Explore query parameters

Explore V2 query parameters let you open the Explore screen directly into a specific query, time range, dataset, or saved view. Instead of opening Explore V2 and configuring the search by hand, you construct a URL with parameters that loads with the query, time range, dataset, and filters already applied.

What you need

To open a URL built with query parameters, you must be signed in to a Coralogix account on the same domain as the URL. If you do not have access to the dataset or saved view referenced in the URL, the link returns a permission error.

URL parameters

Build the URL

https://<team>.<domain>/#/explore/logs?<parameters>

Replace <team> with your Coralogix team subdomain and <domain> with your region (for example, eu2.coralogix.com).

Build a URL with URL Builder

If you would rather not type parameters by hand, use URL Builder from the Explore actions menu in the top-right corner of the Explore screen.

URL Builder opens a form where you select the parameters from a list, set their values, and copy the resulting URL.

Use URL Builder when you want to:

• Compose a URL without remembering the parameter names or syntax.
• Add or remove parameters quickly to experiment with different combinations before settling on the final URL.
• Validate that the parameters you set produce a working URL before sharing.
• Generate URLs from a runbook template or alert webhook payload without manually URL-encoding values.

The URL that URL Builder generates is identical to one you would write by hand using the parameters in the table above. After copying, paste it into your runbook, ticket, dashboard tooltip, or webhook payload.

URL Builder versus Copy URL

The Explore actions menu also has a Copy URL option. The two are for different jobs:

• Use Copy URL to share the exact view you are looking at right now. The URL captures the current query, filters, time range, and saved view.
• Use URL Builder to compose a URL from scratch with parameters you choose, including parameters not currently active in your view.

Pick a URL pattern

Two primary patterns cover most use cases.

Static query URL

Construct a query entirely through URL parameters. Best for runbooks, scripts, alert webhooks, and integrations where you want predictable, repeatable behavior.

Generic syntax:

https://<team>.<domain>/#/explore/logs?queryType=<lucene|dataprime>&query=<query>&preset=<preset>

For example, open today's error logs in Lucene syntax:

https://acme.coralogix.com/#/explore/logs?queryType=lucene&query=severity:error&preset=today

Saved view with filter overlay

Load a saved view as a base, then narrow it with a filter using appendFilter. Best when teams maintain a shared saved view (such as an APM errors view) and individuals need to focus on a specific service or host.

Generic syntax:

https://<team>.<domain>/#/explore/logs?viewId=<saved_view_id>&appendFilter=<key>:<value>

For example, narrow a saved view of APM errors (viewId=123) to a specific service:

https://acme.coralogix.com/#/explore/logs?viewId=123&appendFilter=coralogix.metadata.subsystemName:ws-service-catalog

Examples by product

Real User Monitoring

Find error events in a specific environment. Opens Explore V2 with the last 15 minutes of RUM error events (cx_rum.event_context.severity:5) from a specific environment.

Generic syntax:

https://<team>.<domain>/#/explore/logs?preset=last-15-minutes&queryType=lucene&query=cx_rum.event_context.severity:5 AND cx_rum.environment:<environment>

For example:

https://acme.coralogix.com/#/explore/logs?preset=last-15-minutes&queryType=lucene&query=cx_rum.event_context.severity:5 AND cx_rum.environment:cx498

Open all session activity for a specific session. Filters logs to a single RUM session over the last 15 minutes.

https://acme.coralogix.com/#/explore/logs?preset=last-15-minutes&queryType=lucene&query=cx_rum.session_context.session_id:"00760ea8-1562-40fc-964e-b4213c2e2b72"

APM

Filter logs to a specific service. Filters today's logs by subsystemName, the Coralogix metadata field representing a service.

https://acme.coralogix.com/#/explore/logs?preset=today&queryType=lucene&query=coralogix.metadata.subsystemName:"ws-service-catalog"

Infrastructure

Open Kubernetes cluster errors. Filters logs to errors in a specific cluster.

