Data flow
TCO Optimizer: default RUM priority
TCO Optimizer Settings now include a Default RUM priority, alongside the defaults for logs and traces. The priority you choose is pre-filled when you create a RUM policy, including policies created from RUM statistics. It does not change existing policies, and you can still select another priority in the editor. Unless you change it, the default stays Medium. Learn more
TCO Optimizer: Metrics
Accounts with early access get a Metrics entry in the TCO Optimizer's left navigation. Statistics shows each metric's and APM service's share of usage for a selected day, and you can select the costly ones and block them, on the same screen as logs, traces, and RUM. Each blocked metric or service becomes its own block policy, which you delete to ingest it again. The Overview page now includes metrics. Contact your Coralogix account representative to request access. Learn more
TCO overrides: end-of-life date moved to November 30, 2026
The end-of-life date for TCO log overrides is now November 30, 2026. Until then, the Overrides table and the Overrides API keep working, and you can convert overrides to log policies in bulk. After that date, any remaining overrides become top-ordered log policies automatically. Learn more
TCO Optimizer: side navigation, shared filters, and grouped statistics
The TCO Optimizer now has a collapsible left navigation with an Overview page and an entry for each data type, Logs, Traces, and RUM, each showing its number of policies. Filters moved from the tables into the navigation: one set per data type, shared by its Policies and Statistics views. In Statistics, Group by lets you pick several fields at once and groups the grid into expandable rows. Learn more
TCO Optimizer: quota-based thresholds use the data type's allocation
Quota-based policy thresholds are now measured against the units a quota rule reserves for the data type, or against the unallocated pool when the data type has no quota rule, instead of the full daily quota. For example, with a daily quota of 4,280 units and 835 units reserved for spans and metrics, a logs threshold at 80% routes at 2,756 units. To reserve units for logs, add a quota rule for logs. In the policy editor, the quota label and its info card now name the pool the policy uses, Reserved for logs or Unallocated pool, list every slice of the quota bar, and link to Quota Rules. Learn more
TCO Optimizer: Frequent Search destination for logs and spans
Setting a log or spans policy to High now shows its destination as frequentsearch/logs or frequentsearch/spans, the same names Explore uses. A confirmation explains the move, the destination locks its priority to High, and archive retention governs the S3 copy only. Where High cannot apply, it stays visible and disabled with the reason shown. Quota-based rules are now available on a Frequent Search destination: only the High threshold stays in Frequent Search, and each threshold shows where its share is stored. High is available only on the default dataset. Learn more
TCO Optimizer: per-destination routing and a RUM tab
Every destination now carries its own configuration. The log policy editor replaces the single policy-level priority with an Action card (Route & Store or Block), followed by a Destination & Storage section where each destination is its own tab. Per destination you set the dataset, the Policy type (Standard or Quota-based, with its own thresholds and fallback), the Priority, and the Archive retention, so one policy can route Standard to one dataset and Quota-based to another. Fan-out is capped at two destinations, each copy is billed separately, and the policy table gained Policy type and Destination columns that stack per destination when the two differ. Learn more
RUM policies. A new RUM tab brings the same policy editor to RUM events, routing to the locked default/rum.events dataset with Medium as the default priority. DPXL expressions validate against the rum.events dataset schema. Learn more
TCO Optimizer: DPXL quick actions in the policy editor
Two quick actions are now available in the TCO policy editor when a filter is in Expression mode. A copy icon next to the expression field copies the full DPXL expression to the clipboard, so you can share the filter or paste it into another tool. Go to Explore Logs, below the editor, opens Explore with the expression pre-injected as a DataPrime query on the last 15 minutes of the logs dataset, letting you inspect the actual events the filter matches rather than relying on the aggregate preview counters alone. Widen the time range in Explore if the filter matches low-volume data. Learn more
TCO Optimizer: DPXL expressions for trace policies
Filter trace TCO policies with DPXL. Span (trace) policies now accept a DPXL expression in Expression mode, matching the existing capability for log policies. Write a filter on any span field, such as the label keypaths $l.serviceName, $l.operationName, $l.applicationName, and $l.subsystemName, or keep using the Builder. Learn more
TCO Optimizer: Preview panel and log override migration
Preview a TCO policy's impact before you save. The log policy form now includes a Preview panel that shows how your current filter and priority match recent data. See live Data sent and Total units estimates for the last 24 hours or 7 days, break matched data down by application, subsystem, and severity, and review volume and units over time. Learn more
Log override migration. The Overrides table for logs is being retired. During the hybrid phase you can now migrate overrides to log policies in bulk with Convert to policy or Delete from the Overrides table, and after the cutoff any remaining overrides become top-ordered policies automatically. Learn more
System dataset quota limits
Cap daily ingestion on system datasets. System datasets now support a per-dataset quota limit, set as a percentage of available daily quota or as an absolute CX Units value. Ingestion halts when the limit is reached and resumes at 00:00 UTC. Learn more
April 2026 updates
Route logs to user-defined datasets via TCO Optimizer. TCO policies now support a Target Dataset field. Select a user-defined dataset as the routing destination so logs matching your policy filters land in an isolated dataset instead of default/logs. Learn more
DPXL support in TCO Optimizer
TCO Optimizer now supports DPXL expressions. Write TCO policies using DataPrime Expression Language (DPXL) to match on any log or trace field, including metadata, labels, and user data fields. The Builder remains available for common use cases and generates DPXL automatically. Priority levels are now named High (Frequent Search), Medium (Monitoring), and Low (Compliance) to reflect their storage model and use case. Learn more
Pipeline Analyzer streaming and rule filters
Streaming enhancements and rule-filtering in the Pipeline Analyzer for clearer pipeline visibility. Learn more
Schema Manager field mapping visibility
Schema Manager. See if fields are fully mapped, unmapped, or partially mapped, right inside Schema Manager. Learn more
Pipeline Analyzer and Quota Rules
See inside your data with Pipeline Analyzer. Pipeline Analyzer gives you real-time visibility into your log pipeline. Instantly inspect logs as they're ingested, view parsing rules in execution order, and capture live log streams. Learn more
Take control with Quota Rules. Quota Rules let you set precise usage limits across your telemetry pipeline. Enforce automated blocks, control costs, prevent noisy data spikes. Learn more
Predefined field types for data cleanliness
Protect data cleanliness. Predefine field types, maintain structured data, and eliminate ingestion order dependencies for more accurate and efficient monitoring. Learn more
Kafka Forwarders for external pipelines
Integrate Coralogix with your data pipelines with Forwarders. Seamlessly send parsed and enriched log data from Coralogix to an external kafka cluster with Forwarders. Learn more
Custom enrichment and log normalization
Custom log enrichment is now even more intuitive. Enrich logs from specific columns in your CSV file, download enriched files, and use them as data sources in DataPrime queries. Learn more
Log normalization for simplified data analysis. Leverage new log normalization feature to standardize keys for commonly occurring values across various security log types. Learn more
Archive tags for multiple retention periods
Set Multiple Retention Periods with Archive Tags. Control the length of archive retention for different groups of logs. Define different lifecycle policies in the Setup Archive page. View Documentation >. Learn more
JSON parsing rules
New Parsing Rules. Introducing Stringify JSON Field and Parse JSON Field rules to parse escaped JSON values within a field to a valid JSON object and vice versa. Learn More >. Learn more