Understanding logs - Coralogix Docs

Skip to content

Search /

Initializing search

Coralogix Docs

Search /

Home
Home
- Home
User guides
User guides
- User guides
- What's new
  What's new
- Getting started
  Getting started
  - Quick reference
  - Features tour
  - Common questions
  - Troubleshooting
  - Packages and extensions
    Packages and extensions
    Integration packages
    Quick-Start extensions
- Data flow
  Data flow
  - Forwarders
  - Archive
    Archive
    Amazon S3
    GCS
    Archive retention policy
  - Pipeline Analyzer
- Dataspaces & datasets
  Dataspaces & datasets
- Explore
  Explore
  - Select a data source
  - Search
  - Query builder
  - Fields
  - Tabs, views, and queries
  - Explore actions
  - Custom actions
  - Query with DataPrime
  - Visualize
  - Shared URLs
  - Query parameters
  - Query URLs
  - Explore logs
    Explore logs
    Logs grid
    Log details panel
    Export log data
  - Log Templates
  - LiveTail
  - Explore spans
    Explore spans
    Concepts
    Getting started
    Getting started
    Explore common components
    Spans, Traces, and Flows
    Query builder for spans
    Fields for spans
    Span drilldown
    Span drilldown
    Visualize spans and traces
    Span fields and attributes
    Span related data
    Headers and quick actions
    Highlights
    Exploring async trace calls with OTel link
  - Explore metrics
    Explore metrics
    Browse metric labels and values
  - Visual explorer
    Visual explorer
    Tabs
- Data transformation
  Data transformation
  - Data enrichment
    Data enrichment
    Unified Threat Intelligence
    Geo enrichment
    AWS resource enrichment
    Custom enrichment
    Lookup tables
  - Parsing
    Parsing
    Log Parsing Rules
    Parsing rule types
    Rules cheat sheet
    Auto JSON parsing
    JSON stringify
    Parse JSON field
  - Log normalization
  - Dynamic blocking
- Data query
  Data query
  - Archive query
    Archive query
    Access CX-Data directly
    Archive query from the explore screen
    Import archived logs
  - Background Queries
    Background Queries
    Save results as Datasets
  - Log query
    Log query
    Log query - simply retrieve your data
    Cross-team query
    Querying Coralogix with SQL
  - Relational queries
  - Highlights
    Highlights
    Tracing
    RUM
- Monitoring and insights
  Monitoring and insights
  - Synthetic monitoring
    Synthetic monitoring
    Synthetic monitoring with Checkly
    Synthetic monitoring with Telegraf
  - Setting up your Lambda function metrics dashboard
  - Mapping statistics
  - Version Benchmarks
- Continuous Profiling
  Continuous Profiling
- Fleet Management
  Fleet Management
- SLO
  SLO
  - Introduction
  - Create SLOs
    Create SLOs
    APM
    Custom
    Custom
    Event-Based SLOs
    Time window SLOs
    Preview and validate SLOs
  - Accurate SLO evaluation
  - View and manage SLOs
  - SLO alerts
  - Permissions
  - Using the underlying SLO metrics
  - SLO management API
  - Infrastructure as code
- APM
  APM
  - Getting started
    Getting started
    APM onboarding
    Span metrics
    Span metrics
    Quick start
    Recommended configurations
    Cardinality limiting
    Using compact span metric
    Migration from event2metrics to span metrics
    Aligning Coralogix and OTel naming conventions
  - Features
    Features
    Service Catalog
    Service Catalog
    Service health
    Service health
    Alert-based service health
    Policy-based service health
    Profiles catalog
    Service SLOs
    Analyze
    API error tracking
    Transactions
    Dependencies
    Dependencies
    View database queries
    View external calls
    Apdex score
    Group by service version
    Service Map
    Serverless monitoring
    Database monitoring
    Environment filter
    Monitoring with alerts
    Comparison mode
- RUM
  RUM
  - Getting started
    Getting started
    Real User Monitoring
    RUM integration package
  - SDK installation
    SDK installation
    Overview
    Android
    Apple
    Apple
    iOS
    tvOS
    JavaScript
    JavaScript
    CDN browser SDK installation guide
    NPM browser SDK installation guide
    Next.js
    SvelteKit
    Flutter
    Flutter
    Mobile
    Web
    React Native
    React Native
    React Native plugin
    React Native SDK
  - SDK features
    SDK features
    Trace exporter
    Anonymous users
