Command reference
Full flag reference for each command. Run cx <command> --help for inline help, or cx schema for a machine-readable JSON tree agents can consume directly.
Global options
These apply to every command.
| Flag | Default | Description |
|---|---|---|
-p, --profile <NAME> | default profile | Profile to use. Repeat to fan out across multiple profiles: -p prod -p staging. |
--api-key <KEY> | from profile | Override the profile API key for this invocation. Also read from CX_API_KEY. |
--region <REGION> | from profile | Override the profile region (e.g. eu2, us1). |
-o, --output <FORMAT> | text | Output format: text, json, or toon. Use toon for agent consumption. |
--yes | — | Skip confirmation prompts for destructive operations. Required in non-interactive terminals for risky commands. |
--read-only | — | Block all write operations. Safe to give to an agent that should not modify resources. |
--no-console-link | — | Suppress the "View in Coralogix" console link printed after some operations. |
Risky commands
cx iam, cx archive, and cx ai-center require explicit confirmation before write operations. In a non-interactive terminal (CI, coding agents), pass --yes or the command fails with:
This operation requires confirmation but stdin is not a terminal. Pass --yes to skip the confirmation prompt.
Subcommands that need --yes are tagged [requires --yes] in their help text.
The global setting allow_risky_commands in ~/.cx/config.toml controls whether these commands are available at all. cx init sets this during onboarding; change it by editing the file directly.
Query commands
cx logs
Query logs using DataPrime syntax.
cx logs '<dataprime-query>'
| Flag | Default | Description |
|---|---|---|
--start <TIME> | now-1h | Start of the query window. See Time syntax. |
--end <TIME> | now | End of the query window. |
--limit <N> | 100 | Maximum number of results. |
--tier <TIER> | profile default_tier, or archive | Storage tier: frequent, monitoring, or archive. Overrides the profile default for this invocation. |
source logs is the implicit default — the query string does not need to include it. To target a different source use cx dataprime query with an explicit source directive.
cx logs 'filter $m.severity == ERROR'
cx logs 'filter $d.message ~ "timeout"' --start now-6h --tier archive
cx logs 'filter $l.applicationname == "api"' --limit 200 -o json
cx spans
Query distributed spans using DataPrime syntax.
cx spans '<dataprime-query>'
| Flag | Default | Description |
|---|---|---|
--start <TIME> | now-1h | Start of the query window. |
--end <TIME> | now | End of the query window. |
--limit <N> | 200 | Maximum number of results. Note the higher default than cx logs. |
--tier <TIER> | profile default_tier, or archive | Storage tier. |
source spans is automatically prepended to the query if not already present.
cx spans 'filter $d.traceID == "abc123"'
cx spans 'filter $l.serviceName == "checkout"' --start now-2h --limit 50
cx spans 'groupby $l.operationName aggregate avg($m.duration) as avg_latency'
cx metrics
Query metrics using PromQL.
cx metrics query
Instant query (single point in time).
cx metrics query '<promql-expr>'
| Flag | Default | Description |
|---|---|---|
--time <TIMESTAMP> | now | Evaluation instant (Unix timestamp or RFC 3339). |
cx metrics query 'up'
cx metrics query 'rate(http_requests_total[5m])' --time 2026-03-21T00:00:00Z
cx metrics query-range
Range query (time series).
cx metrics query-range '<promql-expr>'
| Flag | Default | Description |
|---|---|---|
--start <TIME> | now-1h | Range start. |
--end <TIME> | now | Range end. |
--step <DURATION> | 1m | Query resolution, e.g. 30s, 5m. |
cx metrics query-range 'rate(http_requests_total[5m])'
cx metrics query-range 'sum by (service) (rate(http_requests_total[5m]))' --start now-6h --step 30s
cx metrics search
Search available metric names.
