Dynamic Widget

The Dynamic Widget in Coralogix Custom Dashboards automatically analyzes your query results and suggests visualizations based on the shape of the data. Instead of starting with a fixed chart type, you first define the query you are interested in, and the widget recommends the most relevant visualizations for your results.

Start with your data, not your chart

When you first add a Dynamic Widget, it opens in a table view showing raw data in JSON format. This initial state serves as your starting point before you apply query filters, grouping, or aggregation. From there, the widget displays additional suggested visualizations, such as bar charts, pie charts, gauges, line charts, or heatmaps. Whenever you adjust your query, the Dynamic Widget re-analyzes the results and updates the list of recommended visualizations.

This approach ensures that the visualization options always match your data’s shape, reducing trial-and-error and making it faster to find the best way to present your results.

Create a dynamic widget

1. In Custom Dashboards, select Add Widget.

2. Drag and drop the Dynamic widget into your dashboard.

   By default, the widget will open with a table view of your data in JSON entries.

3. Build your query in DataPrime or with the Query Builder.

   The widget automatically analyzes:

   • Dimensions (string fields)
   • Values (numeric or aggregable fields)
   • Aggregation types you’ve applied
   • Select from the suggested visualizations based on your query.
   • Adjust your query or groupings to explore more visualization options. The Dynamic Widget ****updates recommendations in real time.
   • Configure additional settings for your chosen visualization in the widget panel (e.g., thresholds, unit precision, stacking options).
   • Select Save changes to add the widget to your dashboard.

After saving, you can change the visualization at any time by selecting the widget and selecting Suggest visualizations to view other chart types for your query.

Example use case

After you add a new Dynamic Widget to your dashboard, you can explore a complete example that analyzes peaks in network request volume and response size using a data table. For the full walkthrough, see Build a Dynamic Table Widget.

Format results in table view

The table view is the initial visualization in the Dynamic Widget. It adapts automatically to the data returned by your query and lets you choose how the data is displayed and formatted.

The table view detects all available fields from your query results so you can decide which ones to display as columns, set their order, and format their values.

• Shape-based and dynamic: The table layout adapts to the structure of your query results.
• Schema-driven: Take fields and data types from your query and use them to define available columns.
• User-defined formatting: You control column visibility, order, and style rather than using preset chips or field types.

Add and organize columns

Select which fields to display, in what order, and how each field is represented.

Use these features to turn raw query results into a clear, readable table.

Expand the COLUMNS section in the widget settings panel to select or clear fields you want to show as columns.

• Use the search bar to quickly locate fields for adding as columns.
• Drag and drop to reorder columns in the Selected columns list or the table header.

Control column display with rules

Rules let you apply shared properties—such as thresholds, alignment, or units—to multiple columns at once.

Use rules to define how multiple columns behave or appear.

1. Expand the RULES LIST in the settings panel and select Add rule.
2. Give the rule a clear, descriptive name that reflects its effect on the columns.
3. Select which columns the rule applies to. Selecting by Name targets a single column, while Regex and Type match all columns that fit the pattern or data type.
4. Add one or more properties to control formatting, alignment, units or value display.

To remove a rule, select Delete in the rule's more actions menu.

Define rule properties

Each rule can include one or more properties. Properties control how values are formatted, aligned, labelled, or transformed in the table.

Thresholds

Color or label numeric values by range.

Use this when:

You want to notice quick visual cues and patterns.

Example:

Color k8_container_restarts_restart values as

• 0–50 = Greed (good)
• 51–80 = Yellow (warning)
• 81+ = Red (critical)

Column alignment

Align text left, center, or right.

Use this when:

You want consistent alignment across many fields.

Example:

Right align numeric columns.

Units

Append symbols or convert numeric values using preset units (e.g, ms, %, or MB) or define a custom unit at the end of the units list.

Units let you control how numeric values are displayed. They include:

• Decimal places: Set how many decimal places are shown.
• Precision: When enabled, show full, unabridged value. Disable to abbreviate and append with a unit type (e.g, 1.2Kb). Disabled by default.
• Percentage modes:
  • 0-1: Treat values as fractional percentages
  • 0-100: Treat values as whole-number percentages
  • %(Min-Max): Calculate values based on the range you define

Use this when:

You want to convert raw numeric values into readable units.

Example:

Goal: Show http_resp_bytes in bytes with 2 decimal places.