    Analyzing header and payload data
    Web worker support
    Custom logs
    Micro frontend error tracking
    Measuring memory usage
    Trace capturing
    Custom spans
    Enhance & manage browser RUM data with beforeSend
    DOM navigation indications
    RUM conditional error sampling
    Customized timing
    Configure your browser RUM data proxy
    Custom measurements
    Label provider
    Intercept & control RUM events with URL blueprinting
    Data privacy and logging settings
    Ignore errors
    Capturing errors
    Source maps
    Source maps
    JavaScript
    React Native
    Flutter
  - Product features
    Product features
    RUM overview
    Error tracking with Olly Mini
    Measurements
    Monitoring RUM network call performance
    User measurements
    User action and error screenshots
    RUM saved views
    Session replay
    Session replay
    Web
    iOS
    Flutter
    Android
    React Native
    Error tracking
    Error tracking: user manual
    Error template view
    Error analytics
    User sessions
    Core Web Vitals
    Mobile performance
    Versions
  - CLI
    CLI
    RUM CLI
    Uploading debug symbols: iOS
  - Querying RUM logs
- Infrastructure
  Infrastructure
  - Infrastructure explorer
    Infrastructure explorer
    Infrastructure explorer
    Kubernetes dashboard vs infrastructure explorer
    Getting started
    Getting started
    Kubernetes
    Kubernetes
    Set up with minikube
    Deploy OpenTelemetry demo app
    Getting started with Kubernetes monitoring
    Kubernetes enrichment options
    Host
    Host
    Getting started with host monitoring
    Host data enrichments
    Configure applications to send telemetry
    Explore your infrastructure
    Explore your infrastructure
    Search and filter
    Saved views in Infrastructure Explorer
    Health overview
    Health policy
    Manage infrastructure health rules
    Ownership
    Compare infrastructure configuration changes
    View lifecycle events
    Data management
    Data management
    Data usage
    Data limits
    Permissions
    FAQs
- Olly
  Olly
  - Enable Olly
  - Olly chat
  - Features
    Features
    Olly modes
    Model selection
    Rules
    Custom skills
    Dynamic tables and export
    File attachments
  - Capabilities
    Capabilities
    Autonomous agent
    DataPrime query assistance
    Explain log
    Knowledge assistance
  - Integrations
    Integrations
    GitHub
    Slack
  - Olly pricing and usage
  - Data processing, privacy, and compliance
  - Olly FAQs
- AI observability & guardrails
  AI observability & guardrails
  - Getting started
  - Integrations for LLM observability
  - OpenTelemetry integration
    OpenTelemetry integration
    Provider compatibility
    Framework compatibility
    Span attribute inventory
    Code examples
  - Monitoring
    Monitoring
    Monitor your applications
    AI Explorer
    Code agents observability
    AI Center alerts and metrics
  - Guardrails
    Guardrails
    Getting started
    Prebuilt policies
    Prebuilt policies
    Prompt injection
    PII
    Toxicity
    Custom guardrail policies
    Guard API
  - Evaluations
    Evaluations
    Prebuilt evaluation policies
    Custom evaluation policies
  - AI SPM
  - Pricing
  - Permissions
  - FAQs
  - Classic ML observability
- MCP server
  MCP server
  - Setup
  - OAuth
  - Tools
    Tools
    Overview
    Logs and traces
    Metrics
    Real User Monitoring
    Alerts and incidents
    Reference
    Alerts
    Parsing Rules
  - Permissions
  - Limitations
- Alerting
  Alerting
  - Introduction to alerts
  - Create alerts
    Create alerts
    Configure an alert definition
    Configure an alert definition
    Metrics-based query
    Alert types
    Alert types
    Logs
    Logs
    Anomaly detection alerts
    Dataset alerts
    Immediate notifications
    New value alerts
    Ratio alerts
    Threshold alerts
    Time relative alerts
    Unique count alerts
    Metrics
    Metrics
    Anomaly detection alerts
    Custom webhooks: metric alerts
    Threshold alerts
    Traces
    Traces
    Tracing alerts
    Flow alerts
    Define alert details
    Create alert conditions
    Log2Metric alert
  - Manage alerts
    Manage alerts
    Alert definition management
    Alert definition management
    No-Data handling for alerts
    Saved views in Alerts
    Alert Suppression Rules
    Alert aggregation