| Flag | Description |
|---|---|
--name <PATTERN> | Substring or wildcard pattern (* matches any sequence). Conflicts with --description. |
--description <TEXT> | Semantic search using embeddings. Conflicts with --name. |
cx metrics search --name 'http_*'
cx metrics search --description "request error rate"
cx metrics get-labels
cx metrics get-labels <METRIC>
Returns all label names for the named metric.
cx dataprime
DataPrime language reference and raw queries.
cx dataprime list
List available DataPrime commands and functions.
| Flag | Default | Description |
|---|---|---|
--filter <TYPE> | all | Filter by type: commands, functions, or all. |
--name <PATTERN> | — | Substring match on name. |
cx dataprime show
cx dataprime show <NAME>
Show detailed documentation for a DataPrime command or function.
cx dataprime query
Execute a raw DataPrime query without an implicit source.
cx dataprime query '<dataprime-query>'
| Flag | Default | Description |
|---|---|---|
-s, --source <SOURCE> | — | Default source (logs, spans). Ignored if the query already contains an explicit source command. |
--start <TIME> | now-1h | Start of the query window. |
--end <TIME> | now | End of the query window. |
--limit <N> | 100 | Maximum results. |
--tier <TIER> | profile default or archive | Storage tier. |
Unlike cx logs and cx spans, no source is prepended automatically. Either include source <X> in the query or pass --source.
cx dataprime query 'source logs | filter $m.severity == "ERROR"'
cx dataprime query --source logs 'filter $m.severity == ERROR'
cx dataprime query --source spans 'filter $m.duration > 1000000' --start now-6h
cx search-fields
Find log or span fields by description or by value content.
cx search-fields '<text>'
| Flag | Default | Description |
|---|---|---|
-s, --search-type <TYPE> | semantic | semantic — description-based search (what does the field represent?). value — search by field value content (what values does the field hold?). |
--dataset <DATASET> | logs | logs or spans (semantic mode); logs, spans, or all (value mode). |
--limit <N> | 10 | Maximum results. |
--offset <N> | 0 | Results to skip. Only used with -s value for pagination. |
cx search-fields "http response status code"
cx search-fields "error severity level" --dataset spans --limit 10
cx search-fields "payment" -s value --dataset logs
cx search-fields "kubernetes pod" -s value --dataset all --limit 20 --offset 10
cx olly
Interact with the Olly AI assistant.
cx olly ask
cx olly ask '<message>'
| Flag | Default | Description |
|---|---|---|
--chat-id <UUID> | — | Continue an existing chat session. Omit to start a new one. The UUID is returned in the first response. |
--model <NAME> | gpt-5.2 | Model to use, e.g. claude-sonnet-4-5, claude-haiku-4-5, gpt-5.4. |
--timeout <SECONDS> | 900 | Response timeout. |
--agent-to-agent-mode | — | Pass when calling from an LLM or agent. Produces shorter responses without charts or tables, and asks clarifying questions rather than guessing. |
Single-profile only — cx olly ask does not support multi-profile fan-out.
cx olly ask "What alerts fired today?"
cx olly ask "Show me error logs" --chat-id <uuid>
cx olly ask "Find errors in the last 6 hours" --agent-to-agent-mode
cx olly artifacts
cx olly artifacts list
cx olly artifacts get <ARTIFACT-ID>
get returns the download URL for an artifact produced by an olly ask response.
Management commands
All management commands follow the same CRUD pattern. Mutation subcommands tagged [requires --yes] in their help text need --yes in non-interactive terminals.
