System datasets
System datasets live in the system dataspace. Coralogix creates and maintains them, and they record activity inside your Coralogix account, such as alert history, audit events, and quota consumption. They are read-only: you query them, but you can't write to them.
Enable a system dataset before you query it. In Data Flow, open Dataset Management, select the System tab, and turn on write access for the dataset.
| Dataset | Description |
|---|---|
aaa.audit_events | Audit trail of system activity for compliance and access monitoring. |
alerts.history | History of alert evaluations and trigger events. |
engine.queries | Historical record of user queries for introspection and optimization. |
engine.schema_fields | Tracks field-level schema evolution over time. |
labs.limitViolations | Records each time a configured limit is exceeded. |
notification.deliveries | Logs Notification Center delivery events. Alerts record delivery failures; Cases record both successful and failed deliveries. |
dataplan.quota_events | Stream of quota-related events, allocations, consumption, and threshold breaches. |
dataplan.usage_events | Aggregated team data usage events, after unit ratios are applied. |
Each dataset page describes the dataset and lists its fields. Every system dataset carries the same record envelope: engine metadata in $m, labels in $l, and the dataset-specific payload in $d. See Entity types for how the envelope works.
Query a system dataset
Reference a system dataset by its dataspace and name:
source system/engine.queries
All system datasets support full DataPrime functionality. You can filter, aggregate, group, and visualize them in Explore queries, Custom Dashboards, and automated reports. Their events count toward your daily quota, but volumes are typically small compared to your own data.
Next steps
- Learn how the
systemdataspace fits alongside your own data in Thesystemdataspace. - Manage access to system datasets in Dataset management.