FAQs

How does monitoring infrastructure entities impact data usage?

Data usage meters reflect the total number of event updates received from all OpenTelemetry collectors. Usage is proportional to the number of updates, but the exact proportion depends on your infrastructure size and configuration.

What are infrastructure events? Are they the same as Kubernetes events?

Infrastructure events include updates from a range of sources such as Kubernetes and AWS. These are not limited to Kubernetes events and are represented as agg_events(all_resources) in Coralogix, where resource can include events from Kubernetes, AWS, and others.

How are infrastructure events correlated to Kubernetes entities?

They are not directly correlated. Infrastructure events are updates fetched by different OpenTelemetry collectors. If multiple collectors send the same update, each instance is counted toward usage.

What does it mean when I see “X events per day”?

This number represents the total infrastructure updates (from Kubernetes, AWS, etc.) collected across all your configured collectors. Duplicate events from different collectors are not de-duplicated.

If my limit is set to X active items, what happens when the limit is exceeded?

New incoming items will be blocked and dropped once the configured active item limit is reached.

Which entries are dropped when the limit is exceeded?

The newest entries (those not yet sent or processed) are dropped first.

How do I know if any entries were dropped due to limits?

The platform will display a limit breached message when entries are dropped because of a resource cap.

How can I filter out unwanted entities from ingestion?

Use filter statements and transform statements in your OpenTelemetry configuration, specifically in the kubernetesResources preset of the Coralogix Helm chart.

Here’s an example configuration:

opentelemetry-cluster-collector:
  presets:
    kubernetesResources:
      enabled: true
      filterStatements:
        # Filter out specific namespaces
        - 'body["metadata"]["namespace"] != "kube-system"'
        # Filter out specific resource types
        - 'body["kind"] != "Event"'
        # Filter pods by name pattern
        - 'body["kind"] != "Pod" or not IsMatch(body["metadata"]["name"], ".*test.*")'
        # Filter out managed pods
        - 'body["kind"] != "Pod" or not IsMatch(String(body["metadata"]["ownerReferences"]), ".*StatefulSet.*|.*ReplicaSet.*|.*Job.*|.*DaemonSet.*")'
      transformStatements:
        # Remove specific labels
        - 'delete_key(body["metadata"]["labels"], "kubernetes.io/arch")'

For more advanced filtering, refer to the official OTTL documentation and Coralogix Helm chart.

If I block entities in my OpenTelemetry config, does data usage reflect that?

Yes, if entities are blocked at the collector level, they are not sent to Coralogix, and your data usage meters will reflect the reduced event count. For more information, see Advanced Configurations.