Pipeline Analyzer

Our customers often operate in complex environments where logs flow in from a wide array of services, teams, and infrastructure. To handle this scale, many teams create customized processing pipelines—for security, compliance, observability, and more. These pipelines parse, enrich, and route logs based on TCO policies, enabling advanced monitoring and faster issue resolution.

But as environments grow, pipelines multiply, and misconfigurations, conflicting rules, or visibility gaps can lead to incorrect parsing, broken dashboards, and monitoring failures.

The Pipeline Analyzer is a no-code tool designed to solve these challenges. It lets you inspect logs in real time as they move through your Coralogix pipelines, providing complete transparency into parsing, enrichment, and routing behavior.

With the Analyzer, teams can trace log processing flows in order to:

Visualize the full processing flow of logs on demand.
Compare raw and modified logs.
Troubleshoot pipeline behavior with pinpoint accuracy.

How it works

As your logs enter Coralogix, they pass through multiple stages, including:

Parsing rules to extract structure
Enrichments to add context
TCO pipelines to optimize and route

At present, Pipeline Analyzer visualizes the parsing rule pipeline.

Getting started

To get started, navigate to Data Flow > Pipeline Analyzer.

Capture and filter logs on demand

Use filters to narrow your focus by:

application
subsystem
severity
regex

Only those logs meeting your filter criteria are streamed.

Inspect real-time log processing

Watch logs as they’re ingested—viewing every applied parsing rule. Click Play to start streaming logs in real time.

As logs appear in a stream, each shows:

Timestamp
List of applied rules
Raw log content
Modified log

Use Pause or Clear to pause or reset the stream.

Simulate parsing with raw logs

Click on the arrow > or double-click any log entry to view the full raw and modified versions of the log. This gives you a detailed view of how the log changes at each processing stage.

You can also test how logs are parsed by pasting raw log samples directly into the Analyzer.

Hover over any ingested log to download the raw version.

Inspect applied rules

Select one or more logs to view their applicable rules in the right-hand panel.

The parsing rule panel displays:

All applicable rule groups
The specific rules within each group
The order of execution
The option to Show only applied rules

Use the drawer toggle button to expand or collapse the rule panel.

Troubleshoot parsing and rule behavior

Using the Analyzer, you can instantly identify:

Which pipelines and rules modified a specific log.
Logs affected by a particular rule.
How a specific rule changes a log.
Parsing issues caused by overlapping rules or incorrect configurations.

Permissions

To use the Pipeline Analyzer, users need the following permission:
Resource Action Description
Analyzer Read View Pipeline Analyzer

See the full guide on roles and permissions.

Limitations

Logs are not saved after you leave the page
Each session is limited to 2,000 logs or 10 minutes—whichever comes first
Currently supports parsing rules only (TCO and enrichment visibility coming soon)

Archive Retention Policy

Next Schema Management