For AI agents and assistants: visit https://docs.pagerduty.com/llms.txt for the index.
Workflow Actions
Coralogix: Query
Queries Coralogix logs and spans with DataPrime or Lucene, queries metrics with PromQL, and lists metric names and label values.
Availability
See the Incident Workflow Actions Overview table for the plans this workflow is available on.
Description
Query Coralogix logs, traces, and metrics within a specified time range. This action runs one operation per step:
| Operation | What it does |
|---|---|
| Search Logs | Runs a DataPrime or Lucene query against your logs on the Frequent Search or Archive tier. |
| Search Spans | Runs a DataPrime or Lucene query against your spans (traces) on the Frequent Search or Archive tier. |
| PromQL Range | Runs a PromQL query against your metrics and returns a time series for the window. |
| PromQL Instant | Runs a PromQL query against your metrics and returns one value per series at End Time. |
| List Metric Names | Lists the metric names that have data in the window. |
| List Label Values | Lists the values of one metric label (for example, service_name) in the window. |
Prerequisites
- A configured Coralogix connection to use for the query.
- The connection's API key must have read permission for the data the operation queries: logs, spans, or metrics. Searching the Archive tier also requires archive query permission.
Instructions
- If you have not done so, follow the instructions to Create an Incident Workflow.
- When the instructions prompt you to add actions, select this action.
- Enter the following Inputs and click Save.
- Continue following instructions to Publish the Workflow.
- When the action runs, you will see the Outputs listed below.
Inputs
Field References
Fields with the {+} icon accept Field References, which can be useful for referencing incident data or outputs created in prior workflow steps. To add Field References, click {+}, or enter {{, and select relevant fields. Refer to the Field References article for more information.
Frequent Search Limit
On the Frequent Search tier, the window defined by Start Time and End Time must be 192 hours (8 days) or less. Coralogix shortens a longer window and returns a warning in Result Summary. For longer windows or older data, set Tier to Archive.
| Name | Description |
|---|---|
| Connection Input | The Coralogix connection to use for the query. |
| Operation | What to run: Search Logs, Search Spans, PromQL Range, PromQL Instant, List Metric Names, or List Label Values. |
| Query (Optional) | Search Logs and Search Spans: a DataPrime query (e.g. source logs | filter $l.applicationname == 'checkout' or source spans | filter $l.serviceName == 'checkout') or a Lucene query. PromQL Range and PromQL Instant: a PromQL expression (required). List Label Values: an optional series selector (e.g. {service_name="checkout"}). Ignored by List Metric Names. |
| Start Time | Start of the query window. Pick a predefined relative time from the list, or pass an ISO 8601 timestamp (e.g. 2025-10-07T14:00:00Z). Default: 1h (Past 1 Hour). Ignored by PromQL Instant. |
| End Time | End of the query window, and the evaluation time for PromQL Instant. Pick a predefined relative time from the list, or pass an ISO 8601 timestamp (e.g. 2025-10-07T16:00:00Z). Default: Now. |
| Tier (Optional) | Search Logs and Search Spans only. Frequent Search (default) holds recent data; Archive holds older data in your Coralogix archive. |
| Query Syntax (Optional) | Search Logs and Search Spans only. The language the Query is written in: DataPrime (default) or Lucene. |
| Step (Optional) | PromQL Range only. Resolution between points (e.g. 15s, 1m, 5m). Chosen from the window when empty. |
| Label Name (Optional) | List Label Values only, where it is required. The label to list values for (e.g. service_name). |
| Limit (Optional) | Maximum number of logs, spans, or list items to return. Default: 100. Maximum: 1000. Ignored by PromQL Range and PromQL Instant. |
Outputs
| Name | Description |
|---|---|
| Results | Search Logs: log entries, each with timestamp, severity, applicationName, subsystemName, message, and a fields object holding the full log body. Search Spans: spans, each with timestamp, traceId, spanId, parentSpanId, applicationName, subsystemName, serviceName, operationName, durationMs, status, statusMessage, tags, resourceTags, and events. Aggregation queries return flat rows instead. PromQL Range and PromQL Instant: series, each with labels and values (timestamp and value). List operations: a list of strings. |
| Result Count | Number of logs, spans, series, or list items returned. |
| Operation Used | The operation that ran. |
| Query Used | The query sent to Coralogix. |
| Time Range Start | The start time used for the query. |
| Time Range End | The end time used for the query. |
| Search Duration | Coralogix API response time in milliseconds. |
| Result | Value that shows if the action was successful or not. Either Success or Failed. |
| Result Summary | Brief description of what the action did. On a failure caused by the input, query, or API key, it holds the reason. |
| Error | Brief description that is populated if the action failed unexpectedly (rate limit, Coralogix server error). |