Skip to content

Requests

API queries are made using JSON over HTTPS (referred to here as HTTP requests). All requests must use HTTPS. Calls made over plain HTTP will fail. Additionally, any request that lacks proper authentication will be rejected.

Authorization header

To authenticate, add an Authorization Bearer <cx_api_key> header to your API request. It contains a Bearer Token, which identifies a single user, bot user, or workspace-application relationship for authentication.
KeyAuthorization
ValueBearer <cx_api_key>

Host

Use the DataPrime endpoint that matches your Coralogix domain.

Request payload body

When submitting data to a resource via POST, you must submit your payload in JSON. The only required field in the API body is query. All other fields are optional and form the metadata object.

The following example consists of a JSON object that represents the request.

Full DataPrime query with metadata

{
  "query": "source logs | limit 100",
  "metadata": {
    "tier": "TIER_FREQUENT_SEARCH",          // TIER_ARCHIVE for long term storage
    "syntax": "QUERY_SYNTAX_DATAPRIME",      // QUERY_SYNTAX_LUCENE for Lucene queries
    "startDate": "2023-05-29T11:20:00.00Z",  // UTC
    "endDate": "2023-05-29T11:30:00.00Z",    // UTC
    "defaultSource": "logs"
  }
}

Note

If the time zone of your timestamp differs, convert it to UTC or offset the timestamp to your time zone by navigating to Account settings > Preferences > Change your time zone settings. For example, to start the query at 11:20 local time:
In San Francisco (Pacific Daylight Time): 2023-05-29T11:20:00.00-07:00
In India (India Standard Time): 2023-05-29T11:20:00.00+05:30

Note

When querying archived logs using the API, you must explicitly specify "tier": "TIER_ARCHIVE" in the metadata object of your request. Otherwise, the default is "tier": "TIER_FREQUENT_SEARCH".

Making an API query

https://ng-api-http.<span class="domain-value"></span>/api/v1/dataprime/query

{
  "query": "source logs | limit 10"
}

curl --location 'https://ng-api-http.<span class="domain-value"></span>/api/v1/dataprime/query' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <API key>' \
--data '{
    "query": "source logs | limit 10"
}'

Note

When working with curl or similar command-line tools to make JSON over HTTP API requests, it's important to understand how your shell (typically Bash) processes quotes inside command arguments. This becomes especially relevant when your request payload includes JSON — and even more so when the JSON contains both single and double quotes. Find out more here.

import requests
import json

endpoint = "https://ng-api-http.<span class="domain-value"></span>/api/v1/dataprime/query"
api_key = "<API key>"

headers = {
    "Content-Type": "application/json",
    "Authorization": f"Bearer {api_key}"
}

payload = {"query": "source logs | limit 10"}

response = requests.post(endpoint, headers=headers, json=payload)

if response.status_code == 200:
    try:
        for part in response.text.strip().split("\n"):
            print(json.loads(part))
    except json.JSONDecodeError:
        print("Response is not valid JSON:")
        print(response.text)
else:
    print(f"Request failed with status code {response.status_code}")
    print(response.text)

const endpoint = 'https://ng-api-http.<span class="domain-value"></span>/api/v1/dataprime/query';
const apiKey = '<API key>';

const payload = {
  query: 'source logs | limit 10',
};

fetch(endpoint, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    Authorization: `Bearer ${apiKey}`,
  },
  body: JSON.stringify(payload),
})
.then(async (res) => {
  const text = await res.text();

  if (!res.ok) throw new Error(`HTTP ${res.status}`);
  console.log('Status:', res.status);
  console.log('Response:', text);
})
.catch(err => {
  console.error('Error:', err);
});

package main

import (
    "bytes"
    "fmt"
    "io"
    "net/http"
)

func main() {
    url := "https://ng-api-http.<span class="domain-value"></span>/api/v1/dataprime/query"
    apiKey := "<API key>"

    payload := []byte(`{
        "query": "source logs | limit 10"
    }`)

    req, err := http.NewRequest("POST", url, bytes.NewBuffer(payload))
    if err != nil {
        fmt.Println("Error creating request:", err)
        return
    }

    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("Authorization", "Bearer "+apiKey)

