs.elastic.co/integrations/cloudflare_logpush) which is Cloudflare's preferred approach to ship logs. While Logpull is still supported, you can likely get improved performance and broader event coverage from Logpush. I'd recommend going down that road, but if you can't - more than happy to dig into the issues you've faced with Logpull.

---

<div class="post-metadata">

**Author:** ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)\
**Post date:** [November 8, 2022, 10:01am UTC](https://discuss.elastic.co/t/cloudflare-integration-problem-with-delayed-ingestion/317381/4 "2022-11-08T10:01:32Z")

</div>

Hi @jamie.hynds

thank you for your answer.

As you said, I have to keep using the LogPull. For the moment it hasn't given me any major problems. My concern about delayed ingestion. As you can see, the workaround of turning the elastic agent off and on again is not a very "elegant" solution.

I don't understand why the integration fetches the logs of an interval equal to the frequency of the Pull. If set every 5 minutes, he retrieves logs of an interval of 5 minutes and no more.

Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 6, 2022, 10:01am UTC](https://discuss.elastic.co/t/cloudflare-integration-problem-with-delayed-ingestion/317381/5 "2022-12-06T10:01:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
