Data flow

Preview a TCO policy's impact before you save — The log policy form now includes a Preview panel that shows how your current filter and priority match recent data. See live Data sent and Total units estimates for the last 24 hours or 7 days, break matched data down by application, subsystem, and severity, and review volume and units over time. Learn more

Cap daily ingestion on system datasets — System datasets now support a per-dataset quota limit, set as a percentage of available daily quota or as an absolute CX Units value. Ingestion halts when the limit is reached and resumes at 00:00 UTC. Learn more

Route logs to user-defined datasets via TCO Optimizer — TCO policies now support a Target Dataset field. Select a user-defined dataset as the routing destination so logs matching your policy filters land in an isolated dataset instead of default/logs. Learn more

TCO Optimizer now supports DPXL expressions — Write TCO policies using DataPrime Expression Language (DPXL) to match on any log or trace field, including metadata, labels, and user data fields. The Builder remains available for common use cases and generates DPXL automatically. Priority levels are now named High (Frequent Search), Medium (Monitoring), and Low (Compliance) to reflect their storage model and use case. Learn more

Streaming enhancements and rule-filtering in the Pipeline Analyzer for clearer pipeline visibility. Learn more

Compare mode for Pipeline Analyzer. Learn more

Schema Manager — See if fields are fully mapped, unmapped, or partially mapped, right inside Schema Manager. Learn more

See inside your data with Pipeline Analyzer — Pipeline Analyzer gives you real-time visibility into your log pipeline. Instantly inspect logs as they're ingested, view parsing rules in execution order, and capture live log streams. Learn more

Take control with Quota Rules — Quota Rules let you set precise usage limits across your telemetry pipeline. Enforce automated blocks, control costs, prevent noisy data spikes. Learn more

Protect data cleanliness — Predefine field types, maintain structured data, and eliminate ingestion order dependencies for more accurate and efficient monitoring. Learn more

Integrate Coralogix with your data pipelines with Forwarders — Seamlessly send parsed and enriched log data from Coralogix to an external kafka cluster with Forwarders. Learn more

Custom log enrichment is now even more intuitive — Enrich logs from specific columns in your CSV file, download enriched files, and use them as data sources in DataPrime queries. Learn more

Log normalization for simplified data analysis — Leverage new log normalization feature to standardize keys for commonly occurring values across various security log types. Learn more

Set Multiple Retention Periods with Archive Tags — Control the length of archive retention for different groups of logs. Define different lifecycle policies in the Setup Archive page. View Documentation >. Learn more

New Parsing Rules — Introducing Stringify JSON Field and Parse JSON Field rules to parse escaped JSON values within a field to a valid JSON object and vice versa. Learn More >. Learn more