> Documentation index for AI agents: https://docs.pagerduty.com/llms.txt

# Coralogix: Query

Queries Coralogix logs and spans with DataPrime or Lucene, queries metrics with PromQL, and lists metric names and label values.


> **Availability:** See the [Incident Workflow Actions Overview table](/workflow-actions) for the plans this workflow is available on.

## Description

Query Coralogix logs, traces, and metrics within a specified time range. This action runs one operation per step:

| Operation | What it does |
| :-------- | :----------- |
| **Search Logs** | Runs a DataPrime or Lucene query against your logs on the Frequent Search or Archive tier. |
| **Search Spans** | Runs a DataPrime or Lucene query against your spans (traces) on the Frequent Search or Archive tier. |
| **PromQL Range** | Runs a PromQL query against your metrics and returns a time series for the window. |
| **PromQL Instant** | Runs a PromQL query against your metrics and returns one value per series at **End Time**. |
| **List Metric Names** | Lists the metric names that have data in the window. |
| **List Label Values** | Lists the values of one metric label (for example, `service_name`) in the window. |

## Prerequisites

- A configured Coralogix connection to use for the query.
- The connection's API key must have read permission for the data the operation queries: logs, spans, or metrics. Searching the Archive tier also requires archive query permission.

## Instructions

1. If you have not done so, follow the instructions to [Create an Incident Workflow](/ai-automation/automation/incident-workflows#create-an-incident-workflow).
2. When the instructions prompt you to [add actions](/ai-automation/automation/incident-workflows#add-actions), select **this action**.
3. Enter the following **Inputs** and click **Save**.
4. Continue following instructions to **Publish** the Workflow.
5. When the action runs, you will see the **Outputs** listed below.

## Inputs

> **Field References:** Fields with the **\{+\}** icon accept [Field References](/ai-automation/automation/incident-workflows#field-references), which can be useful for referencing incident data or outputs created in prior workflow steps. To add Field References, click **\{+\}**, or enter `{{`, and select relevant fields. Refer to the [Field References](/ai-automation/automation/incident-workflows#field-references) article for more information.

> **Frequent Search Limit:** On the Frequent Search tier, the window defined by **Start Time** and **End Time** must be 192 hours (8 days) or less. Coralogix shortens a longer window and returns a warning in **Result Summary**. For longer windows or older data, set **Tier** to **Archive**.

| Name | Description |
| :--- | :---------- |
| **Connection Input** | The Coralogix connection to use for the query. |
| **Operation** | What to run: **Search Logs**, **Search Spans**, **PromQL Range**, **PromQL Instant**, **List Metric Names**, or **List Label Values**. |
| **Query** *(Optional)* | **Search Logs** and **Search Spans**: a DataPrime query (e.g. `source logs \| filter $l.applicationname == 'checkout'` or `source spans \| filter $l.serviceName == 'checkout'`) or a Lucene query. **PromQL Range** and **PromQL Instant**: a PromQL expression (required). **List Label Values**: an optional series selector (e.g. `{service_name="checkout"}`). Ignored by **List Metric Names**. |
| **Start Time** | Start of the query window. Pick a predefined relative time from the list, or pass an ISO 8601 timestamp (e.g. `2025-10-07T14:00:00Z`). Default: **1h (Past 1 Hour)**. Ignored by **PromQL Instant**. |
| **End Time** | End of the query window, and the evaluation time for **PromQL Instant**. Pick a predefined relative time from the list, or pass an ISO 8601 timestamp (e.g. `2025-10-07T16:00:00Z`). Default: **Now**. |
| **Tier** *(Optional)* | **Search Logs** and **Search Spans** only. **Frequent Search** (default) holds recent data; **Archive** holds older data in your Coralogix archive. |
| **Query Syntax** *(Optional)* | **Search Logs** and **Search Spans** only. The language the **Query** is written in: **DataPrime** (default) or **Lucene**. |
| **Step** *(Optional)* | **PromQL Range** only. Resolution between points (e.g. `15s`, `1m`, `5m`). Chosen from the window when empty. |
| **Label Name** *(Optional)* | **List Label Values** only, where it is required. The label to list values for (e.g. `service_name`). |
| **Limit** *(Optional)* | Maximum number of logs, spans, or list items to return. Default: 100. Maximum: 1000. Ignored by **PromQL Range** and **PromQL Instant**. |

## Outputs

| Name | Description |
| :--- | :---------- |
| **Results** | **Search Logs**: log entries, each with timestamp, severity, applicationName, subsystemName, message, and a fields object holding the full log body. **Search Spans**: spans, each with timestamp, traceId, spanId, parentSpanId, applicationName, subsystemName, serviceName, operationName, durationMs, status, statusMessage, tags, resourceTags, and events. Aggregation queries return flat rows instead. **PromQL Range** and **PromQL Instant**: series, each with labels and values (timestamp and value). **List** operations: a list of strings. |
| **Result Count** | Number of logs, spans, series, or list items returned. |
| **Operation Used** | The operation that ran. |
| **Query Used** | The query sent to Coralogix. |
| **Time Range Start** | The start time used for the query. |
| **Time Range End** | The end time used for the query. |
| **Search Duration** | Coralogix API response time in milliseconds. |
| **Result** | Value that shows if the action was successful or not. Either `Success` or `Failed`. |
| **Result Summary** | Brief description of what the action did. On a failure caused by the input, query, or API key, it holds the reason. |
| **Error** | Brief description that is populated if the action failed unexpectedly (rate limit, Coralogix server error). |