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        fmt.Println("Request error:", err)
        return
    }
    defer resp.Body.Close()

    body, err := io.ReadAll(resp.Body)
    if err != nil {
        fmt.Println("Error reading response:", err)
        return
    }

    fmt.Println("Status:", resp.Status)
    fmt.Println("Response:")
    fmt.Println(string(body))
}

<?php
$url = "https://ng-api-http.<span class="domain-value"></span>/api/v1/dataprime/query";
$apiKey = "<API key>";

$payload = [
    "query" => "source logs | limit 10"
];

$ch = curl_init($url);

curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
    "Authorization: Bearer $apiKey"
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));

$response = curl_exec($ch);
$httpStatus = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "Status: $httpStatus\n";
echo "Response: $response\n";
?>

import java.io.*;
import java.net.HttpURLConnection;
import java.net.URL;

public class CoralogixQuery {
    public static void main(String[] args) throws Exception {
        String endpoint = "https://ng-api-http.<span class="domain-value"></span>/api/v1/dataprime/query";
        String apiKey = "<API key>";

        URL url = new URL(endpoint);
        HttpURLConnection con = (HttpURLConnection) url.openConnection();
        con.setRequestMethod("POST");
        con.setRequestProperty("Content-Type", "application/json");
        con.setRequestProperty("Authorization", "Bearer " + apiKey);
        con.setDoOutput(true);

        String payload = "{\"query\": \"source logs | limit 10\"}";
        try (OutputStream os = con.getOutputStream()) {
            byte[] input = payload.getBytes("utf-8");
            os.write(input, 0, input.length);
        }

        int status = con.getResponseCode();
        InputStream responseStream = (status < 400) ? con.getInputStream() : con.getErrorStream();
        BufferedReader in = new BufferedReader(new InputStreamReader(responseStream));
        String line;
        StringBuilder response = new StringBuilder();
        while ((line = in.readLine()) != null) {
            response.append(line.trim());
        }
        in.close();
        System.out.println("Status: " + status);
        System.out.println("Response: " + response.toString());
    }
}

using System;
using System.Net.Http;
using System.Text;
using System.Threading.Tasks;

class Program {
    static async Task Main() {
        var client = new HttpClient();
        var url = "https://ng-api-http.<span class="domain-value"></span>/api/v1/dataprime/query";
        var apiKey = "<API key>";

        var payload = "{\"query\": \"source logs | limit 10\"}";
        var content = new StringContent(payload, Encoding.UTF8, "application/json");

        client.DefaultRequestHeaders.Add("Authorization", $"Bearer {apiKey}");

        var response = await client.PostAsync(url, content);
        var result = await response.Content.ReadAsStringAsync();

        Console.WriteLine($"Status: {(int)response.StatusCode}");
        Console.WriteLine("Response:");
        Console.WriteLine(result);
    }
}

API response

The Content-Type representation header is used to indicate the original media type of the resource (before any content encoding is applied for sending). In responses, a Content-Type header provides the client with the actual content type of the returned content.

Correct results are returned in batches. Each batch may contain multiple rows of results, which are returned as Newline Delimited JSON or ndjson format.

The response will consist of 2 JSON objects. The first will contain the queryId and the second will contain the result of the DataPrime query.

{
  "queryId": {
    "queryId": "12345678-07f8-4313-1234-d954b1b45d31"
  }
}
{
  "result": {
    "results": [
      {
        "metadata": [
          {
            "key": "logid",
            "value": "c3ca5343-88dc-4807-a8f3-82832274afb7"
          }
        ],
        "labels": [
          {
            "key": "applicationname",
            "value": "staging"
          }
        ],
        "userData": "{ ... \"log_obj\":{\"level\":\"INFO\",\"message\":\"some log message\" ... }, ...}"
      }
    ]
  }
}

Background queries HTTP API

The Background Queries JSON over HTTP API enables you to run high-latency, long-running queries asynchronously using DataPrime or Lucene syntax from scripts or CLI. Ideal for recurring, extensive analytical tasks—such as monthly or quarterly reports—this feature operates in the background, allowing you to continue active monitoring within the Coralogix platform.

