Logs Querying Skill

Query and analyze Coralogix logs using the cx logs command with DataPrime syntax.

Understanding Logs in Coralogix

Logs in Coralogix are largely unstructured. Every log entry has a small structured envelope - metadata and labels - but the actual application payload (userData) is free-form and varies entirely by application. There is no universal schema for $d.* fields.

This means:

• Metadata ($m.*) and labels ($l.*) are predictable - you can always filter on severity, timestamp, application name, and subsystem name without discovery.
• User data ($d.*) is not predictable - field names, nesting, and types depend on whatever the application chose to log. Always verify $d fields before assuming they exist.

CLI Command

cx logs '<dataprime_query>'