Common patterns
Read JSON from a file or stdin
Most create and update subcommands accept --from-file:
cx alerts create --from-file alert.json # from file
cat alert.json | cx alerts create # from stdin (default when --from-file is omitted)
cx alerts create --from-file - # explicit stdin
Get before update
The standard round-trip for in-place edits:
cx dashboards get <id> -o json > dash.json
# edit dash.json ...
cx dashboards replace --from-file dash.json --yes
cx alerts
| Subcommand | Description |
|---|---|
list [--name <PATTERN>] | List all alerts. Optional case-insensitive name filter. |
get <ALERT-ID> | Get an alert by definition ID or alert version ID. Both are tried. |
create --from-file <FILE> | Create from JSON. [requires --yes] |
delete <ALERT-ID> | Delete an alert. [requires --yes] |
enable <ALERT-ID> | Enable an alert. [requires --yes] |
disable <ALERT-ID> | Disable an alert. [requires --yes] |
events [--alert-version-id <ID>] [--start] [--end] | List alert trigger events. --alert-version-id is repeatable. |
event-stats | Show aggregate alert event statistics. |
suppression-rules list | List suppression rules. |
suppression-rules get <ID> | Get a suppression rule. |
suppression-rules create --from-file | Create a suppression rule. [requires --yes] |
suppression-rules update --from-file | Update a suppression rule. [requires --yes] |
suppression-rules delete <ID> | Delete a suppression rule. [requires --yes] |
cx cases
| Subcommand | Description |
|---|---|
get <CASE-ID> | Get a case. Accepts UUID or readable ID (e.g. CASE-123). |
update <CASE-ID> [--title] [--resolution-reason] | Update mutable fields. |
comment <CASE-ID> --text <TEXT> | Add a comment. |
assign <CASE-ID> --user <EMAIL|ID> | Assign to a user. Accepts email address (resolved via team directory) or raw user ID. |
unassign <CASE-ID> | Remove the assignee. |
acknowledge <CASE-ID> | Acknowledge a case. |
unacknowledge <CASE-ID> | Remove the acknowledgment. |
resolve <CASE-ID> [--reason <TEXT>] [--no-reason] | Resolve (irreversible). Prompts for a reason interactively; --no-reason omits it. |
close <CASE-ID> | Close a case. |
set-priority <CASE-ID> --priority <P1..P5> | Override computed priority. |
clear-priority <CASE-ID> | Remove the priority override. |
events list <CASE-ID> | List the case event timeline. |
events get <EVENT-ID> | Get a single case event. |
notifications <CASE-ID> [<CASE-ID>...] | List notification deliveries for one or more cases. |
resolve is irreversible. Omitting --reason in a non-interactive terminal is an error unless --no-reason is passed.
cx dashboards
| Subcommand | Description |
|---|---|
catalog | List all dashboards. |
get <DASHBOARD-ID> | Get a dashboard by ID. |
create --from-file <FILE> [--folder <FOLDER-ID>] | Create from JSON. Accepts bare dashboard or {"dashboard":{...}} wrapper. [requires --yes] |
replace --from-file <FILE> | Replace in-place; JSON must include the id field. [requires --yes] |
check [--from-file <FILE> | <DASHBOARD-ID>] | Validate without saving. Exits non-zero on error-severity issues. |
delete <DASHBOARD-ID> | Delete. [requires --yes] |
search <DESCRIPTION> | Semantic search by natural-language description. --limit (default 10). |
query-search [--field <PATH> | --description <TEXT>] | Find dashboards whose queries reference a field path or match a description. |
folders list | List dashboard folders. |
folders create --name <NAME> [--parent-id <ID>] | Create a folder. [requires --yes] |
folders delete <ID> | Delete a folder. [requires --yes] |
cx notifications
| Subcommand | Description |
|---|---|
connectors list | List notification connectors. |
connectors get <ID> | Get a connector. |
connectors create --from-file | Create. [requires --yes] |
connectors update --from-file | Replace. [requires --yes] |
connectors delete <ID> | Delete. [requires --yes] |
connectors types | List connector type summaries. |
connectors entity-types | List entity types. |
connectors entity-subtypes --type <TYPE> | List entity subtypes. |
routers list / get / create / update / delete | Manage notification routers. |
routers validate-matcher --from-file | Test entity label matcher. |
presets list / get / create / update / delete | Manage notification presets. |
presets set-default <ID> | Set the default preset. [requires --yes] |
test connector / destination / preset / routing-condition / template-render | Test notification configurations. All read --from-file. |