Submit a background query

https://ng-api-http.<span class="domain-value"></span>/api/v1/dataprime/background-query

{
  "query": "source logs",
  "syntax": "QUERY_SYNTAX_DATAPRIME",  // QUERY_SYNTAX_LUCENE for Lucene
  "startDate": "2025-01-20T00:00:00Z", // UTC
  "endDate": "2025-01-20T01:00:00Z",   // UTC
  "nowDate": "2025-01-20T02:00:00Z",   // UTC
  "tier": "TIER_ARCHIVE",              // (optional field) TIER_FREQUENT_SEARCH for Frequent Search
  "limit": 2000                        // (optional field) Max number of results. Default is 2000
}

curl --location 'https://ng-api-http.coralogix.com/api/v1/dataprime/background-query' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <API key>' \
--data '{
    "query": "source logs | limit 101",
    "syntax": "QUERY_SYNTAX_DATAPRIME",
    "startDate": "2025-01-20T00:00:00Z",
    "endDate": "2025-01-20T01:00:00Z",
    "nowDate": "2025-01-20T02:00:00Z"
}'

import requests
import json

endpoint = "https://ng-api-http.coralogix.com/api/v1/dataprime/background-query"
api_key = "<API key>"

headers = {
    "Content-Type": "application/json",
    "Authorization": f"Bearer {api_key}"
}

payload = {"query": "source logs | limit 10"}

response = requests.post(endpoint, headers=headers, json=payload)

if response.status_code == 200:
    try:
        for part in response.text.strip().split("\n"):
            print(json.loads(part))
    except json.JSONDecodeError:
        print("Response is not valid JSON:")
        print(response.text)
else:
    print(f"Request failed with status code {response.status_code}")
    print(response.text)

const endpoint = 'https://ng-api-http.coralogix.com/api/v1/dataprime/background-query';
const apiKey = '<API key>';

const payload = {
    query: "source logs | limit 101",
    syntax: "QUERY_SYNTAX_DATAPRIME",
    startDate: "2025-01-20T00:00:00Z",
    endDate: "2025-01-20T01:00:00Z",
    nowDate: "2025-01-20T02:00:00Z"
};

fetch(endpoint, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    Authorization: `Bearer ${apiKey}`,
  },
  body: JSON.stringify(payload),
})
.then(async (res) => {
  const text = await res.text();

  if (!res.ok) throw new Error(`HTTP ${res.status}`);
  console.log('Status:', res.status);
  console.log('Response:', text);
})
.catch(err => {
  console.error('Error:', err);
});

package main

import (
    "bytes"
    "fmt"
    "io"
    "net/http"
)

func main() {
    url := "https://ng-api-http.coralogix.com/api/v1/dataprime/background-query"
    apiKey := "<API key>"

    payload := []byte(`{
    "query": "source logs | limit 101",
    "syntax": "QUERY_SYNTAX_DATAPRIME",
    "startDate": "2025-01-20T00:00:00Z",
    "endDate": "2025-01-20T01:00:00Z",
    "nowDate": "2025-01-20T02:00:00Z"
  }`)

    req, err := http.NewRequest("POST", url, bytes.NewBuffer(payload))
    if err != nil {
        fmt.Println("Error creating request:", err)
        return
    }

    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("Authorization", "Bearer "+apiKey)

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        fmt.Println("Request error:", err)
        return
    }
    defer resp.Body.Close()

    body, err := io.ReadAll(resp.Body)
    if err != nil {
        fmt.Println("Error reading response:", err)
        return
    }

    fmt.Println("Status:", resp.Status)
    fmt.Println("Response:")
    fmt.Println(string(body))
}

<?php
$url = "https://ng-api-http.coralogix.com/api/v1/dataprime/background-query";
$apiKey = "<API key>";

$payload = [
    "query" => "source logs | limit 101",
    "syntax" => "QUERY_SYNTAX_DATAPRIME",
    "startDate" => "2025-01-20T00:00:00Z",
    "endDate" => "2025-01-20T01:00:00Z",
    "nowDate" => "2025-01-20T02:00:00Z"
];

$ch = curl_init($url);

curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
    "Authorization: Bearer $apiKey"
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));

