API and background query limitations

Direct query limitations

Coralogix places certain limitations on direct query responses. Warnings are returned when a limit is breached.

Results returned

You can control the number of results returned in two ways:

The limit clause in your query — for example, source logs | limit 5000.
The limit field in the request metadata.

The total rows returned is the smaller of: any | limit N in your query, the metadata.limit field, and the tier's hard limit. If you provide no limit at all, you get the soft limit of 2,000 rows regardless of tier.
Tier Soft limit (no limit set) Hard limit (with limit set)
High (default when tier is unset) 2,000 rows 15,000 rows
Archive 2,000 rows 50,000 rows

For Archive-tier queries against object storage, see S3 Archive.

Bytes scanned limit

The number of bytes scanned is limited as follows:

High tier: 100 MB for OpenSearch queries. This applies to fetching 100 MB of high-tier data — it does not limit the scanning within the database storage.
Archive tier: archive scan limit is derived from your team's quota.

Rate limit

Direct query requests are capped at 30 per minute.

Background query limitations

When performing background queries—whether via the Coralogix platform or by using the API—you may encounter a number of system-enforced limits or errors. These are typically related to data volume, storage access, or execution time. The table below outlines the most common error codes and messages you might receive, along with explanations and guidance to help you understand and resolve them effectively.
Error Explanation Description
"MAX_RESULTS" "Max results is 1000000. Refine your query." The query exceeded the maximum number of rows allowed for a single response. This usually indicates that the result set is too large; try reducing the time range or applying filters.
"SCANNED_BYTES_LIMIT" "Scanned bytes limit has been reached." The query attempted to scan more data than permitted by your tier or plan. Reduce the data scope, apply filters, or request access to higher query limits.
"BLOCK_LIMIT" "Blocks limit has been reached." Too many data blocks were involved in processing the query. This often results from querying a large time range or high-cardinality data. Consider narrowing the query scope.
"METASTORE_DATA_MISSING" "No data exists in your object storage bucket for the given timeframe." The query timeframe points to archived storage, but there is no available metadata for this period. Check that logs were archived and the dates are correct.
"BUCKET_ACCESS_DENIED" "Access to bucket denied." The background query engine was unable to access the specified object storage bucket due to permission issues. Verify your integration or cloud storage access settings.
"BUCKET_READ_FAILED" "Failed to read from bucket." A general I/O error occurred while attempting to read archived data. This may be due to connectivity, permissions, or a corrupted file.
"BUCKET_MISSING_DATA" "Data partially missing from bucket." Some of the expected data blocks could not be found or read from your object store. Results may be incomplete.
"SCROLL_TIMEOUT" "Scroll timed out." The server took too long to scroll through the result set, usually due to large volumes or resource constraints. Try running a smaller or more efficient query.

Rate limits

Each background query API endpoint has its own rate limit:
Endpoint Limit
Submit a background query 100 requests per minute (queue admission, not query execution)
Cancel a background query 50 requests per minute
Get background query status 50 requests per minute
Get background query data 30 requests per minute

Deleting background queries

Background queries cannot be manually deleted, but they automatically expire after 30 days. If a background query is canceled, all associated data will be deleted immediately. However, the query's metadata will persist for 30 days.

Queued background queries

A maximum queue of 50 background queries is allowed. When this limit is reached, new queries cannot be added to the queue until your team’s quota rises above zero.

Execution time limitations

Queries are limited to a maximum execution time of 30 minutes for background queries.

Need help? Contact Support.

What's new? Find out here.

LLM? Read llms.txt.

Previous Quoting JSON in shell scripts for API requests

Next Overview

Tier	Soft limit (no `limit` set)	Hard limit (with `limit` set)
High (default when tier is unset)	2,000 rows	15,000 rows
Archive	2,000 rows	50,000 rows

Error	Explanation	Description
"MAX_RESULTS"	"Max results is 1000000. Refine your query."	The query exceeded the maximum number of rows allowed for a single response. This usually indicates that the result set is too large; try reducing the time range or applying filters.
"SCANNED_BYTES_LIMIT"	"Scanned bytes limit has been reached."	The query attempted to scan more data than permitted by your tier or plan. Reduce the data scope, apply filters, or request access to higher query limits.
"BLOCK_LIMIT"	"Blocks limit has been reached."	Too many data blocks were involved in processing the query. This often results from querying a large time range or high-cardinality data. Consider narrowing the query scope.
"METASTORE_DATA_MISSING"	"No data exists in your object storage bucket for the given timeframe."	The query timeframe points to archived storage, but there is no available metadata for this period. Check that logs were archived and the dates are correct.
"BUCKET_ACCESS_DENIED"	"Access to bucket denied."	The background query engine was unable to access the specified object storage bucket due to permission issues. Verify your integration or cloud storage access settings.
"BUCKET_READ_FAILED"	"Failed to read from bucket."	A general I/O error occurred while attempting to read archived data. This may be due to connectivity, permissions, or a corrupted file.
"BUCKET_MISSING_DATA"	"Data partially missing from bucket."	Some of the expected data blocks could not be found or read from your object store. Results may be incomplete.
"SCROLL_TIMEOUT"	"Scroll timed out."	The server took too long to scroll through the result set, usually due to large volumes or resource constraints. Try running a smaller or more efficient query.

Endpoint	Limit
Submit a background query	100 requests per minute (queue admission, not query execution)
Cancel a background query	50 requests per minute
Get background query status	50 requests per minute
Get background query data	30 requests per minute