Open in ChatGPTOpen in Claude

Errors and warnings

When you run a query in Explore, Coralogix tells you whether it ran cleanly. Two outcomes need your attention:

• Error: the query fails and returns no results.
• Warning: the query succeeds and returns results, along with advisories about how it ran.

Errors and warnings work the same way whether you explore Logs or Spans, and whether you query in Builder or DataPrime. Explore shows an error in red and a warning in yellow, with the message so you can resolve it.

Errors

An error means the query can't run, so Explore returns no results. Correct the cause and run the query again. Common causes:

• Invalid query syntax: Explore can't compile the Builder configuration or DataPrime expression. The message identifies the problem so you can correct the flagged part. For example:
  • DataPrime: Unexpected token 'and' at position 42
  • Builder: Filter value required for field "status"
• Query timeout: the query ran too long to return results. Narrow the time range or make the query more selective.
• Rate limit reached: too many queries ran in a short period. Wait a moment, then run the query again.
• Resources exhausted: the query compiled but needed more memory or compute than allowed — typically from high-cardinality aggregations or wide field selections. Reduce the number of fields, aggregation buckets, or the time range.

Warnings

A warning means the query ran and returned results, but something about how it ran is worth knowing. The results shown are valid for what Explore was able to return. Common warnings:

• Partial results: the query reached a result or scan limit, such as a row cap or an aggregation-bucket cap, so the results are a subset. Narrow the query or time range to see the full picture.
• No data available: the query is valid, but no data matches for the selected time range. Adjust the query or widen the time range.
• Missing fields: a field referenced in the query doesn't exist in the schema of the queried dataset. Check the field path for typos, or confirm the field exists in this dataset. A field that exists but has no matching values is different: the Fields Panel shows "No values found" for it, and no warning appears.
• Unindexed fields read from raw data: the query reads fields that aren't indexed, which might slow it down. Reserve those fields to speed up future queries.

Speed up queries that read unindexed fields

Coralogix indexes fields as it ingests them. When a query references a field that isn't indexed, Coralogix reads it from the raw event data, which might slow the query down. Explore then surfaces a performance warning that names the affected datasets and fields and points you to reserve them.

Unindexed-fields warning

Performance warning: the following fields were not indexed in some of the files queried, so some entries required raw data parsing:

default/logs : host.name

To avoid this, ask a team admin to reserve these fields in Schema Manager. Learn more

To clear the warning, reserve the listed fields so Coralogix maps them on ingestion and future queries read them from the index. Reserving fields requires manage access, so ask a team admin to reserve them in Schema Manager.

A team admin reserves the fields as follows:

1. Open Schema Manager.
2. Select the dataspace and dataset named in the warning.
3. Open Reserved fields.
4. Add the fields listed in the warning to the reserved list.

Reserved fields apply to newly ingested data, so the warning clears for later queries over that data. For details, see Adding reserved fields.

Note

The same performance warning appears in Custom Dashboards when a widget query reads unindexed fields. Reserve the fields the same way.

Related resources

• Reserved fields — reserve the fields a query reads from raw data.
• Schema management — discover and govern the structure of your ingested data.
• Overview tab — where query warnings surface alongside the results chart.