Setup: Disable Precision, set Decimal to 2, set Units to Bytes

Result: 1027 → 1.01KiB

Regex extract

Define a regular-expression capture group to display only the portion of a value you want. The table shows the captured group instead of the full original string.

Use this when:

You need to shorten long identifiers and keep only the meaningful segment.

Example: Extract only the IP portion of a hostname

Value:

ip-192-168-0-1.us-east-1.compute.internal

Regex:

ip-(?<val>[^\.]+)

Display value:

192-168-0-1

Explanation: The regex finds the ip- prefix and captures only the numeric sequence of numbers and hyphens (the ip-block), using a named capture group called value . Only the captured portion appears in the table.

Value alias

Replace the entire displayed value with a simpler label or interpolated value.

Use this when:

You want to rename or simplify a specific value without regex.

Example:

Replace the value payment-service-v3 with payments.

Value mapping

Map exact values or regex-matched values to custom labels for display.

Use this when:

You want to adjust how values are displayed in the table, including null or missing fields.

Example:

• Map 500 to Server Error
• Map null values (leave Value field blank) to "N/A"
• Map regex pattern ^5/d/d$ to replace 5xx status codes with Server Error

Custom Actions

Add a clickable link in the cell’s […icon] more actions menu to trigger custom actions. The link can open another Coralogix view or an external system, using values from that cell.

Use this when:

• You want to jump to another part of Coralogix while preserving context from the table.
• You want to open external tools or applications populated with data from that cell.

Example:

https://example.com/?service={{$l.subsystemname}} 

To build custom links, see Create and Manage Custom Actions.

Delete properties

To remove a rule property, hover over the property, and then select Delete property.

Preview and review applied rules

Each rule displays the number of columns it applies to in the RULES LIST.

• If a rule applies to one to three columns, their names appear directly in the tooltip.
• If a rule applies to more, the tooltip displays “Applied to N columns.”

Data limits in Dynamic Widgets

Dynamic Widgets display up to 2,000 records per query result. If a query returns more than 2,000 records, the widget shows a Partial Data notice. The widget includes only the first 2,000 rows returned.

To analyze or export the complete result set, narrow the time range or apply filters to reduce the number of returned records.

Understanding projected and unprojected queries

Some queries return all fields from your dataset, while others return only the fields produced by your query logic. This affects which columns you can manage in the table.

Projected vs. unprojected queries:

• Unprojected queries expose all available fields in your dataset.
• Projected queries show only the fields defined by your query.

Unprojected queries

Unprojected queries return raw records with all available fields. This appears as full JSON entries in the table. Most log queries with filters are unprojected.

For example:

source logs | filter $d.http_resp_status == 500 

This query returns a table containing all fields from the matching log records.

Projected queries

Projected queries return a reshaped dataset produced by grouping, aggregating, or joining records.

For example:

source logs 
| filter $m.severity == ERROR 
| groupby $l.applicationname aggregate count() 

This query returns one row per applicationname with a count of error logs. Since the grouping and aggregation define the output fields, the table can display only the applicationname and count columns.

What creates a projected query?

Projected queries result from grouping, aggregating, joining, or applying any transformation that reshapes the original records. The query defines the final set of columns.

Effect on column management 

When a query is projected, the COLUMNS section in the widget settings is locked. You can still apply rules to the fields returned by the query, but you can’t add new columns from the UI. Any new fields must be introduced in the query.

Visualization recommendations

The Dynamic Widget automatically suggests other visualizations that fit your data, such as:

• Bar, line, or area charts for time series or grouped metrics
• Pie or donut charts for categorical proportions
• Gauge or single-value metrics for key KPIs

To switch visualizations anytime without rebuilding your query, select Suggest Visualizations.

Export the widget to CSV

You can export any Dynamic Widget visualization as a comma-separated-values (CSV) file. The export contains the same data the widget displays, organized into a simple table so you can use it in external tools or share results with your team.

The CSV reflects the data produced by your query after grouping, filtering, and aggregation:

• If your widget groups results by service and status code, the exported file includes those columns along with the aggregated values. For example with this DataPrime query:

  source logs | groupby $l.subsystemname, $m.severity aggregate count()
  

• If your widget uses a raw unprojected query—without any grouping or aggregation—the CSV flattens each field in the JSON data into it’s own column, and each row represents one event.

To export widget data: Open the widget’s more actions menu and select Export widget to CSV.

Related resources

• Query Builder
• Create a Dynamic Table
• Custom Actions