$response = curl_exec($ch);
$httpStatus = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "Status: $httpStatus\n";
echo "Response: $response\n";
?>

import java.io.*;
import java.net.HttpURLConnection;
import java.net.URL;

public class CoralogixQuery {
    public static void main(String[] args) throws Exception {
        String endpoint = "https://ng-api-http.coralogix.com/api/v1/dataprime/background-query";
        String apiKey = "<API key>";

        URL url = new URL(endpoint);
        HttpURLConnection con = (HttpURLConnection) url.openConnection();
        con.setRequestMethod("POST");
        con.setRequestProperty("Content-Type", "application/json");
        con.setRequestProperty("Authorization", "Bearer " + apiKey);
        con.setDoOutput(true);

        String payload = """
        {
          "query": "limit 101",
          "syntax": "QUERY_SYNTAX_DATAPRIME",
          "startDate": "2025-01-20T00:00:00Z",
          "endDate": "2025-01-20T01:00:00Z",
          "nowDate": "2025-01-20T02:00:00Z"
        }
        """;


        try (OutputStream os = con.getOutputStream()) {
            byte[] input = payload.getBytes("utf-8");
            os.write(input, 0, input.length);
        }

        int status = con.getResponseCode();
        InputStream responseStream = (status < 400) ? con.getInputStream() : con.getErrorStream();
        BufferedReader in = new BufferedReader(new InputStreamReader(responseStream));
        String line;
        StringBuilder response = new StringBuilder();
        while ((line = in.readLine()) != null) {
            response.append(line.trim());
        }
        in.close();
        System.out.println("Status: " + status);
        System.out.println("Response: " + response.toString());
    }
}

using System;
using System.Net.Http;
using System.Text;
using System.Threading.Tasks;

class Program {
    static async Task Main() {
        var client = new HttpClient();
        var url = "https://ng-api-http.coralogix.com/api/v1/dataprime/background-query";
        var apiKey = "<API key>";

        var payload = "{"
          + "\"query\": \"limit 101\","
          + "\"syntax\": \"QUERY_SYNTAX_DATAPRIME\","
          + "\"startDate\": \"2025-01-20T00:00:00Z\","
          + "\"endDate\": \"2025-01-20T01:00:00Z\","
          + "\"nowDate\": \"2025-01-20T02:00:00Z\""
          + "}";

        var content = new StringContent(payload, Encoding.UTF8, "application/json");

        client.DefaultRequestHeaders.Add("Authorization", $"Bearer {apiKey}");

        var response = await client.PostAsync(url, content);
        var result = await response.Content.ReadAsStringAsync();

        Console.WriteLine($"Status: {(int)response.StatusCode}");
        Console.WriteLine("Response:");
        Console.WriteLine(result);
    }
}

Response

{
    "queryId": "a63653bc-aba8-49cf-b4a4-1b1ca9907f54",
    "warnings": []
}

Get status of a background query

https://ng-api-http.<span class="domain-value"></span>/api/v1/dataprime/background-query/status

{
    "queryId": "c80fa3e7-fa5b-441a-b0d4-acdbdbe36e64"
}

curl --location 'https://ng-api-http.coralogix.com/api/v1/dataprime/background-query/status' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <API key>' \
--data '{"queryId": "c80fa3e7-fa5b-441a-b0d4-acdbdbe36e64"}'

import requests
import json

endpoint = "https://ng-api-http.coralogix.com/api/v1/dataprime/background-query/status"
api_key = "<API key>"

headers = {
    "Content-Type": "application/json",
    "Authorization": f"Bearer {api_key}"
}

payload = {"queryId": "c80fa3e7-fa5b-441a-b0d4-acdbdbe36e64"}

response = requests.post(endpoint, headers=headers, json=payload)

if response.status_code == 200:
    try:
        for part in response.text.strip().split("\n"):
            print(json.loads(part))
    except json.JSONDecodeError:
        print("Response is not valid JSON:")
        print(response.text)
else:
    print(f"Request failed with status code {response.status_code}")
    print(response.text)

const endpoint = 'https://ng-api-http.coralogix.com/api/v1/dataprime/background-query/status';
const apiKey = '<API key>';

const payload = {queryId: "c80fa3e7-fa5b-441a-b0d4-acdbdbe36e64"};

