Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fdataprime%2Flanguage-reference%2Ffunctions-reference%2Fgeneral%2Fentitytype.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fdataprime%2Flanguage-reference%2Ffunctions-reference%2Fgeneral%2Fentitytype.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

# `entityType`

## Description

Return the **entity type** of a record, such as `logs`, `spans`, or `jsonData`.

An entity type is the specific kind of data a record holds. It is narrower than a [pillar](https://coralogix.com/docs/dataprime/language-reference/functions-reference/general/pillar.md): several entity types can sit under the same pillar, so `logs`, `engineQueries`, and `auditEvents` all belong to the `logs` pillar. An entity type's schema is a superset of its pillar's: it includes every field the pillar guarantees, plus fields specific to that entity type. Knowing a record's entity type tells you which fields you can rely on. See [Entity types](https://coralogix.com/docs/user-guides/data-layer/entity-types.md).

This is especially useful when a query reads more than one source, for example with [\`union\`](https://coralogix.com/docs/dataprime/language-reference/commands-reference/union.md) or a multi-dataset [\`source\`](https://coralogix.com/docs/dataprime/language-reference/commands-reference/sources/source.md), and records with different entity types end up in the same result set.

`entityType()` works on Archive data and on Frequent Search data. Like [\`pillar\`](https://coralogix.com/docs/dataprime/language-reference/functions-reference/general/pillar.md), it returns `null` after an aggregation such as `groupby`, `countby`, or `aggregate`, and when the source of a record can't be resolved. To keep the value, compute it before you aggregate, or group by it.

## Syntax

```
entityType(): string
```

## Example 1

**Use case: Break a multi-source result down by origin**

Group a query that reads several datasets by all four origin functions to see, in one result, what each dataset holds and how many records it contributed. This is useful when the list of datasets comes from somewhere else, such as a saved query or an AI agent, and you need to confirm what kind of data is in each one before you aggregate across them.

### Example query

```
source logs, spans, system/engine.queries

| groupby dataspace() as dataspace,

          dataset() as dataset,

          pillar() as pillar,

          entityType() as entityType

  agg count() as count
```

### Example output

| dataspace | dataset        | pillar | entityType    | count  |
| --------- | -------------- | ------ | ------------- | ------ |
| default   | logs           | logs   | logs          | 277318 |
| default   | spans          | spans  | spans         | 41207  |
| system    | engine.queries | logs   | engineQueries | 364    |

## Example 2

**Use case: Keep only one entity type from a mixed result**

Application logs and audit events both belong to the `logs` pillar, so [\`pillar\`](https://coralogix.com/docs/dataprime/language-reference/functions-reference/general/pillar.md) can't separate them. Because `entityType()` is an expression, you can filter on it in the same query. Only the audit events remain.

### Example data

```
{

    "action": "login",

    "user": "jane@example.com"

}
```

### Example query

```
source logs, system/aaa.audit_events

| filter entityType() == 'auditEvents'
```

### Example output

```
{

    "action": "login",

    "user": "jane@example.com"

}
```

## Example 3

**Use case: Tag each record with its entity type**

Add the entity type to every record so it travels with the data into a dashboard, an export, or a downstream query.

### Example data

```
{

    "service": "backend-service",

    "status_code": 500

}
```

### Example query

```
source logs

| limit 1

| create entity_type from entityType()
```

### Example output

```
{

    "service": "backend-service",

    "status_code": 500,

    "entity_type": "logs"

}
```