Default labels
On ingest, Coralogix adds three default labels to logs and spans: $l.env, $l.envType, and $l.serviceName. They sit next to the existing $l.applicationName and $l.subsystemName labels and use the same names on logs and spans, so one filter such as $l.env == 'production' works on both. Before these labels, the service and environment of a record sat in a different field depending on the source that sent it.
You don't need to set anything up. Coralogix fills the labels from fields your data already carries.
Default labels are available in the EU2 region. Other regions will follow.
What you need
- Logs or spans ingested in a region where default labels are available. Records ingested before the labels reached your region don't carry them.
How each label gets its value
For each label, Coralogix checks a list of sources in order and takes the first one that holds a non-empty value. If no source has a value, the record doesn't get that label.
Logs
| Label | Sources, in order |
|---|---|
$l.serviceName | 1. The OpenTelemetry resource attribute service.name (or service_name)2. The subsystem name ( $l.subsystemName) |
$l.env | 1. The OpenTelemetry resource attribute deployment.environment.name (or deployment_environment_name)2. The deprecated resource attribute deployment.environment (or deployment_environment)3. The application name ( $l.applicationName) |
$l.envType | No default source |
The underscore forms cover logs processed by the Coralogix OpenTelemetry extension packs, whose parsing rule replaces dots in field names with underscores. RUM events follow the logs sources.
Spans
| Label | Sources, in order |
|---|---|
$l.serviceName | Unchanged. Spans already carry $l.serviceName from the span's process service name. |
$l.env | 1. The process tag deployment.environment.name2. The span tag deployment.environment.name3. The deprecated process tag deployment.environment4. The application name ( $l.applicationName) |
$l.envType | No default source |
Because spans already used $l.serviceName, a log and a span from the same service now match on the same $l.serviceName value when the log carries service.name or a matching subsystem name.
Environment type
$l.envType is reserved for the type of environment. OpenTelemetry has no stable attribute for it, so Coralogix doesn't fill it from a default source and the label is empty on most records.
Query default labels
Use the labels in DataPrime and Lucene queries the same way as any other label.
Find the error logs of one service in production:
source logs
| filter $l.serviceName == 'checkout' && $l.env == 'production'
| filter $m.severity == ERROR
Count logs per environment and service:
source logs
| countby $l.env, $l.serviceName
Filter spans by environment in Lucene:
$l.env:"production"
The labels are also available in TCO policy expressions, where $l.env and $l.serviceName apply to logs and $l.env applies to spans.
Get accurate values
- Set
service.nameanddeployment.environment.nameas resource attributes in your OpenTelemetry instrumentation. These take priority over the application and subsystem names. - If your OpenTelemetry SDK can't find a service name, it sends a default value such as
unknown_service, and that value becomes$l.serviceName. Setservice.nameexplicitly to avoid it. - For data that doesn't come from OpenTelemetry, the labels follow your application and subsystem names:
$l.envtakes the application name and$l.serviceNametakes the subsystem name.