coralogix-analysis

Start with get_statistics.py to get log volume, error rate, top error patterns, and anomaly detection before sampling. Then use sample_logs.py with the errors_only strategy and extract_signatures.py to cluster error patterns for root cause analysis.

DataPrime queries start with 'source logs' and chain filters and aggregations with pipes, such as 'filter $m.severity == ERROR | groupby $l.subsystemname aggregate count()'. Use == for equality, ~~ for text search, and unquoted enum values for severity.

Run get_slow_spans.py with a --min-duration threshold in milliseconds to list spans exceeding that latency, or use --stats for per-service latency averages. Span durations are stored in microseconds, and you can follow a full request with get_traces.py --trace-id.

In production, credentials are injected by a proxy layer via CORALOGIX_BASE_URL, so no API key is visible. For direct testing mode, set CORALOGIX_API_KEY plus CORALOGIX_DOMAIN or CORALOGIX_REGION so the client can resolve the correct regional API endpoint.

Dumping raw logs is slow and buries the signal in noise. The statistics-first approach surfaces error rates, dominant patterns, and time anomalies first, so you only sample targeted slices like errors_only or around_anomaly windows.