39% of Coralogix sessions are now headless

We set out to understand how customers were using Coralogix from outside the web app. Olly answers questions about a system in plain language. Coding agents query logs, examine traces, read metrics and configure the platform through the Coralogix CLI and MCP server. We wanted to see how much of this was becoming part of everyday work.

In the week of 20–26 October, 39% of Coralogix sessions included Olly, the CLI or MCP. More than one in five sessions took place entirely through those interfaces, without the web app at all. 11,458 people worked headlessly during that week, 40% of everyone active on Coralogix.

We have published the figures on our live Headless Usage page, which refreshes every five minutes. The page shows how adoption is changing, how people use Olly, which coding agents customers use, and what those agents ask Coralogix to do.

More customers are working headlessly

Between the week of 27 September–3 October and the week of 20–26 October, the share of sessions involving Olly, the CLI or MCP rose from 31.8% to 39.1%. The number of people working headlessly grew from 9,141 to 11,458, an increase of 25%.

The share of sessions conducted entirely outside the web app grew faster still, from 15.1% to 20.9%. That is a 39% relative increase in the share of sessions with no web app use.

There are two behaviours within these figures. Some people combine headless access with the web app. Others complete their work through Olly, the CLI or MCP alone. In the latest week, those groups accounted for 18% and 21% of all sessions respectively.

This distinction matters. An engineer may want an agent to investigate a problem, then open a dashboard to examine what it found. Another may stay in their coding environment throughout. Both workflows are already present in the data.

Olly puts the question first

Not every headless session runs through a terminal. Olly is Coralogix’s AI agent: a person describes what they want to know, and Olly runs the investigation and returns the answer. The person never opens a dashboard to get there, which is why we count Olly alongside the CLI and MCP.

In the week of 20–26 October, 1,374 people asked Olly something, up from 1,279 in the week of 27 September–3 October, an increase of 7%. That is about one in twenty of everyone active on Coralogix that week.

Each of them asked Olly around six things over the week, and that figure held steady across the month. People who use Olly keep coming back to it.

Coding agents spend most of their calls querying telemetry

We also looked at the work coding agents were doing through the CLI. For Claude Code, 60% of calls were log and span queries, and another 37% were metrics queries. Cursor showed a similar pattern: 65% log and span queries, and 32% metrics queries.

For both agents, roughly 97% of calls were queries. Configuration accounted for the remaining 3%.

GitHub Copilot had a different mix. Log and span queries accounted for 58% of calls, metrics for 15%, and configuration for 27%. These percentages describe each agent’s own activity; they do not mean the agents had equal volumes of traffic.

The common pattern is that agents are asking questions of production data. That is a useful starting point for understanding what an observability platform needs to give them. An agent investigating a failing request needs to find the relevant service, narrow the time window, inspect the errors and decide what to examine next. Each answer shapes another query.

The answer has to fit inside a context window

A production system can produce millions of log lines during an investigation. Pulling those lines into an agent’s context quickly consumes the space it needs to reason about the problem.

Coralogix lets the agent filter, group and aggregate data on the server using DataPrime. A question about which services are failing can return a short list of services and error counts. The underlying documents stay where they are.

This changes the amount of information the agent has to read. It can begin with a summary, identify an unusual result and query that result more deeply. The context window holds the findings that guide the investigation.

The format of those findings matters too. The CLI supports TOON, or Token-Oriented Object Notation, alongside text and JSON. TOON writes field names once, followed by rows of values. Repeated keys take up less space, leaving more room for the data itself.

Agents need a way to learn the platform

Access to a query endpoint is only part of the problem. An agent also needs to know how to discover fields, write a valid query and interpret the response.

The Coralogix CLI includes more than 20 skills covering logs, spans, metrics, dashboards, alerts, SLOs, RUM and other platform capabilities. These are guides the coding agent can load when it needs to perform a particular task.

For example, an investigation into a slow request may begin with a span query. The result may point to a service whose logs need examining. The agent can load the relevant guidance as the investigation moves between those tasks.

This gives the agent a practical way to explore an unfamiliar environment, with instructions for the work it is doing at that moment.

Follow-up questions need access to older data

An investigation rarely stays within its original time window. An error that appeared this morning may need comparing with last week’s deployment, or with the same traffic pattern a month earlier.

Coralogix queries data directly in cloud object storage, without a rehydration step. Olly or a coding agent can follow the investigation into older data without first restoring it to a separate hot store.

The cost of asking another question matters for the same reason. An agent may run several queries before it finds a useful lead, then several more to check it. Coralogix does not charge per query or per byte scanned. Query volume can grow with the investigation without adding those charges.

These choices support the behaviour visible on the page: people and their agents repeatedly querying telemetry as they work through a problem.

We will keep publishing how this changes

Headless usage includes people asking Olly, people working directly at a terminal and people using coding agents. The adoption figures therefore measure use of Olly, the CLI and MCP, rather than the proportion of work performed autonomously. They also measure activity, rather than whether an investigation succeeded or a repair was correct.

What they do show is a change in how customers reach their observability data. In the latest week, almost two in five sessions involved headless access, and more than a fifth used it exclusively.

We will keep updating the live figures, so you can follow that change as it happens.

---

Figures captured on 27 October 2026. Weekly comparisons use 27 September–3 October and 20–26 October. Percentages are rounded; relative changes are calculated from the underlying values. Headless means use of Olly, the Coralogix CLI or the Coralogix MCP server.