  - Advanced configuration
    Advanced configuration
    Custom evaluation delay
    Customizing anomaly detection alert sensitivity
    Lucene query builder
    Lucene query builder
    Alert query behavior
  - Notifications
    Notifications
    Notification settings
    Alerts as a notification source type
    Outbound webhooks
    Outbound webhooks
    Configure alert notifications for outbound webhooks
    Send log outbound webhooks
    Email group outbound webhooks
    Generic outbound webhooks (alert webhooks)
    Create alerting email Templates with Coralogix
    Alert webhook with GCP Chat
    Slack outbound webhooks
    Jira outbound webhooks
    Opsgenie outbound webhooks
    Alert webhook with VictorOps
    Microsoft Teams outbound webhooks
    PagerDuty outbound webhooks
    Workflow-based Microsoft Teams outbound webhooks
    AWS EventBridge outbound webhook
    Zenduty
  - Monitor and respond
    Monitor and respond
    Alert drill-down view
    Alerts map
    Incidents
    Coralogix reporter
  - Troubleshoot alerting
- Cases
  Cases
  - Cases vs Incidents
  - Set up Cases
  - Working with Cases
    Working with Cases
    Explores from a Case
    Cases saved views
  - Cases analytics
  - Settings and integrations
    Settings and integrations
    Case settings
    Cases ServiceNow integration
    Slack integration
- Visualizations
  Visualizations
- Custom Dashboards
  Custom Dashboards
- Investigations
  Investigations
- Notification Center
  Notification Center
  - Quick start
  - Concepts
    Concepts
    Entity types
    Notification concepts
  - Routing
    Routing
    Alert routing labels
    Create a router
    Define routing rule
    Condition templating
  - Connectors and destinations
    Connectors and destinations
    Connectors
    Destination types
    Destination types
    HTTPS
    HTTPS
    Connector configuration
    Message configuration
    OpsGenie and JSM configuration via HTTPS
    Incident.io configuration via HTTPS
    PagerDuty
    PagerDuty
    Connector configuration
    Message configuration
    Slack
    Slack
    Slack integration
    Connector configuration
    Message configuration
    Email
    Email
    Connector configuration
    Message configuration
    ServiceNow
  - Message customization
    Message customization
    Presets
    Presets
    Message rendering
    Preset creation
    Dynamic templating
    Dynamic templating
    Tera syntax
    Tera usage
  - User scenarios
    User scenarios
    Slack routing
    PagerDuty routing
  - Permissions
- Security
  Security
  - Security data sources
    Security data sources
    Okta contextual logs
    PingSafe
    Cloudflare data ingestion
    FortiGate
  - Cloud Security Posture Management (CSPM)
    Cloud Security Posture Management (CSPM)
    Downloading your security report
    GCP Security Posture Management (CSPM)
    AWS Cloud Security Posture Management (CSPM)
    Azure Cloud Security Posture Management (CSPM)
- Metrics
  Metrics
  - Metric usage analysis
    Metric usage analysis
    Variations
    Labels
    Explore tab
  - Query usage analysis
    Query usage analysis
    Live error logs
  - Query drilldown
  - Metrics cost optimizer
  - Optimize metrics costs in Coralogix by adjusting your scrape interval
  - Recording Rules
  - Metrics API
  - Events2Metrics
- Account management
  Account management
  - Access control
    Access control
    Permissions
    Permissions
    Permissions list
    Policies
    Scopes
  - Account settings
    Account settings
    Application and subsystem names
    Coralogix domain
    General settings
    IP access control
    Notifications preferences
    Session length
    Team ID
  - API keys
    API keys
    API keys
    Send-Your-Data API key
  - Fair usage
    Fair usage
    Ingestion & query limits
    Metrics
    Infrastructure
  - Organization management
    Organization management
    Organizational grouping
    Create an organization
    Manage admins
    Quota manager
    Organization settings
  - Payment and billing
    Payment and billing
    Data usage metrics
    Plan and payments management
    Pay-As-You-Go
    Quota management
    Quota Rules
    Data usage
    Data Usage settings panel
  - TCO Optimizer
  - User management
    User management
    Teams
    Teams
    Create teams
    Manage teams
    Manage team members
    Groups
    Groups
    Create and manage groups
