Open in ChatGPTOpen in Claude

Querying RUM logs

Real User Monitoring SDKs send logs to the Coralogix Ingress API using a predefined JSON format that maintains a consistent structure across all logs. This uniformity makes it easy to query RUM logs with DataPrime, as all log types share the same overarching schema.

Each RUM log includes a common set of fields applicable to all event types. In addition, each specific event type has its own nested object containing fields unique to that event.

Currently, based on the enabled instrumentation, both browser and mobile SDKs can generate the following types of events:

• resources
• error
• network-request
• user-interaction
• longtask
• log
• web-vitals
• dom
• custom-measurement
• screenshot

Where RUM data is stored

RUM data is stored in its own dataset, default/rum.events. Every field path on this page is written as it appears in that dataset.

RUM data used to be written into default/logs alongside your application logs, and every RUM field carried a cx_rum. prefix. Accounts move to default/rum.events one at a time, so both layouts are in use today. When an account moves, the prefix is dropped: cx_rum.event_context.type becomes event_context.type.

To check which applies to your account, open the dataset selector in the query builder and look for default/rum.events. If your RUM events appear there, use the paths on this page exactly as written. If your RUM data is still in default/logs, add the cx_rum. prefix to every path on this page.

Note

There is no double write. Once an account moves, RUM data is written only to default/rum.events, and the cx_rum. paths no longer exist in default/logs. Anything still pointing at the old paths returns no results. See Updating saved queries after the move.

Shared fields

These fields are included in all RUM logs, regardless of the event type. They provide contextual details such as session, event metadata, user identity, and environment information.

Full path	Description	Example value	Field
Session context
session_context.ip_geoip.ip	User's IP address	49.249.153.150	ip
session_context.ip_geoip.ip_ipaddr	Alternative IP address	49.249.153.150	ip_ipaddr
session_context.ip_geoip.location_geopoint.lat	Latitude of user location	21.9974	lat
session_context.ip_geoip.location_geopoint.lon	Longitude of user location	79.0011	lon
session_context.ip_geoip.continent_name	Continent name	Asia	continent_name
session_context.ip_geoip.country_name	Country name	India	country_name
session_context.ip_geoip.city_name	City name	Delhi	city_name
session_context.ip_geoip.postal_code	Postal code	90210	postal_code
session_context.ip_geoip.is_local	Is IP local	FALSE	is_local
session_context.browser	Browser name	Chrome	browser
session_context.browserVersion	Browser version	136.0.0.0	browserVersion
session_context.device	Device type	Desktop	device
session_context.hasRecording	Current session has recording	FALSE	hasRecording
session_context.hasScreenshot	Current session has screenshot	FALSE	hasScreenshot
session_context.onlyWithErrorMode	Error mode only	FALSE	onlyWithErrorMode
session_context.os	Operating system	MacOS	os
session_context.osVersion	OS version	10.15.7	osVersion
session_context.prev_session.hasRecording	Previous session had recording	TRUE	prev_session_hasRecording
session_context.prev_session.hasScreenshot	Previous session had screenshot	FALSE	prev_session_hasScreenshot
session_context.prev_session.session_creation_date	Previous session creation time	1748503307441	prev_session_creation_date
session_context.prev_session.session_id	Previous session ID	bfcd4bf5-c4ff-48fb-99d4-b1af603707e4	prev_session_id
session_context.session_creation_date	Current session creation time	1748514787150	session_creation_date
session_context.session_id	Current session ID	c664895a-63d7-4997-ad88-ce753974ca3a	session_id
session_context.user_agent	User agent string	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36	user_agent
session_context.user_id	User ID	1234	user_id
session_context.user_name	User name	Aviv Alush	user_name
session_context.x_forwarded_for	Forwarded IPs	49.249.153.150,163.116.212.40	x_forwarded_for
Event context
event_context.severity	Event severity	3	event_severity
event_context.type	Event type	user-interaction	event_type
Labels
labels.cxFeatureGroupId	Feature group ID	data-exploration	cxFeatureGroupId
labels.cxFeatureId	Feature ID	logs-explorer	cxFeatureId
labels.releaseId	Release ID	web-app@866faa56	releaseId
Page context
page_context.page_fragments	Page fragments	query-new/archive-logs	page_fragments
page_context.page_url	Page URL	https://zupee-prd.app.coralogix.in/#/query-new/archive-logs?id=A9JBQSSgVyIl1jtNbPHbf&page=0	page_url
page_context.page_url_blueprint	Blueprint URL	https://zupee-prd.app.coralogix.in/#/query-new/archive-logs?id=A9JBQSSgVyIl1jtNbPHbf&page=0	page_url_blueprint
page_context.referrer	Referrer		referrer
General metadata
browser_sdk.version	SDK version	2.8.3	browser_sdk_version
environment	Deployment environment	mumbaisaas	environment
platform	Platform	browser	platform
timestamp	Timestamp	1748514789996	timestamp
version_metadata.app_name	App name	web-app	app_name
version_metadata.app_version	App version	866faa56	app_version

User interactions

Tracks user actions such as clicks and inputs to understand behavior and flow.

