Security Data Works

Public production architecture teardown

Cloudflare — ClickHouse + DataFusion on R2

Edge-network analytics at quadrillion-row scale, run on ClickHouse for nearly a decade — and now paired with R2 SQL, a distributed query engine built on Apache DataFusion that reads Parquet directly from R2 object storage via the Iceberg-backed R2 Data Catalog. Two engines, two retention envelopes, one telemetry plane.

1.61 Q events

Queried in under 2 seconds, across a full day. A separate query scanned 96 trillion events in one hour at the same latency. Margin of error under 1%. Latency held during a simulated North America data-center outage — the active-active soft-cluster design redistributes load without consensus overhead.

The pipeline

  1. Sources

    300+ edge data centers

    DNS · WAF · bot management · security logs

  2. Ingest

    Pipelines + R2 streaming

    SQL-transformed in flight; writes Parquet to R2 as Iceberg

  3. Hot store

    ClickHouse soft clusters

    Active-active; dynamic node assembly; minimal coordination

  4. Cold store

    R2 + R2 Data Catalog

    Parquet on object storage; Iceberg metadata; partition + column stats

  5. Query

    R2 SQL (Apache DataFusion)

    Coordinator + workers; range reads; filter pushdown

What composes, what’s brittle

  • ~10-year run. ClickHouse in production at Cloudflare since the mid-2010s — among the earliest large-scale adopters.
  • Active-active by design. No Raft/Paxos in the hot path; nodes can be addressed individually or as a soft cluster.
  • Why DataFusion on R2. Columnar Parquet + range reads + Iceberg pruning means cold-tier SQL without egress to a separate warehouse.
  • Composes with. Iceberg R2 Data Catalog is engine-agnostic — Databricks and ClickHouse can read the same tables.
  • What's distinctive. Two query engines on one storage plane, each chosen for the latency envelope it actually wins on.
  • What's brittle. Soft-cluster operational discipline; R2 SQL is new (2025) — engine maturity vs. the decade of ClickHouse battle-testing.

Sources: ClickHouse engineering blog, "Trouble will find you: How Cloudflare uses ClickHouse to scale analytics at quadrillion-row scale" (2025) · Cloudflare engineering blog, "R2 SQL: a deep dive into our new distributed query engine" · Cloudflare Pipelines product documentation (SQL transformations + Iceberg, Sep 2025).

See how the pattern lands on your workload.

The matrix scoring that justified each reference architecture's tool choices is the paid deliverable. The benchmark behind it is public — reproduce it on your own workload, then book a call to scope the work.