fetch(endpoint, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    Authorization: `Bearer ${apiKey}`,
  },
  body: JSON.stringify(payload),
})
.then(async (res) => {
  const text = await res.text();

  if (!res.ok) throw new Error(`HTTP ${res.status}`);
  console.log('Status:', res.status);
  console.log('Response:', text);
})
.catch(err => {
  console.error('Error:', err);
});

package main

import (
    "bytes"
    "fmt"
    "io"
    "net/http"
)

func main() {
    url := "https://ng-api-http.coralogix.com/api/v1/dataprime/background-query/status"
    apiKey := "<API key>"

    payload := []byte(`{"queryId": "c80fa3e7-fa5b-441a-b0d4-acdbdbe36e64"}`)

    req, err := http.NewRequest("POST", url, bytes.NewBuffer(payload))
    if err != nil {
        fmt.Println("Error creating request:", err)
        return
    }

    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("Authorization", "Bearer "+apiKey)

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        fmt.Println("Request error:", err)
        return
    }
    defer resp.Body.Close()

    body, err := io.ReadAll(resp.Body)
    if err != nil {
        fmt.Println("Error reading response:", err)
        return
    }

    fmt.Println("Status:", resp.Status)
    fmt.Println("Response:")
    fmt.Println(string(body))
}

<?php
$url = "https://ng-api-http.coralogix.com/api/v1/dataprime/background-query/status";
$apiKey = "<API key>";

$payload = ["queryId" => "c80fa3e7-fa5b-441a-b0d4-acdbdbe36e64"];

$ch = curl_init($url);

curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
    "Authorization: Bearer $apiKey"
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));

$response = curl_exec($ch);
$httpStatus = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "Status: $httpStatus\n";
echo "Response: $response\n";
?>

import java.io.*;
import java.net.HttpURLConnection;
import java.net.URL;

public class CoralogixQuery {
    public static void main(String[] args) throws Exception {
        String endpoint = "https://ng-api-http.coralogix.com/api/v1/dataprime/background-query/status";
        String apiKey = "<API key>";

        URL url = new URL(endpoint);
        HttpURLConnection con = (HttpURLConnection) url.openConnection();
        con.setRequestMethod("POST");
        con.setRequestProperty("Content-Type", "application/json");
        con.setRequestProperty("Authorization", "Bearer " + apiKey);
        con.setDoOutput(true);

        String payload = "{\"queryId\": \"c80fa3e7-fa5b-441a-b0d4-acdbdbe36e64\"}";

        try (OutputStream os = con.getOutputStream()) {
            byte[] input = payload.getBytes("utf-8");
            os.write(input, 0, input.length);
        }

        int status = con.getResponseCode();
        InputStream responseStream = (status < 400) ? con.getInputStream() : con.getErrorStream();
        BufferedReader in = new BufferedReader(new InputStreamReader(responseStream));
        String line;
        StringBuilder response = new StringBuilder();
        while ((line = in.readLine()) != null) {
            response.append(line.trim());
        }
        in.close();
        System.out.println("Status: " + status);
        System.out.println("Response: " + response.toString());
    }
}

using System;
using System.Net.Http;
using System.Text;
using System.Threading.Tasks;

class Program {
    static async Task Main() {
        var client = new HttpClient();
        var url = "https://ng-api-http.coralogix.com/api/v1/dataprime/background-query/status";
        var apiKey = "<API key>";

        var payload = "{\"queryId\": \"c80fa3e7-fa5b-441a-b0d4-acdbdbe36e64\"}"

        var content = new StringContent(payload, Encoding.UTF8, "application/json");

        client.DefaultRequestHeaders.Add("Authorization", $"Bearer {apiKey}");

        var response = await client.PostAsync(url, content);
        var result = await response.Content.ReadAsStringAsync();

        Console.WriteLine($"Status: {(int)response.StatusCode}");
        Console.WriteLine("Response:");
        Console.WriteLine(result);
    }
}

Response

{
    "terminated": {
        "runningSince": "2025-01-23T15:16:01Z",
        "terminatedAt": "2025-01-23T15:16:01Z",
        "success": {}
    },
    "submittedAt": "2025-01-23T15:15:58Z",
    "metadata": [
        {
            "statistics": {
                "bytesScanned": "506070"
            }
        }
    ],
    "warnings": []
}

