dataplan.quota_events
The dataplan.quota_events dataset is a stream of quota-related events emitted by the platform — quota-definition changes, threshold breaches, ingestion blocks, Pay-as-you-go activations, and resets. Query it to track how your team's quota is allocated and consumed over time, and to investigate when and why limits are approached, exceeded, or reset.
Query the dataset
dataplan.quota_events is a system dataset maintained by Coralogix. Query it with DataPrime:
Like other system datasets, its events count toward your daily quota; volumes are typically small compared to your user data.
Schema description
Every event shares a common envelope and carries one event-type-specific payload, selected by $d.quotaEventType.
| Field | Type | Description |
|---|---|---|
$d.id | string (UUID) | Unique identifier for the event. |
$d.correlationId | string (UUID) | Correlation ID linking related events. |
$d.teamId | integer | The team the event belongs to. |
$d.actorDetails | object | Who or what triggered the event (actorType, and userId when applicable). |
$d.authDetails | object | null | Authentication details (authType), when applicable. |
$d.quotaEventType | string (enum) | Event-type discriminator. Determines which payload object is populated — see Event types. |
Event types
The value of $d.quotaEventType selects the populated payload object:
quotaEventType | Payload object | Description |
|---|---|---|
quotaDefChanged | $d.quotaDefChanged | A quota definition (entity-type allocation rule) was created, updated, or deleted, with before/after rule state. |
dataUsageThresholdReached | $d.dataUsageThresholdReached | A usage threshold (for example, the warning level) was reached for a team, entity type, or TCO policy. |
dataUsageBlocked | $d.dataUsageBlocked | Ingestion was blocked after quota was exhausted, for a team or entity type. |
payAsYouGoKickedIn | $d.payAsYouGoKickedIn | Pay-as-you-go overflow activated for a team or entity type. |
dataUsageReset | $d.dataUsageReset | A TCO-policy quota window was reset. |
Note
Each payload object carries extensive nested fields — quota allocations, used and limit units, Pay-as-you-go context, and TCO-policy details. For the complete per-event-type field definitions, see the dataset's schema in Coralogix's data catalog.
Example queries
Event count by type over the last 24 hours:
source system/"dataplan.quota_events"
| filter $m.timestamp > now() - 24h
| groupby $d.quotaEventType aggregate count() as events
| orderby events desc
Ingestion-block events for your team:
source system/"dataplan.quota_events"
| filter $d.quotaEventType == "dataUsageBlocked"
| choose $m.timestamp, $d.teamId, $d.dataUsageBlocked
Next steps
- Manage dataset access and ingestion in Dataset management.
- Analyze raw consumption with
dataplan.usage_events. - Review limit enforcement with
labs.limit_violations.