Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fdataprime%2Flanguage-reference%2Ffunctions-reference%2Fgeneral%2Fpillar.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fdataprime%2Flanguage-reference%2Ffunctions-reference%2Fgeneral%2Fpillar.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

# `pillar`

## Description

Return the **pillar** that a record belongs to. DataPrime queries three pillars, so the value is `logs`, `spans`, or `data`.

A pillar is the broadest grouping of Coralogix data. It says what kind of data a record is. Every dataset belongs to exactly one pillar, and every entity type sits under one pillar, so several entity types can share a pillar. See [Pillars and the entity types within them](https://coralogix.com/docs/user-guides/data-layer/entity-types.md#pillars-and-the-entity-types-within-them) for the full list.

This is especially useful when a query reads more than one source, for example with [\`union\`](https://coralogix.com/docs/dataprime/language-reference/commands-reference/union.md) or a multi-dataset [\`source\`](https://coralogix.com/docs/dataprime/language-reference/commands-reference/sources/source.md), and you need to know which pillar each record came from. A query built from a list of dataset names, by a person or by an AI agent, doesn't always know in advance what kind of data each dataset holds. `pillar()` answers that per record, in the result itself.

`pillar()` works on Archive data and on Frequent Search data. It returns `null` after an aggregation such as `groupby`, `countby`, or `aggregate`, because an aggregated row no longer comes from a single source, and when the source of a record can't be resolved. To keep the value, compute it before you aggregate, or group by it.

Note

For the finer-grained classification inside a pillar, see [\`entityType\`](https://coralogix.com/docs/dataprime/language-reference/functions-reference/general/entitytype.md). Together with [\`dataspace\`](https://coralogix.com/docs/dataprime/language-reference/functions-reference/general/dataspace.md), [\`dataset\`](https://coralogix.com/docs/dataprime/language-reference/functions-reference/general/dataset.md), and [\`recordLocation\`](https://coralogix.com/docs/dataprime/language-reference/functions-reference/general/recordlocation.md), these functions describe where every record comes from.

## Syntax

```
pillar(): string
```

## Example 1

**Use case: See where each record in a multi-source query comes from**

Take one record from each of three sources and return only its origin. Each row reads from the outside in: the dataspace holds the dataset, the dataset holds data of one pillar and one entity type, and [\`recordLocation\`](https://coralogix.com/docs/dataprime/language-reference/functions-reference/general/recordlocation.md) points to the archive file the record was read from. Logs and engine queries share the `logs` pillar but differ in entity type.

### Example query

```
source logs

| limit 1

| union (source spans | limit 1)

| union (source system/engine.queries | limit 1)

| choose

    dataspace() as dataspace,

    dataset() as dataset,

    pillar() as pillar,

    entityType() as entityType,

    recordLocation() as archive_file
```

### Example output

| dataspace | dataset        | pillar | entityType    | archive\_file                                                                                                     |
| --------- | -------------- | ------ | ------------- | ----------------------------------------------------------------------------------------------------------------- |
| default   | logs           | logs   | logs          | `s3://<bucket>/cx/parquet/v1/team_id=<team_id>/dt=2026-10-08/hr=07/<file>.parquet`                                |
| default   | spans          | spans  | spans         | `s3://<bucket>/cx/spans/parquet/v1/team_id=<team_id>/dt=2026-10-08/hr=07/<file>.parquet`                          |
| system    | engine.queries | logs   | engineQueries | `s3://<bucket>/cx/format=wide-parquet-v1/dataspace=system/dataset=engine.queries/version=1/team_id=<team_id>/...` |

Rows can come back in any order. For records read from Frequent Search, `archive_file` is `null`, because those records aren't read from archive files.

## Example 2

**Use case: Count records per pillar in a multi-source query**

A query that reads both logs and spans returns records from two pillars. Tagging each record with its pillar shows how the result set splits between them.

### Example query

```
source logs, spans

| create pillar from pillar()

| countby pillar
```

### Example output

| pillar | \_count |
| ------ | ------- |
| logs   | 1204    |
| spans  | 317     |

## Example 3

**Use case: Keep only the records from one pillar**

Because `pillar()` is an expression, you can filter on it in the same query that produced the combined result set. Only the records from `spans` remain.

### Example data

```
{

    "service": "checkout",

    "duration": 890

}
```

### Example query

```
source logs, spans

| filter pillar() == 'spans'
```

### Example output

```
{

    "service": "checkout",

    "duration": 890

}
```