Cancel a background query

https://ng-api-http.<span class="domain-value"></span>/api/v1/dataprime/background-query/cancel

{
    "queryId": "c80fa3e7-fa5b-441a-b0d4-acdbdbe36e64"
}

curl --location 'https://ng-api-http.coralogix.com/api/v1/dataprime/background-query/cancel' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <API key>' \
--data '{"queryId": "c80fa3e7-fa5b-441a-b0d4-acdbdbe36e64"}'

import requests
import json

endpoint = "https://ng-api-http.coralogix.com/api/v1/dataprime/background-query/cancel"
api_key = "<API key>"

headers = {
    "Content-Type": "application/json",
    "Authorization": f"Bearer {api_key}"
}

payload = {"queryId": "c80fa3e7-fa5b-441a-b0d4-acdbdbe36e64"}

response = requests.post(endpoint, headers=headers, json=payload)

if response.status_code == 200:
    try:
        for part in response.text.strip().split("\n"):
            print(json.loads(part))
    except json.JSONDecodeError:
        print("Response is not valid JSON:")
        print(response.text)
else:
    print(f"Request failed with status code {response.status_code}")
    print(response.text)

const endpoint = 'https://ng-api-http.coralogix.com/api/v1/dataprime/background-query/cancel';
const apiKey = '<API key>';

const payload = {queryId: "c80fa3e7-fa5b-441a-b0d4-acdbdbe36e64"};

fetch(endpoint, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    Authorization: `Bearer ${apiKey}`,
  },
  body: JSON.stringify(payload),
})
.then(async (res) => {
  const text = await res.text();

  if (!res.ok) throw new Error(`HTTP ${res.status}`);
  console.log('Status:', res.status);
  console.log('Response:', text);
})
.catch(err => {
  console.error('Error:', err);
});

package main

import (
    "bytes"
    "fmt"
    "io"
    "net/http"
)

func main() {
    url := "https://ng-api-http.coralogix.com/api/v1/dataprime/background-query/cancel"
    apiKey := "<API key>"

    payload := []byte(`{"queryId": "c80fa3e7-fa5b-441a-b0d4-acdbdbe36e64"}`)

    req, err := http.NewRequest("POST", url, bytes.NewBuffer(payload))
    if err != nil {
        fmt.Println("Error creating request:", err)
        return
    }

    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("Authorization", "Bearer "+apiKey)

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        fmt.Println("Request error:", err)
        return
    }
    defer resp.Body.Close()

    body, err := io.ReadAll(resp.Body)
    if err != nil {
        fmt.Println("Error reading response:", err)
        return
    }

    fmt.Println("Status:", resp.Status)
    fmt.Println("Response:")
    fmt.Println(string(body))
}

<?php
$url = "https://ng-api-http.coralogix.com/api/v1/dataprime/background-query/cancel";
$apiKey = "<API key>";

$payload = ["queryId" => "c80fa3e7-fa5b-441a-b0d4-acdbdbe36e64"];

$ch = curl_init($url);

curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
    "Authorization: Bearer $apiKey"
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));

$response = curl_exec($ch);
$httpStatus = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "Status: $httpStatus\n";
echo "Response: $response\n";
?>

import java.io.*;
import java.net.HttpURLConnection;
import java.net.URL;

public class CoralogixQuery {
    public static void main(String[] args) throws Exception {
        String endpoint = "https://ng-api-http.coralogix.com/api/v1/dataprime/background-query/cancel";
        String apiKey = "<API key>";

        URL url = new URL(endpoint);
        HttpURLConnection con = (HttpURLConnection) url.openConnection();
        con.setRequestMethod("POST");
        con.setRequestProperty("Content-Type", "application/json");
        con.setRequestProperty("Authorization", "Bearer " + apiKey);
        con.setDoOutput(true);