    Secure login
    Secure login
    OAuth 2.1
    MFA
    SSO
    SCIM
    Multi-SAML for SSO
- Troubleshooting
  Troubleshooting
  - Coralogix Audit
  - Troubleshoot data collection with Coralogix
- Data privacy
  Data privacy
  - Handling PII and sensitive data
DataPrime
DataPrime
- DataPrime
- Welcome to DataPrime
- User guide
  User guide
- Cookbook
  Cookbook
  - ⏱️ working with time
    ⏱️ working with time
    Parsing date strings
    Create variables for timestamp calculations
    Convert a timestamp
  - 🔍 filtering & searching
    🔍 filtering & searching
    metadata vs. data field
    Fuzzy search all fields
    Accessing fields with special characters
  - 📊 counting & aggregation patterns
    📊 counting & aggregation patterns
    Count and sort events
    Conditionally count logs
    Find peak traffic
  - 🧱 Infrastructure use cases
    🧱 Infrastructure use cases
    Count k8s container restarts
    Summarize container restarts
  - ⚙️ Application-level use cases
    ⚙️ Application-level use cases
    Bucket longtask durations into performance ranges
    Calculate Lambda function invocation duration
  - 🔌 System dataset use cases
    🔌 System dataset use cases
    Count schema changes over time
    Audit schema field types and values by dataset
    Monitor dataset schema changes for compliance
    Count queries using joins by team
    Group failed queries by failure type
    Find heavy DataPrime queries
- API
  API
- Language reference
  Language reference
  - Types
  - Access mechanisms
  - Limitations
  - Commands reference
    Commands reference
    Sources
    Sources
    source
    Time
    Time
    around
    between
    last
    timeshifted
    aggregate
    block
    bottom
    choose
    convert
    count
    countby
    create
    dedupeby
    distinct
    enrich
    explode
    extract
    filter
    find / text
    groupby
    multigroupby
    join
    limit
    lucene
    move
    orderby / sortby
    redact
    remove
    replace
    stitch
    top
    union
    wildfind / wildtext
  - Functions reference
    Functions reference
    Aggregration
    Aggregration
    any_value
    approx_count_distinct
    avg
    collect
    count_if
    distinct_count_if
    distinct_count
    max
    max_by
    min
    min_by
    percentile
    sample_stddev
    sample_variance
    stddev
    sum
    variance
    Array
    Array
    arrayAppend
    arrayConcat
    arrayContains
    arrayInsertAt
    arrayJoin
    arrayLength
    arrayRemove
    arrayRemoveAt
    arrayReplaceAll
    arrayReplaceAt
    arraySort
    arraySplit
    cardinality
    inArray
    isEmpty
    isSubset
    isSuperset
    setDiff
    setDiffSymmetric
    setEqualsTo
    setIntersection
    setUnion
    Case
    Case
    case
    case_contains
    case_equals
    case_find
    case_greaterthan
    case_lessthan
    General
    General
    firstNonNull
    if
    in
    recordLocation
    IP
    IP
    ipInSubnet
    ipPrefix
    Number
    Number
    abs
    ceil
    e
    floor
    fromBase
    ln
    log
    log2
    mod
    pi
    power
    random
    randomInt
    round
    sqrt
    toBase
    String
    String
    byteLength
    chr
    codepoint
    concat
    contains
    decodeBase64
    encodeBase64
    endsWith
    indexOf
    length
    ltrim
    matches
    pad
    padLeft
    padRight
    regexpSplitParts
    rtrim
    splitParts
    startsWith
    substr
    textSearch
    toLowerCase
    toUpperCase
    trim
    Time
    Time
    Specifying timestamp formats
    addInterval
    addTime
    diffTime
    extractTime
    formatInterval
    formatTimestamp
    fromUnixTime
    multiplyInterval
    now
    parseInterval
    parseTimestamp
    parseToTimestamp
    roundInterval
    roundTime
    subtractInterval
    subtractTime
    timeRound
    toInterval
    toIso8601DateTime
    toUnixTime
    URL
    URL
    urlDecode
    urlEncode
    UUID
    UUID
    isUuid
    randomUuid
    uuid
Integrations
Integrations
- Integrations
- Getting started
- Quick-Start extensions
- Coralogix endpoints
  Coralogix endpoints
  - Coralogix endpoint updates and deprecations
- AI observability
  AI observability
  - AI discovery
    AI discovery
    GitHub app for AI discovery
  - LLM providers and frameworks
    LLM providers and frameworks
    Anthropic
    Amazon Bedrock
    Gemini
    Google ADK
    LangChain
    LangGraph
    LiteLLM