When a Worker calls your origin, the request line logs OriginResponseStatus = 0 — the real origin status is on a separate subrequest line. Pick a scenario below to fire a real request, see exactly what the eyeball, Worker and origin each returned, and watch a naive alert vs a subrequest-aware alert.
output_options.merge_subrequests: true, verified 2026-07-23). So worker requests below can be shown as separate rows or as a single merged row with a nested Subrequests[] — toggle it in each result.What each hop returned
The Logpush data
Alert evaluation
Keep your spike alert, and add a subrequest-aware origin alert. Fields are the standard Logpush http_requests dataset — map to your own index.
EdgeResponseStatus >= 500 and ClientRequestSource : "eyeball"
# scans every row (parent + edgeWorkerFetch); catches masked origin 5xx
OriginResponseStatus >= 500
# with merge_subrequests on, one field per parent tells the story: error_attribution : "origin_5xx" and client_facing_5xx : false # the masked ones
Merging: with output_options.merge_subrequests: true (enabled here) the parent line carries a nested Subrequests[], so per-request attribution is one hop. Rule B works even without merging — the edgeWorkerFetch rows are already in your stream.
The 111 masked requests returned a healthy status to the client while the origin was throwing 500s behind the Worker.