Skip to content
Open in ChatGPT Open in Claude

Deprecation of TCO overrides

Published: October 5, 2025

Effective: March 31, 2026

Deprecation notice

To simplify cost controls and eliminate duplicate concepts, Coralogix is deprecating the TCO overrides feature, which will no longer be accessible in the TCO Optimizer API or the TCO Optimizer UI for logs. During the hybrid phase, existing override endpoints remain functional, and your override rules continue to apply.

After the cutoff date, overrides will no longer be available. All existing override rules will appear as standard TCO policies at the top of the Log policies table and will execute before more general policies—preserving current behavior.

Action is required for some users (see audience-specific guidance below).

Why this is happening

TCO now uses a single, consistent mechanism - policies - to route logs by business value across tiers (High, Medium, Low, Blocked) and to apply archive retention. Maintaining a parallel “override” concept created confusion, doubled the surface area for automation, and risked drift between UI, API, and Terraform.

What’s changing

  • The TCO Optimizer Override API will be deprecated. Calls continue to work during the hybrid phase and then will return errors after the cutoff date.
  • The Overrides table in the UI is being retired. During the hybrid phase it remains visible; after the cutoff, it is removed. Each existing override will be represented as a standard TCO policy with the same matching conditions (application, subsystem, severity), priority, and archive retention. Converted items appear at the top of Log policies and run first.

What you need to do

Choose the path that matches how you manage TCO today.

Exclusive UI users

During the hybrid phase

Migrate overrides in bulk from the Overrides table:

  1. Select one or more override rows. Use the header checkbox to select every row at once.
  2. Select Convert to policy to migrate the selected overrides into log policies, or Delete to remove them.
  3. Confirm the action in the dialog box that appears.

Each converted override is removed from the Overrides table and recreated as a policy with the same conditions, priority, and archive retention. The new policies appear at the top of Log policies and run before broader rules. Conversion cannot be reversed.

The delete dialog shows how many rows are being removed and warns that deletion is permanent.

If a bulk action succeeds for some rows but fails for others — for example, when a quota or fair-use limit is reached — a results dialog lists the rules that failed and why. Re-run the action on the failed rows once the limit is resolved.

If you lack permission to manage TCO policies, the Convert to policy and Delete buttons stay disabled and a tooltip explains the missing access. All bulk conversions and deletions are recorded in the audit log.

Note: If you take no action, at the end of the hybrid phase, all existing override rules will appear as standard TCO policies at the top of the Log policies table and will execute before more general policies, preserving the current behavior.

When to delete vs convert overrides

  • If the override priority equals the fallback priority (the priority that would apply without the override), you can safely delete the override.
  • Otherwise, convert it to preserve behavior.

After the cutoff

  • The Overrides table is removed. Any remaining overrides will appear automatically as policies at the top of Log policies.

API users (using the TCO Overrides API)

What’s affected

Any use of the following endpoints will stop functioning after the cutoff date:

  • GET /overrides: https://api.<domain>.coralogix.com/api/v1/external/tco/overrides
  • GET /overrides/{id}: https://api.<domain>.coralogix.com/api/v1/external/tco/overrides/<id>
  • POST /overrides: https://api.<domain>.coralogix.com/api/v1/external/tco/overrides
  • POST /overrides/bulk:https://api.<domain>.coralogix.com/api/v1/external/tco/overrides/bulk
  • PUT /overrides/bulk: https://api.<domain>.coralogix.com/api/v1/external/tco/overrides/bulk
  • DELETE /overrides/{id}: https://api.<domain>.coralogix.com/api/v1/external/tco/overrides/<id>
  • DELETE /overrides/bulk: https://api.<domain>.coralogix.com/api/v1/external/tco/overrides/bulk

After the cutoff, calls to Overrides endpoints fail; policies continue to work.

Terraform-only users

No changes are required.

FAQs

Will performance or features change?

No. The conversion preserves behavior. Features by tier remain the same (for example, High supports Lightning Queries, Medium supports monitoring and alerts, Low supports archival and retrieval).

What happens if my override conflicts with an existing policy?

Order resolves conflicts. Converted overrides appear as policies at the top of Log policies and run first.

What if I do nothing?

At cutoff, overrides are converted to top-ordered policies automatically in the UI. Find out more here.

Need help?

Reach out via in-app chat or contact your Technical Account Manager. We’re happy to review your current overrides and propose equivalent policies and order.

Need help? Contact Support.
What's new? Find out here.
LLM? Read llms.txt.