Pipeline Analyzer

In complex environments, logs often flow from multiple services, teams, and infrastructure. To handle this scale, many teams create customized processing pipelines—for security, compliance, observability, and more. These pipelines parse, enrich, and route logs based on TCO policies, enabling advanced monitoring and faster issue resolution.

But as environments grow, pipelines multiply, and misconfigurations, conflicting rules, or visibility gaps can lead to incorrect parsing, broken dashboards, and monitoring failures.

The Pipeline Analyzer is a no-code tool designed to solve these challenges. Use it to inspect logs in real time as they move through your pipelines, providing complete transparency into parsing, enrichment, and routing behavior.

With the Analyzer, teams can trace log processing flows in order to:

• Visualize the full processing flow of logs on demand.
• Compare raw and modified logs.
• Troubleshoot pipeline behavior with pinpoint accuracy.

How it works

As your logs enter Coralogix, they pass through multiple stages, including:

1. Parsing rules to extract structure
2. Enrichments to add context
3. TCO pipelines to optimize and route

At present, Pipeline Analyzer visualizes the parsing rule pipeline.

Start using Pipeline Analyzer

To get started, navigate to Data Flow, then Pipeline Analyzer.

Capture and filter logs on demand

Use filters to capture only logs that match your criteria:

• application
• subsystem
• severity
• regex

Only those logs meeting your filter criteria are streamed.

Inspect real-time log processing

Watch logs as they’re ingested—viewing every applied parsing rule. Select Play to start streaming logs in real time.

As logs appear in a stream, each shows:

• Timestamp
• List of applied rules
• Raw log content
• Modified log

Use Pause or Clear to stop or reset the stream.

Simulate parsing with raw logs

Double-click a log entry or select the arrow (▶) to view its raw and modified versions. This gives you a detailed view of how the log changes at each processing stage.

Paste a raw log sample into the Analyzer to test parsing behavior.

Hover over any ingested log to download the raw version.

View applied rules

Select one or more logs to view their applicable rules in the right-hand panel.

The parsing rule panel displays:

• All applicable rule groups
• The specific rules within each group
• The order of execution
• The option to Show only applied rules

Use the Drawer toggle to expand or collapse the Rule Panel.

Compare raw and parsed logs

Use Compare mode to see how parsing rules transform your logs. The view displays the raw log alongside the ingested log, allowing you to identify the changes that occurred during processing quickly.

View logs side by side

Compare mode opens a split view:

• The left panel shows the raw log exactly as it was received.
• The right panel shows the ingested log after parsing rules are applied.

Use this view to trace changes and confirm that your parsing rules work as intended.

Identify changes

Compare mode highlights differences between the two versions of the log so you can:

• Track added, removed, or modified fields and values.
• Verify how specific rules affected log content.
• Detect unexpected transformations or missing data.

You can view all changes or focus on a specific rule group.

Inspect rule-level transformations

To analyze rule-level changes:

• The left panel shows the log input before the rule is applied.
• The right panel displays the log output after the rule has run.

This comparison helps you validate parsing logic, troubleshoot issues, and confirm that rule order and behavior match your expectations.

Troubleshoot parsing and rule behavior

Using the Analyzer, you can instantly identify:

• Which pipelines and rules modified a specific log.
• Logs affected by a particular rule.
• How a specific rule changes a log.
• Parsing issues caused by overlapping rules or incorrect configurations.

Permissions

To use the Pipeline Analyzer, users need the following permission:

Resource	Action	Description
Analyzer	Read	View Pipeline Analyzer

See the full guide on roles and permissions.

Limitations

• Logs are not saved after you leave the page
• Each session is limited to 2,000 logs or 10 minutes—whichever comes first
• Currently supports parsing rules only (TCO and enrichment visibility coming soon)