Request Demo


Coralogix CLI

Coralogix is on a mission to provide a CLI that will enable you to do all your Coralogix operations without the web interface involved. Currently, we support LiveTail (a live log stream from all your services) and our archive query to help you directly query your archived logs that were stored to S3 using the Elasticsearch syntax.

You can filter your logs by Coralogix metadata fields such as application name, subsystem name, and severity and also by querying the data itself.

Live tail is much like how the stern command in K8s streams logs in real-time.

*Before using the CLI to query archived data, please make sure that you’ve configured your own S3 bucket on AWS to work with Coralogix, as described in this tutorial.

Install the Coralogix CLI for MacOS/Linux


curl -O


curl -O


gunzip -N cxctl-*.gz

Make Executable:

chmod +x cxctl

Set Environment Variables:





The API key to use can be found in settings->account->’API Access’

Use the Alerts and Rules API key

Scan Option:

S3 bucket             
--bucket [bucket name], -b [bucket name]
Time range - Start  --range-start [start time], -s [start time]
Time range - End  --range-end [end time], -e [end time]
Application --application-name [application]
Subsystem--subsystem [subsystem]
Severity --severity [severity]
Limit the number of logs-c [number]
Query" [Your Query] "

Scan Examples

./cxctl scan --bucket coralogix-tutorial -s "2020-08-18T16:30:00Z" -e "2020-08-18T17:00:00Z" -c 5Retrieve the first 5 rows within the time range
./cxctl scan --bucket coralogix-tutorial --range-start 2020-08-18T00:01:01Z --range-end 2020-08-18T00:09:05Z -c 5 "NOT s3_bucket:amir-blog-logs"Retrieves the top 5 results of the query within the time range
./cxctl scan -b coralogix-tutorial -s 2020-08-18T00:01:01Z -e 2020-08-18T16:59:05Z --application-name Prod --subsystem Coralogix --severity infoRetrieve all the logs from Prod application and Coralogix subsystem with info severity within the time range

Log Streaming

In order to stream the logs in real-time (as they are being archived) use the following command:

$ ./cxctl livetail --region "region-name" --api-key <api-key> --format pretty --application "app-name" --subsystem "subsystem-name"

A Coralogix API key can be passed to the scanner through the `–api-key` argument or as an environment variable

Streaming supports the EU and IN regions; specify them as `eu` and `in` respectively

By default, the logs use the `pretty` format. A `raw` format is also available which prints out the logs as JSON objects

The scanner will tail the logs infinitely by default but can stop after a specified number of log lines using –count

LiveTail Option:

Coralogix Alerts & Rules API Key--api-key , -k
Application name to filter on--application
Add a custom field to the colored fields when pretty-printing--color-by
How many lines to read--count , -c
How to render the logs (raw/pretty)--format
Print logs without any colors--monochrome, -m
Coralogix account region (eu/in)--region , -r
Subsystem to filter on--subsystem
Severity to filter on (case-sensitive - use DEBUG/INFO/etc.)

Start solving your production issues faster

Let's talk about how Coralogix can help you

Managed, scaled, and compliant monitoring, built for CI/CD

Get a demo

No credit card required

Get a personalized demo

Jump on a call with one of our experts and get a live personalized demonstration