Full path	Description	Example value	Field
event_context.severity	Severity level of the event (e.g., 1–5)	3	severity
event_context.type	Type of the event	user-interaction	type
interaction_context.element_classes	CSS classes of interacted element	cx-input-field ng-untouched ng-pristine ng-valid	element_classes
interaction_context.element_id	Element ID	cx-input-3	element_id
interaction_context.event_name	Interaction event name	click	event_name
interaction_context.target_element	HTML element targeted	INPUT	target_element
interaction_context.target_element_inner_text	Inner text of target element		target_element_inner_text
interaction_context.target_element_type	Type of target element	text	target_element_type

Network requests

Records details of XHR and fetch requests to monitor API usage and latency.

Full path	Description	Example value	Field
event_context.severity	Event severity	3	severity
event_context.type	Type of event detected	network-request	event_type
network_request_context.duration	Duration of the network request	680	request_duration
network_request_context.method	HTTP method	POST	request_method
network_request_context.url	Full request URL	https://ng-api-grpc.cx498.coralogix.com/com.coralogix.schemastore.v1.SchemaStoreService/SubmitUsageStats	request_url
network_request_context.status_code	HTTP response status code	200	status_code
timestamp	Timestamp of the event	1748510384932	timestamp
traceId	Trace identifier for observability	8a6eb6a6131e8680c9b36cdeb424ccc4	traceId
spanId	Span identifier for tracing	7b32e31e2275c1b4	spanId

Errors

Captures JavaScript errors and exceptions to help identify and resolve issues impacting the user experience.

Full path	Description	Example value	Field
error_context.error_message	Error message text	ERROR Cannot read properties of undefined (reading 'map')	error_message
error_context.original_stacktrace	Original JavaScript stack trace	Array of 10 stack frames (see details below)	original_stacktrace

Resources

Logs the loading of external assets (like images, scripts, and stylesheets) to measure resource performance.

Full path	Description	Example value	Field
event_context.severity	Severity level (info/warning)	3	severity
event_context.type	Type of the event	resources	type
resource_context.connectEnd	End of the connection phase	67021.59999990463	connectEnd
resource_context.connectStart	Start of the connection	67021.59999990463	connectStart
resource_context.decodedBodySize	Size of decoded response body	3993	decodedBodySize
resource_context.deliveryType	Resource delivery type	(empty)	deliveryType
resource_context.domainLookupEnd	End of DNS lookup	67021.59999990463	domainLookupEnd
resource_context.domainLookupStart	Start of DNS lookup	67021.59999990463	domainLookupStart
resource_context.duration	Total resource load time	175.5	duration
resource_context.encodedBodySize	Size of compressed body	1375	encodedBodySize
resource_context.entryType	Type of performance entry	resource	entryType
resource_context.fetchStart	Start of fetch	67021.59999990463	fetchStart
resource_context.finalResponseHeadersStart	Time headers were received	67196.79999995232	finalResponseHeadersStart
resource_context.firstInterimResponseStart	Interim response timing	0	firstInterimResponseStart
resource_context.fragments	Associated JS chunk	chunk-K6NU6CD3.js	fragments
resource_context.initiatorType	What triggered the resource load	script	initiatorType
resource_context.name	Resource URL	https://cdn.jsdelivr.net/npm/[email protected]/lodash.min.js	name
resource_context.nextHopProtocol	Protocol used (HTTP/2)	h2	nextHopProtocol
resource_context.redirectEnd	End of redirect (if any)	0	redirectEnd
resource_context.redirectStart	Start of redirect (if any)	0	redirectStart
resource_context.renderBlockingStatus	Whether this blocked rendering	non-blocking	renderBlockingStatus
resource_context.requestStart	Time request started	67024.09999990463	requestStart
resource_context.responseEnd	Time full response received	67197.09999990463	responseEnd
resource_context.responseStart	Time response started	67196.79999995232	responseStart
resource_context.responseStatus	HTTP status code	200	responseStatus
resource_context.secureConnectionStart	Start of secure TLS handshake	67021.59999990463	secureConnectionStart
resource_context.serverTiming	Server timing info	[]	serverTiming
resource_context.startTime	Start time of resource timing measurement	67021.59999990463	startTime
resource_context.transferSize	Total bytes transferred (including headers)	1675	transferSize
resource_context.workerStart	Start of any service worker involvement	0	workerStart

Long task

Detects main thread blocking operations to surface performance bottlenecks.

