Vercel CDN, Routing and Firewall Logs - Bronto Docs

Besides function logs, Vercel’s log drain carries what happens before your code runs:

`source`	What it is
`static`	Requests for static assets and cached pages
`redirect`	Redirects from your project configuration
`external`	Rewrites to external URLs
`firewall`	Requests denied or rate-limited by Vercel Firewall rules
`edge`	Edge runtime functions

Request lines carry the cache state (proxy.vercelCache: HIT, MISS, STALE, PRERENDER, …), the path type (proxy.pathType), the edge region (proxy.region) and the status code. Firewall lines carry proxy.wafAction and the rule ID (proxy.wafRule).

Recommended method

Marketplace connector: its log drain carries all of these sources.

Alternatives

Drains you configure, for example one filtered to firewall for a security team.

Worth knowing

The firewall source covers requests that your firewall rules deny or rate-limit (Vercel’s docs describe it as requests denied by firewall rules). Allowed requests appear only under their normal source.
Rate-limited requests are logged as proxy.wafAction = 'deny' with the rate-limit rule’s ID, for example rule_rate_limit_new_chats_…. In testing they reached the drain a few minutes after the request.

See Ingesting Vercel Data into Bronto for the full mapping.

References