cx webhooks
| Subcommand | Description |
|---|---|
list | List outgoing webhooks. |
get <ID> | Get a webhook. |
create --from-file | Create. [requires --yes] |
update --from-file | Update. [requires --yes] |
delete <ID> | Delete. [requires --yes] |
test <ID> | Send a test delivery to the webhook. |
types | List supported webhook types. |
actions list / get / create / update / delete / batch / reorder | Manage automation actions. |
cx views
| Subcommand | Description |
|---|---|
list | List saved views. |
get <ID> | Get a view. |
create / update / delete | CRUD. [requires --yes] for write operations. |
folders list / get / create / update / delete | Manage view folders. |
cx slos
| Subcommand | Description |
|---|---|
list | List SLO definitions. |
get <SLO-ID> | Get an SLO. |
create --from-file | Create from JSON. [requires --yes] |
update --from-file | Update. [requires --yes] |
delete <SLO-ID> | Delete. [requires --yes] |
cx tco
| Subcommand | Description |
|---|---|
list | List TCO policies. |
get <ID> | Get a policy. |
create / update / delete / reorder | CRUD and priority reordering. All mutations [require --yes]. |
test --from-file | Test policy matching against a JSON payload. |
settings | Show TCO settings. |
settings-update --from-file | Replace settings. [requires --yes] |
cx retentions
| Subcommand | Description |
|---|---|
list | List retention settings. |
update --from-file | Update. [requires --yes] |
status | Show retention status. |
cx e2m
Events2Metrics definitions.
| Subcommand | Description |
|---|---|
list | List E2M definitions. |
get <ID> | Get a definition. |
create / update / delete | CRUD. Mutations [require --yes]. |
labels-cardinality | Show label cardinality. |
limits | Show E2M limits. |
cx recording-rules
Prometheus recording rule groups.
| Subcommand | Description |
|---|---|
list | List all groups. |
get <GROUP-ID> | Get a group. |
create --from-file | Create. [requires --yes] |
update --from-file <GROUP-ID> | Update. [requires --yes] |
delete <GROUP-ID> | Delete. [requires --yes] |
cx parsing-rules
| Subcommand | Description |
|---|---|
list | List parsing rule groups. |
get <GROUP-ID> | Get a group. |
create / update / delete | CRUD. Mutations [require --yes]. |
bulk-delete | Delete multiple groups from a JSON list. [requires --yes] |
usage-limits | Show parsing rule usage limits. |
cx enrichments
| Subcommand | Description |
|---|---|
list | List enrichment rules. |
add --from-file | Add enrichments. [requires --yes] |
remove --from-file | Remove enrichments. [requires --yes] |
overwrite --from-file | Overwrite all enrichments. [requires --yes] |
limit | Show enrichment limits. |
settings | Show enrichment settings. |
custom list / get / create / update / delete / search | Manage custom enrichment tables. Mutations [require --yes]. search accepts --query <TEXT>. |
cx integrations
| Subcommand | Description |
|---|---|
list | List deployed integrations. |
get <ID> | Get a deployed integration. |
definition <ID> | Get an integration definition (the template). |
deployed | List all deployed integrations (alias for list). |
create / update / delete | CRUD. [require --yes]. |
test <ID> | Test a deployed integration. |
template | Get the raw integration template. |
extensions list / get / deployed / deploy / update / undeploy | Manage extensions. Deploy/update/undeploy [require --yes]. |
contextual-data list / get / create / update / delete / definition / test | Manage contextual data sources. Mutations [require --yes]. |
cx usage
| Subcommand | Description |
|---|---|
summary [--start] [--end] | Data usage overview. Defaults to last 24h. |
daily --type <TYPE> [--start] [--end] | Daily breakdown. --type: processed-gbs, units, or evaluation-tokens. |
logs-count [--start] [--end] [--resolution] [--subsystem-aggregation] [--application-aggregation] | Logs count over time. |
spans-count [--start] [--end] [--resolution] [--subsystem-aggregation] [--application-aggregation] | Spans count over time. |
capabilities | List labels, measurements, and limits for the Data Usage Query API. |
query --from-file <FILE> | Run a capabilities-derived usage query. Build request from capabilities -o json. |
export-status | Show data export status. |
logs-count and spans-count output is normalized to a single object; large backend responses arriving as multiple JSON chunks are merged automatically.