Full path	Description	Example value	Field
event_context.severity	Severity level (e.g., info = 1, warning = 3, error = 5)	3	severity
event_context.type	Type of RUM event	longtask	type
longtask_context.duration	Time the task blocked the main thread (in ms)	84	duration
longtask_context.entryType	Type of performance entry	longtask	entryType
longtask_context.id	Unique identifier for the long task	5885bbfc-cefa-4e33-aa9d-bbd3acf75c30	id
longtask_context.name	Source of the long task (usually self or cross-origin)	self	name
longtask_context.startTime	When the long task began (in ms since page load)	3473.5	startTime

Web vitals

Reports key performance metrics like LCP, FID, and CLS to assess the core user experience.

Full path	Description	Example value	Field
event_context.severity	Event severity level (e.g., info = 1, warning = 3, error = 5)	3	severity
event_context.type	Type of the event	web-vitals	type
web_vitals_context.name	Web vital type (Largest Contentful Paint)	LCP	name
web_vitals_context.value	Measured LCP value in milliseconds	18224	value (ms)
web_vitals_context.rating	Performance rating based on metric thresholds	poor	rating
web_vitals_context.attribution.elementRenderDelay	Time from page load to element render	17605.4	elementRenderDelay (ms)
web_vitals_context.attribution.lcpEntry.renderTime	Time from navigation start to LCP render	18224	renderTime (ms)
web_vitals_context.attribution.lcpEntry.size	Size of the largest element contributing to LCP	20160	size (bytes)
web_vitals_context.attribution.timeToFirstByte	TTFB value from navigation timing	618.6	timeToFirstByte (ms)
web_vitals_context.navigationType	Type of navigation (navigate, reload, etc.)	navigate	navigationType
web_vitals_context.navigationId	Identifier for navigation event	1	navigationId
web_vitals_context.id	Unique identifier for the web vital metric	v4-1748520702813-3468299023131	id

Document navigation timings

When web_vitals_context.name is LT, the event carries the browser's PerformanceNavigationTiming entry alongside the fields above, so the whole document load sequence is queryable. Use these to find the slowest phase of a page load, or to separate a slow document from a slow render.

Full path	Description	Example value	Field
web_vitals_context.activationStart	Time between a prerendered document starting and being activated	92.1	activationStart (ms)
web_vitals_context.domInteractive	When the document became interactive	313.9	domInteractive (ms)
web_vitals_context.domContentLoadedEventStart	Immediately before the DOMContentLoaded handler ran	544	domContentLoadedEventStart (ms)
web_vitals_context.domContentLoadedEventEnd	Immediately after the DOMContentLoaded handler finished	544.1	domContentLoadedEventEnd (ms)
web_vitals_context.domComplete	The document and every sub-resource finished loading	583.2	domComplete (ms)
web_vitals_context.loadEventStart	When the document's load event started	583.2	loadEventStart (ms)
web_vitals_context.loadEventEnd	When the document's load event finished	583.4	loadEventEnd (ms)
web_vitals_context.unloadEventStart	Immediately before the previous document's unload handler ran	0	unloadEventStart (ms)
web_vitals_context.unloadEventEnd	Immediately after the previous document's unload handler finished	0	unloadEventEnd (ms)
web_vitals_context.redirectCount	Redirects since the last non-redirect navigation	0	redirectCount
web_vitals_context.url	The document URL the timings belong to	https://coralogix.com/	url
web_vitals_context.value	Total page load time	583.4	value (ms)

navigationType and type both appear on these events and hold the same value - navigate, reload, back_forward or prerender - because the SDK copies the performance entry in whole and then derives navigationType from its type.

Memory usage

Reports the browser's memory consumption, broken down by what is holding it. Collected on an interval when memoryUsageConfig is enabled, and only in a secure context, since it relies on measureUserAgentSpecificMemory.

Full path	Description	Example value	Field
event_context.type	Type of the event	memory-usage	type
memory_usage_context.bytes	Total memory consumption across all objects	10485760	bytes
memory_usage_context.breakdown.bytes	Memory consumed by one group of objects	2097152	bytes
memory_usage_context.breakdown.types	Object types in that group, such as DOM, JavaScript or shared workers	["DOM"]	types
memory_usage_context.breakdown.attribution.url	URL of the frame or worker the memory is attributed to	https://coralogix.com/	url
memory_usage_context.breakdown.attribution.scope	Scope the memory belongs to, such as a window or a worker	Window	scope

Mobile vitals

Reports automatically collected performance metrics such as CPU, memory, frames-per-second (fps), and app start-up times to assess mobile app responsiveness. For more details, see Mobile Vitals.

