`pillar`

Description

Return the pillar that a record belongs to. DataPrime queries three pillars, so the value is logs, spans, or data.

A pillar is the broadest grouping of Coralogix data. It says what kind of data a record is. Every dataset belongs to exactly one pillar, and every entity type sits under one pillar, so several entity types can share a pillar. See Pillars and the entity types within them for the full list.

This is especially useful when a query reads more than one source, for example with `union` or a multi-dataset `source`, and you need to know which pillar each record came from. A query built from a list of dataset names, by a person or by an AI agent, doesn't always know in advance what kind of data each dataset holds. pillar() answers that per record, in the result itself.

pillar() works on Archive data and on Frequent Search data. It returns null after an aggregation such as groupby, countby, or aggregate, because an aggregated row no longer comes from a single source, and when the source of a record can't be resolved. To keep the value, compute it before you aggregate, or group by it.

Note

For the finer-grained classification inside a pillar, see `entityType`. Together with `dataspace`, `dataset`, and `recordLocation`, these functions describe where every record comes from.

Syntax

pillar(): string

Example 1

Use case: See where each record in a multi-source query comes from

Take one record from each of three sources and return only its origin. Each row reads from the outside in: the dataspace holds the dataset, the dataset holds data of one pillar and one entity type, and `recordLocation` points to the archive file the record was read from. Logs and engine queries share the logs pillar but differ in entity type.

Example query

source logs
| limit 1
| union (source spans | limit 1)
| union (source system/engine.queries | limit 1)
| choose
    dataspace() as dataspace,
    dataset() as dataset,
    pillar() as pillar,
    entityType() as entityType,
    recordLocation() as archive_file

Example output

dataspace	dataset	pillar	entityType	archive_file
default	logs	logs	logs	`s3://<bucket>/cx/parquet/v1/team_id=<team_id>/dt=2026-10-08/hr=07/<file>.parquet`
default	spans	spans	spans	`s3://<bucket>/cx/spans/parquet/v1/team_id=<team_id>/dt=2026-10-08/hr=07/<file>.parquet`
system	engine.queries	logs	engineQueries	`s3://<bucket>/cx/format=wide-parquet-v1/dataspace=system/dataset=engine.queries/version=1/team_id=<team_id>/...`

Rows can come back in any order. For records read from Frequent Search, archive_file is null, because those records aren't read from archive files.

Example 2

Use case: Count records per pillar in a multi-source query

A query that reads both logs and spans returns records from two pillars. Tagging each record with its pillar shows how the result set splits between them.

Example query

source logs, spans
| create pillar from pillar()
| countby pillar

Example output

pillar	_count
logs	1204
spans	317

Example 3

Use case: Keep only the records from one pillar

Because pillar() is an expression, you can filter on it in the same query that produced the combined result set. Only the records from spans remain.

Example data

{
    "service": "checkout",
    "duration": 890
}

Example query

source logs, spans
| filter pillar() == 'spans'

Example output

{
    "service": "checkout",
    "duration": 890
}

Last updated on October 20, 2026