        String payload = "{\"queryId\": \"c80fa3e7-fa5b-441a-b0d4-acdbdbe36e64\"}";

        try (OutputStream os = con.getOutputStream()) {
            byte[] input = payload.getBytes("utf-8");
            os.write(input, 0, input.length);
        }

        int status = con.getResponseCode();
        InputStream responseStream = (status < 400) ? con.getInputStream() : con.getErrorStream();
        BufferedReader in = new BufferedReader(new InputStreamReader(responseStream));
        String line;
        StringBuilder response = new StringBuilder();
        while ((line = in.readLine()) != null) {
            response.append(line.trim());
        }
        in.close();
        System.out.println("Status: " + status);
        System.out.println("Response: " + response.toString());
    }
}

using System;
using System.Net.Http;
using System.Text;
using System.Threading.Tasks;

class Program {
    static async Task Main() {
        var client = new HttpClient();
        var url = "https://ng-api-http.coralogix.com/api/v1/dataprime/background-query/cancel";
        var apiKey = "<API key>";

        var payload = "{\"queryId\": \"c80fa3e7-fa5b-441a-b0d4-acdbdbe36e64\"}"

        var content = new StringContent(payload, Encoding.UTF8, "application/json");

        client.DefaultRequestHeaders.Add("Authorization", $"Bearer {apiKey}");

        var response = await client.PostAsync(url, content);
        var result = await response.Content.ReadAsStringAsync();

        Console.WriteLine($"Status: {(int)response.StatusCode}");
        Console.WriteLine("Response:");
        Console.WriteLine(result);
    }
}

Response

{}

Get background query data

https://ng-api-http.<span class="domain-value"></span>/api/v1/dataprime/background-query/data

{
    "queryId": "c80fa3e7-fa5b-441a-b0d4-acdbdbe36e64"
}

curl --location 'https://ng-api-http.coralogix.com/api/v1/dataprime/background-query/data' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <API key>' \
--data '{"queryId": "c80fa3e7-fa5b-441a-b0d4-acdbdbe36e64"}'

import requests
import json

endpoint = "https://ng-api-http.coralogix.com/api/v1/dataprime/background-query/data"
api_key = "<API key>"

headers = {
    "Content-Type": "application/json",
    "Authorization": f"Bearer {api_key}"
}

payload = {"queryId": "c80fa3e7-fa5b-441a-b0d4-acdbdbe36e64"}

response = requests.post(endpoint, headers=headers, json=payload)

if response.status_code == 200:
    try:
        for part in response.text.strip().split("\n"):
            print(json.loads(part))
    except json.JSONDecodeError:
        print("Response is not valid JSON:")
        print(response.text)
else:
    print(f"Request failed with status code {response.status_code}")
    print(response.text)

const endpoint = 'https://ng-api-http.coralogix.com/api/v1/dataprime/background-query/data';
const apiKey = '<API key>';

const payload = {queryId: "c80fa3e7-fa5b-441a-b0d4-acdbdbe36e64"};

fetch(endpoint, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    Authorization: `Bearer ${apiKey}`,
  },
  body: JSON.stringify(payload),
})
.then(async (res) => {
  const text = await res.text();

  if (!res.ok) throw new Error(`HTTP ${res.status}`);
  console.log('Status:', res.status);
  console.log('Response:', text);
})
.catch(err => {
  console.error('Error:', err);
});

package main

import (
    "bytes"
    "fmt"
    "io"
    "net/http"
)

func main() {
    url := "https://ng-api-http.coralogix.com/api/v1/dataprime/background-query/data"
    apiKey := "<API key>"

    payload := []byte(`{"queryId": "c80fa3e7-fa5b-441a-b0d4-acdbdbe36e64"}`)

    req, err := http.NewRequest("POST", url, bytes.NewBuffer(payload))
    if err != nil {
        fmt.Println("Error creating request:", err)
        return
    }

    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("Authorization", "Bearer "+apiKey)

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        fmt.Println("Request error:", err)
        return
    }
    defer resp.Body.Close()

    body, err := io.ReadAll(resp.Body)
    if err != nil {
        fmt.Println("Error reading response:", err)
        return
    }

    fmt.Println("Status:", resp.Status)
    fmt.Println("Response:")
    fmt.Println(string(body))
}

<?php
$url = "https://ng-api-http.coralogix.com/api/v1/dataprime/background-query/data";
$apiKey = "<API key>";

