# Default labels

Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fdata-layer%2Fdefault-labels.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fdata-layer%2Fdefault-labels.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

On ingest, Coralogix adds three default labels to logs and spans: `$l.env`, `$l.envType`, and `$l.serviceName`. They sit next to the existing `$l.applicationName` and `$l.subsystemName` labels and use the same names on logs and spans, so one filter such as `$l.env == 'production'` works on both. Before these labels, the service and environment of a record sat in a different field depending on the source that sent it.

You don't need to set anything up. Coralogix fills the labels from fields your data already carries.

Note

Default labels are available in the EU2 region. Other regions will follow.

## What you need[​](#what-you-need "Direct link to What you need")

* Logs or spans ingested in a region where default labels are available. Records ingested before the labels reached your region don't carry them.

## How each label gets its value[​](#how-each-label-gets-its-value "Direct link to How each label gets its value")

For each label, Coralogix checks a list of sources in order and takes the first one that holds a non-empty value. If no source has a value, the record doesn't get that label.

### Logs[​](#logs "Direct link to Logs")

| Label            | Sources, in order                                                                                                                                                                                                                                             |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `$l.serviceName` | 1. The OpenTelemetry resource attribute `service.name` (or `service_name`)<br />2. The subsystem name (`$l.subsystemName`)                                                                                                                                    |
| `$l.env`         | 1. The OpenTelemetry resource attribute `deployment.environment.name` (or `deployment_environment_name`)<br />2. The deprecated resource attribute `deployment.environment` (or `deployment_environment`)<br />3. The application name (`$l.applicationName`) |
| `$l.envType`     | No default source                                                                                                                                                                                                                                             |

The underscore forms cover logs processed by the Coralogix OpenTelemetry extension packs, whose parsing rule replaces dots in field names with underscores. RUM events follow the logs sources.

### Spans[​](#spans "Direct link to Spans")

| Label            | Sources, in order                                                                                                                                                                                                   |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `$l.serviceName` | Unchanged. Spans already carry `$l.serviceName` from the span's process service name.                                                                                                                               |
| `$l.env`         | 1. The process tag `deployment.environment.name`<br />2. The span tag `deployment.environment.name`<br />3. The deprecated process tag `deployment.environment`<br />4. The application name (`$l.applicationName`) |
| `$l.envType`     | No default source                                                                                                                                                                                                   |

Because spans already used `$l.serviceName`, a log and a span from the same service now match on the same `$l.serviceName` value when the log carries `service.name` or a matching subsystem name.

### Environment type[​](#environment-type "Direct link to Environment type")

`$l.envType` is reserved for the type of environment. OpenTelemetry has no stable attribute for it, so Coralogix doesn't fill it from a default source and the label is empty on most records.

## Query default labels[​](#query-default-labels "Direct link to Query default labels")

Use the labels in DataPrime and Lucene queries the same way as any other label.

Find the error logs of one service in production:

```
source logs

| filter $l.serviceName == 'checkout' && $l.env == 'production'

| filter $m.severity == ERROR
```

Count logs per environment and service:

```
source logs

| countby $l.env, $l.serviceName
```

Filter spans by environment in Lucene:

```
$l.env:"production"
```

The labels are also available in TCO policy expressions, where `$l.env` and `$l.serviceName` apply to logs and `$l.env` applies to spans.

## Get accurate values[​](#get-accurate-values "Direct link to Get accurate values")

* Set `service.name` and `deployment.environment.name` as resource attributes in your OpenTelemetry instrumentation. These take priority over the application and subsystem names.
* If your OpenTelemetry SDK can't find a service name, it sends a default value such as `unknown_service`, and that value becomes `$l.serviceName`. Set `service.name` explicitly to avoid it.
* For data that doesn't come from OpenTelemetry, the labels follow your [application and subsystem names](https://coralogix.com/docs/user-guides/account-management/account-settings/application-and-subsystem-names.md): `$l.env` takes the application name and `$l.serviceName` takes the subsystem name.

## Related resources[​](#related-resources "Direct link to Related resources")

* [Access mechanisms](https://coralogix.com/docs/dataprime/language-reference/access_mechanisms.md)
* [How data is processed](https://coralogix.com/docs/user-guides/data-layer/data-processing.md)
* [Application and subsystem names](https://coralogix.com/docs/user-guides/account-management/account-settings/application-and-subsystem-names.md)