Supported fields and operators

Represents the name of the load balancer executing these rules.

Example value:
lb.example.com

Provides the region name of the data center processing the request.

Example value:
ENAM

If proxied, this field provides the client TCP IP address, which may be adjusted to reflect the actual address of the client by using HTTP headers such as X-Forwarded-For or X-Real-IP.

If unproxied (DNS-only), this field provides the ECS source address, if available. If not available, it provides the client resolver IP address.

Deprecation Warning: In the future, this field will always be set to the client resolver IP address for unproxied requests. To check for the presence of ECS and use the ECS IP, see the fields dns.rr.opt.client and dns.rr.opt.client.addr, respectively.

Example value:
1.2.3.4

Represents the entire cookie as a string.

Example value:
session=8521F670545D7865F79C3D7BEDC29CCE;-background=light

Represents the host name used in the full request URI.

Example value:
www.example.org

Represents the HTTP Referer request header, which contains the address of the web page that linked to the currently requested page.

Example value:
Referer: htt­ps://developer.example.org/en-US/docs/Web/JavaScript

Represents HTTP request headers as a Map (or associative array).

The keys of the associative array are the names of HTTP request headers converted to lowercase.

When there are repeating headers, the array includes them in the order they appear in the request.

Decoding: no decoding performed
Whitespace: preserved
Non-ASCII: preserved

Example:
any(http.request.headers["content-type"][*] == "application/json")

Example value:
{"content-type": ["application/json"]}

Represents the names of the headers in the HTTP request.

The names are not pre-processed and retain the original case used in the request.

Note: In HTTP/2 the names of HTTP headers are always in lowercase. Recent versions of the curl tool enable HTTP/2 by default for HTTPS connections.

The order of header names is not guaranteed but will match http.request.headers.values.

Duplicate headers are listed multiple times.

Decoding: no decoding performed
Whitespace: preserved
Non-ASCII: preserved

Example:
any(http.request.headers.names[*] == "content-type")

Example value: ["content-type"]

Represents the values of the headers in the HTTP request.

The values are not pre-processed and retain the original case used in the request.

The order of header values is not guaranteed but will match http.request.headers.names.

Duplicate headers are listed multiple times.

Decoding: no decoding performed
Whitespace: preserved
Non-ASCII: preserved

Example 1:
any(http.request.headers.values[*] == "application/json")

Example value 1:
["application/json"]

Additionally used to match requests according to the specified operator and the length/size entered for the header value.

Example 2:
any(len(http.request.headers.values[*])[*] gt 10)

Example value 2:
["This header value is longer than 10 bytes"]

Represents the HTTP method, returned as a string of uppercase characters.

Example value:
GET

Represents the timestamp when Cloudflare received the request, expressed as Unix time in seconds. This value is 10 digits long.

Example value:
1484063137

Represents the URI path and query string of the request.

Example value:
/articles/index?section=539061&expand=comments

Represents the HTTP URI arguments associated with a request as a Map (associative array).

When an argument repeats, then the array contains multiple items in the order they appear in the request.

The values are not pre-processed and retain the original case used in the request.

Decoding: no decoding performed
Non-ASCII: preserved

Example:
any(http.request.uri.args["search"][*] == "red+apples")

Example value:
{"search": ["red+apples"]}

Represents the names of the arguments in the HTTP URI query string. The names are not pre-processed and retain the original case used in the request.

When a name repeats, the array contains multiple items in the order that they appear in the request.

Decoding: no decoding performed
Non-ASCII: preserved

Example:
any(http.request.uri.args.names[*] == "search")

Example value:
["search"]

Represents the values of arguments in the HTTP URI query string. The values are not pre-processed and retain the original case used in the request. They are in the same order as in the request.

Duplicated values are listed multiple times.

Decoding: no decoding performed
Non-ASCII: preserved

Example:
any(http.request.uri.args.values[*] == "red+apples")

Example value:
["red+apples"]

Represents the URI path of the request.

Example value:
/articles/index

Represents the entire query string, without the ? delimiter.

Example value:
section=539061&expand=comments

Represents the version of the HTTP protocol used. Use this field when you require different checks for different versions.

Example Values:

• HTTP/1.1
• HTTP/3

Represents the query name asked.

Example value:
example.com.

Represents the length in bytes of the query name.

Example value:
123

When true, this field indicates that the received DNS message was a question.

Represents the numeric value of the DNS query type.

Example Values:

• 1 (A record)
• 28 (AAAA record)

When true, this field indicates that the EDNS Client Subnet (ECS) address was sent with the DNS request.

If present, this field represents the ECS address sent with the DNS request.

Example value:
1.2.3.0