$payload = ["queryId" => "c80fa3e7-fa5b-441a-b0d4-acdbdbe36e64"];

$ch = curl_init($url);

curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
    "Authorization: Bearer $apiKey"
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));

$response = curl_exec($ch);
$httpStatus = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "Status: $httpStatus\n";
echo "Response: $response\n";
?>

import java.io.*;
import java.net.HttpURLConnection;
import java.net.URL;

public class CoralogixQuery {
    public static void main(String[] args) throws Exception {
        String endpoint = "https://ng-api-http.coralogix.com/api/v1/dataprime/background-query/data";
        String apiKey = "<API key>";

        URL url = new URL(endpoint);
        HttpURLConnection con = (HttpURLConnection) url.openConnection();
        con.setRequestMethod("POST");
        con.setRequestProperty("Content-Type", "application/json");
        con.setRequestProperty("Authorization", "Bearer " + apiKey);
        con.setDoOutput(true);

        String payload = "{\"queryId\": \"c80fa3e7-fa5b-441a-b0d4-acdbdbe36e64\"}";

        try (OutputStream os = con.getOutputStream()) {
            byte[] input = payload.getBytes("utf-8");
            os.write(input, 0, input.length);
        }

        int status = con.getResponseCode();
        InputStream responseStream = (status < 400) ? con.getInputStream() : con.getErrorStream();
        BufferedReader in = new BufferedReader(new InputStreamReader(responseStream));
        String line;
        StringBuilder response = new StringBuilder();
        while ((line = in.readLine()) != null) {
            response.append(line.trim());
        }
        in.close();
        System.out.println("Status: " + status);
        System.out.println("Response: " + response.toString());
    }
}

using System;
using System.Net.Http;
using System.Text;
using System.Threading.Tasks;

class Program {
    static async Task Main() {
        var client = new HttpClient();
        var url = "https://ng-api-http.coralogix.com/api/v1/dataprime/background-query/data";
        var apiKey = "<API key>";

        var payload = "{\"queryId\": \"c80fa3e7-fa5b-441a-b0d4-acdbdbe36e64\"}"

        var content = new StringContent(payload, Encoding.UTF8, "application/json");

        client.DefaultRequestHeaders.Add("Authorization", $"Bearer {apiKey}");

        var response = await client.PostAsync(url, content);
        var result = await response.Content.ReadAsStringAsync();

        Console.WriteLine($"Status: {(int)response.StatusCode}");
        Console.WriteLine("Response:");
        Console.WriteLine(result);
    }
}

Response

{
  "response": {
    "results": {
      "results": [
        {
          "metadata": [...],
          "labels": [...],
          "userData": "..."
        },
        ...
      ]
    }
  }
},
{
  ...
}
...

Responses

The Content-Type representation header indicates the original media type of the resource before any content encoding is applied for transmission.

In responses, the Content-Type header informs the client of the actual content type of the returned data.

Data endpoint results are returned in batches, with each batch containing multiple rows formatted as Newline Delimited JSON (NDJSON). Other types of responses are returned in standard JSON format.

Status codes

Here are some of the most common status codes to expect.
Status codeDescription
200No Error
400Bad Request
403Forbidden

Failed requests

The general format guidelines are displayed when the accompanying status code is returned.

Warnings

The Warning response contains information about possible problems with the status of the message. More than one Warning header may appear in a response.

Warning responses can be applied to any message, before or after query results.
Warning typeDescription
CompileWarningWarning of potential compilation error in your query. In the event of a compilation failure, you will receive an error response.
TimeRangeWarningWhen the time frame for your query has been built incorrectly or exceeds internal limits
NumberOfResultsLimitWarningWhen the number of query results exceeds internal limits
BytesScannedLimitWarningWhen the number of bytes returned in query results exceeds internal limits
DeprecationWarningWhen a value in your query is changed or deprecated incorrectly

Limitations

Coralogix places certain limitations on query responses. Warnings are returned when a limit is breached.

Previous Previous API queries
Next gRPC API queries Next
Home
User Guides User Guides
DataPrime DataPrime
Integrations Integrations
OpenTelemetry OpenTelemetry
Developer Portal Developer Portal