Full path	Description	Example value	Field
event_context.severity	Event severity level (e.g., info = 1, warning = 3, error = 5)	3	severity
event_context.type	Type of the event	mobile-vitals	type
mobile_vitals_context.name	Specific mobile vital metric name	cpu_usage	name
mobile_vitals_context.type	High-level metric category	cpu	type
mobile_vitals_context.value	Measured value of the metric	0.02	value
mobile_vitals_context.units	Unit of measurement for the value	percentage, mb, ms	units
mobile_vitals_context.uuid	Unique identifier for the metric sample	a3a7532f-1c8d-4c02-86f4-6f7b5aefa2a1	uuid

Log

Provides general-purpose logging for application events and custom developer insights.

Full path	Description	Example value	Field
event_context.severity	Severity level of the event (e.g., 1–5)	3	severity
event_context.type	Type of the event	log	type
event_context.source	Source of the log	code	source
event_context.severity	Event severity	1	event_severity
event_context.source	Event source	code	event_source
event_context.type	Event type	log	event_type
log_context.data.event.log.customTriggerData.actionType	Log action type	Other	log_actionType
log_context.data.event.log.customTriggerData.extraData.exceptionInfo.error.statusCode	Log error status code	5	log_statusCode
log_context.data.event.log.customTriggerData.extraData	Log extra data as JSON object	Mock not found	log_statusMessage
log_context.data.event.log.customTriggerData.message	Log message	[custom-dashboards] platform-overview.component - handleDataLoadingError: {"statusCode":5,"statusMessage":"Mock not found","metadata":{"map":{}}} - failed	log_message
log_context.data.event.triggerType	Log trigger type	custom	log_triggerType
log_context.data.event.severity	Log severity: 1-6	1	log_severity
log_context.data.message	Log context message	[custom-dashboards] platform-overview.component - handleDataLoadingError: {"statusCode":5,"statusMessage":"Mock not found","metadata":{"map":{}}} - failed	log_context_message

DOM

Logs changes and structures in the Document Object Model for advanced session analysis.

Full path	Description	Example value	Field
event_context.severity	Severity level of the event (e.g., 1–5)	3	severity
event_context.type	Type of the event	dom	type
snapshot_context.actionCount	Number of user actions recorded	0	actionCount
snapshot_context.errorCount	Number of errors recorded	0	errorCount
snapshot_context.hasRecording	Indicates if recording exists	true	hasRecording
snapshot_context.hasScreenshot	Indicates if screenshot exists	false	hasScreenshot
snapshot_context.viewCount	Number of views recorded	1	viewCount

Custom measurement

Allows developers to send specific measurements relevant to their application logic.

Full path	Description	Example value	Field
event_context.severity	Severity level of the event (e.g., 1–5)	3	severity
event_context.type	Type of the event	custom-measurement	type
custom_measurement_context.name	Name of the custom measurement	RUM errors page loaded	name
custom_measurement_context.value	Value of the custom measurement	167	value

Screenshot

Captures visual snapshots during user sessions for enhanced debugging and replay context.

Full path	Description	Example value	Field
event_context.severity	Severity level of the event (e.g., 1–5)	3	severity
event_context.type	Type of the event	screenshot	type
screenshot_context.description	Reason or description for the screenshot	creating a screenshot due to an error!	description
screenshot_context.id	Unique identifier for the screenshot event	2c54846d-4a52-47dc-8911-cec10bf962b8	id

Updating saved queries after the move

Alerts, dashboards, events2metrics rules, and saved views are not updated automatically when your account moves to default/rum.events. Update each one yourself:

1. Point it at default/rum.events instead of default/logs.
2. Remove the cx_rum. prefix from every field reference. In DataPrime, $d.cx_rum.event_context.type becomes $d.event_context.type.

Alerts

Once your account has moved, the Application dropdown on an alert that runs on default/logs no longer lists your RUM applications, because the RUM data is no longer in that dataset.

Set the alert's Dataset to default/rum.events and filter on the application in the query itself:

version_metadata.app_name:"frontend-livefeed" AND event_context.type:"error"

For how dataset selection works on an alert, see Dataset alerts.

Dashboards, events2metrics, and saved views

Each of these stores the dataset and the field paths it was built with, so both need updating:

• Dashboards: repoint each widget's data source to default/rum.events and drop the prefix from every field in the query, the filters, and the group-by.
• Events2metrics: repoint the rule at default/rum.events and update the field paths in its query and labels. Metrics already generated under the old rule keep the labels they were written with.
• Saved views and custom filters: update the dataset and the field paths together. A view saved against default/logs keeps working, but returns no RUM data.