cx archive
Data archive storage configuration. [risky] — write operations require --yes.
| Subcommand | Description |
|---|---|
metrics get | Get metrics archive configuration. |
metrics create / update / enable / disable | Manage metrics archive. All [require --yes]. |
metrics validate --from-file | Validate a metrics archive config without saving. |
logs get | Get logs archive configuration. |
logs set --from-file | Set logs archive configuration. [requires --yes] |
cx iam
IAM management. [risky] — write operations require --yes.
| Subcommand | Description |
|---|---|
api-keys list / get / create / update / delete | Manage API keys. |
api-keys send-data-keys | List send-data (ingestion) keys. |
api-keys admin list / delete / set-status | Admin-level key management. |
roles list / get / create / update / delete / system | Manage roles. system lists built-in roles. |
scopes list / get / create / update / delete | Manage scopes. |
users search [--query] [--email] [--limit] | Search team members. |
users get <ID> | Get a user. |
users create / update / set-status | Manage users. |
groups list / get / get-by-name / users / create / update / delete | Manage team groups. |
ip-access get / create / update / delete | Manage IP access rules. |
cx ai-center
AI Center (GenAI). [risky] — write operations require --yes.
| Subcommand | Description |
|---|---|
applications list [--limit] [--application] [--subsystem] | List applications. |
applications get <ID> | Get an application. |
evaluations list / get / create / update / delete | Manage evaluations. |
custom-evaluations list / list-for-application / create / update / add / remove | Manage custom evaluations. |
coverage | Show AI Center coverage. |
model-pricing get / set --from-file | Get or update model pricing. set [requires --yes]. |
cx infra
| Subcommand | Description |
|---|---|
resources types | List resource types grouped by category. |
resources list --category <CAT> --type <TYPE> | List resources. |
resources health-history | Get health history for resources. |
resources raw-data | Get raw resource data. |
cx infra resources types
cx infra resources list --category Hosts --type EC2_Instances
cx service-catalog
Service-catalog v2: RED metrics, health, resource saturation.
| Subcommand | Description |
|---|---|
entity-types | List available entity types. |
schema <ENTITY-TYPE> | Get the schema for an entity type. |
entities <ENTITY-TYPE> | List entities of a type. |
data <ENTITY-TYPE> --start --end [--column <COL>] | Get time-series data for all entities of a type. |
entity-data <ENTITY-TYPE> <ENTITY-NAME> --start --end [--column <COL>] | Get time-series data for a single entity. |
cx service-catalog entity-types
cx service-catalog schema service
cx service-catalog entities service
cx service-catalog data service --start now-1h --end now --column latency_p99
cx service-catalog entity-data service checkout --start now-1h --end now --column latency_p99
cx docs
Search and fetch official Coralogix product documentation (not live tenant data).
| Subcommand | Description |
|---|---|
search <QUERY> [--limit <N>] | Search docs by title or path. --limit 1–20, default 5. Returns path suffixes. |
fetch <SUFFIX> | Fetch one page as Markdown. Use the path suffix returned by search, not a full URL. |
cx docs search "explore spans" --limit 5
cx docs fetch user-guides/data_exploration/spans/
cx completions
Shell tab completion.
| Subcommand | Description |
|---|---|
install <SHELL> | Install completion for bash, zsh, fish, or powershell. |
refresh | Re-install completions (use after upgrading cx). |
generate <SHELL> | Print the completion script to stdout without installing. |
cx completions install zsh
cx completions refresh
See Advanced configuration for shell-specific setup details.
Last updated on