https://acme.coralogix.com/#/explore/logs?queryType=lucene&query=resource.attributes.k8s_cluster_name:"cx498" AND severity:"ERROR"

Traces

Open logs related to a specific trace from a trace drilldown. Filters logs to a specific trace ID and warning level.

https://acme.coralogix.com/#/explore/logs?queryType=lucene&query=trace_id.keyword:"40f7fcf2945d459a94a7a599a3935bf3" AND level.keyword:"WARN"

Encode special characters in the URL

When a query contains spaces, quotes, or other special characters, the browser encodes those characters automatically when the URL loads. For example, the query:

severity:"ERROR" AND host:"prod"

May appear in the address bar as:

query=severity:"ERROR"%3aAND%3ahost:"prod"

This is expected. The browser converts reserved characters into a percent-encoded form so the URL stays valid, and Coralogix decodes the value on the receiving end. You do not need to do anything.

If you are constructing a URL programmatically, use your language's standard URL-encoding function:

• JavaScript: encodeURIComponent
• Python: urllib.parse.quote
• Go: url.QueryEscape

Best practices

A few patterns help you build URLs that work the first time and stay useful over time.

Pick the right time parameter

Use only one time parameter per URL. The available options:

• preset for always-current snapshots: today, yesterday, last-15-minutes. Best for runbooks and recurring queries.
• relativeTime for rolling windows: last-15-minutes, last-1-hour. Best for monitoring and ongoing investigations.
• from and to for absolute Unix timestamps in milliseconds. Best for incident postmortems, audit trails, and any link that should always show the same time range regardless of when it is opened.

Combining these can produce unexpected results. Pick one approach per link.

Use viewId for stable views and appendFilter for one-offs

If your team maintains a public saved view that everyone uses (for example, a "production errors" view), share its viewId rather than rebuilding the same query in every URL. When you need to add a one-off filter on top of that saved view, use appendFilter instead of duplicating the saved view.

URL-encode when constructing programmatically

When you build URLs in a script or runbook generator, use your language's URL-encoding function so spaces, quotes, and other special characters are handled consistently.

Confirm permissions before sharing

The recipient must be signed in to a Coralogix account on the same domain and must have access to the dataset and saved view referenced in the URL. If you share with users outside your team, confirm their access first.

Test the link before sharing

Open the URL in a private window or another browser profile to confirm it loads the expected query, time range, and filters. Catching a typo before sharing saves a round of "the link does not work" follow-ups.

Use it in your workflows

Explore V2 query parameters reduce friction in any workflow that takes someone to a filtered view of their data. Common places to use them:

• Runbooks in PagerDuty, Opsgenie, or Incident.io. Replace "open Coralogix and search for X" with a one-click link that opens Coralogix already filtered to the affected service and time window.
• Slack and Microsoft Teams alert notifications. Add a "View logs" button to alert webhook payloads so responders open Explore V2 with the alert's labels and evaluation window pre-applied.
• Status pages and customer-facing transparency. Link from an internal status page to a saved view that shows live error rates for a specific service.
• Cross-team handoffs in Jira and GitHub. Paste a URL into a ticket or pull request so the recipient lands on the same view you are looking at, without describing how to reproduce the search.
• CI and CD pipeline failure reports. Have a failing build script post a deep link to the logs from that deploy window.
• Custom Dashboards drilldowns. Embed URLs in dashboard tooltips so a chart can drill down to its underlying logs.
• Customer support escalations. Share a pre-filtered link from a support ticket to engineering instead of attaching screenshots.
• Internal wikis in Notion or Confluence. Embed live, pre-filtered links to Coralogix queries instead of static screenshots that go stale.
• Automation scripts and integrations. Construct links programmatically in any workflow that takes a user to specific telemetry.

Troubleshoot

Learn more

• Lucene query reference
• DataPrime reference guide
• Explore actions
• Export log data

Support

Reach the Coralogix customer success team 24/7 via in-app chat or by email at [email protected].

Next steps

Share the exact view you are looking at right now with the Copy URL action in Explore actions.