API and background query limitations

Background query limitations

When performing background queries—whether via the Coralogix platform or by using the API—you may encounter a number of system-enforced limits or errors. These are typically related to data volume, storage access, or execution time. The table below outlines the most common error codes and messages you might receive, along with explanations and guidance to help you understand and resolve them effectively.
Error Explanation Description
"MAX_RESULTS" "Max results is 1000000. Refine your query." The query exceeded the maximum number of rows allowed for a single response. This usually indicates that the result set is too large; try reducing the time range or applying filters.
"SCANNED_BYTES_LIMIT" "Scanned bytes limit has been reached." The query attempted to scan more data than permitted by your tier or plan. Reduce the data scope, apply filters, or request access to higher query limits.
"BLOCK_LIMIT" "Blocks limit has been reached." Too many data blocks were involved in processing the query. This often results from querying a large time range or high-cardinality data. Consider narrowing the query scope.
"METASTORE_DATA_MISSING" "No data exists in your COS bucket for the given timeframe." The query timeframe points to archived storage, but there is no available metadata for this period. Check that logs were archived and the dates are correct.
"BUCKET_ACCESS_DENIED" "Access to bucket denied." The background query engine was unable to access the specified object storage (COS) bucket due to permission issues. Verify your integration or cloud storage access settings.
"BUCKET_READ_FAILED" "Failed to read from bucket." A general I/O error occurred while attempting to read archived data. This may be due to connectivity, permissions, or a corrupted file.
"BUCKET_MISSING_DATA" "Data partially missing from bucket." Some of the expected data blocks could not be found or read from your object store. Results may be incomplete.
"SCROLL_TIMEOUT" "Scroll timed out." The server took too long to scroll through the result set, usually due to large volumes or resource constraints. Try running a smaller or more efficient query.

Deleting background queries

Background queries cannot be manually deleted, but they automatically expire after 30 days. If a background query is canceled, all associated data will be deleted immediately. However, the query's metadata will persist for 30 days.

Queued background queries

A maximum queue of 50 background queries is allowed. When this limit is reached, new queries cannot be added to the queue until your team’s quota rises above zero.

Execution time limitations

Queries are limited to a maximum execution time of 30 minutes for background queries.

API rate limit

The number of requests is capped at 30 per minute.

Previous Quoting JSON in shell scripts for API requests

Next Overview

Error	Explanation	Description
"MAX_RESULTS"	"Max results is 1000000. Refine your query."	The query exceeded the maximum number of rows allowed for a single response. This usually indicates that the result set is too large; try reducing the time range or applying filters.
"SCANNED_BYTES_LIMIT"	"Scanned bytes limit has been reached."	The query attempted to scan more data than permitted by your tier or plan. Reduce the data scope, apply filters, or request access to higher query limits.
"BLOCK_LIMIT"	"Blocks limit has been reached."	Too many data blocks were involved in processing the query. This often results from querying a large time range or high-cardinality data. Consider narrowing the query scope.
"METASTORE_DATA_MISSING"	"No data exists in your COS bucket for the given timeframe."	The query timeframe points to archived storage, but there is no available metadata for this period. Check that logs were archived and the dates are correct.
"BUCKET_ACCESS_DENIED"	"Access to bucket denied."	The background query engine was unable to access the specified object storage (COS) bucket due to permission issues. Verify your integration or cloud storage access settings.
"BUCKET_READ_FAILED"	"Failed to read from bucket."	A general I/O error occurred while attempting to read archived data. This may be due to connectivity, permissions, or a corrupted file.
"BUCKET_MISSING_DATA"	"Data partially missing from bucket."	Some of the expected data blocks could not be found or read from your object store. Results may be incomplete.
"SCROLL_TIMEOUT"	"Scroll timed out."	The server took too long to scroll through the result set, usually due to large volumes or resource constraints. Try running a smaller or more efficient query.