# Coralogix: Search Logs

Queries Coralogix logs with a DataPrime-style expression across a window of up to 192 hours, per Coralogix's search limit.


> **Availability:** See the [Incident Workflow Actions Overview table](/workflow-actions) for the plans this workflow is available on.

## Description

Search for logs in Coralogix within a specified time range. This action retrieves diagnostic data from Coralogix programmatically during incident response, so your team can analyze logs as part of an automated workflow instead of running manual searches.

## Prerequisites

A configured Coralogix connection to use for the query.

## Instructions

1. If you have not done so, follow the instructions to [Create an Incident Workflow](/ai-automation/automation/incident-workflows#create-an-incident-workflow).
2. When the instructions prompt you to [add actions](/ai-automation/automation/incident-workflows#add-actions), select **this action**.
3. Enter the following **Inputs** and click **Save**.
4. Continue following instructions to **Publish** the Workflow.
5. When the action runs, you will see the **Outputs** listed below.

## Inputs

> **Field References:** Fields with the **\{+\}** icon accept [Field References](/ai-automation/automation/incident-workflows#field-references), which can be useful for referencing incident data or outputs created in prior workflow steps. To add Field References, click **\{+\}**, or enter `{{`, and select relevant fields. Refer to the [Field References](/ai-automation/automation/incident-workflows#field-references) article for more information.

> **Frequent Search Limit:** The search window defined by **Start Time** and **End Time** must be 192 hours (8 days) or less, which is the Frequent Search limit in Coralogix.

> **Numeric Field Comparisons:** When comparing a numeric field that may be stored as text, cast it with `:num` (e.g. `$d.status_code:num >= 500`).

| Name | Description |
| :--- | :---------- |
| **Connection Input** | The Coralogix connection to use for the query. |
| **Query** | A DataPrime query (e.g. `source logs \| filter $d.status_code:num >= 500`). Use `source logs` to return all logs. When comparing a numeric field that may be stored as text, cast it with `:num`. |
| **Start Time** | Start of the search window. Pick a predefined relative time from the list, or pass an ISO 8601 timestamp (e.g. `2025-10-07T14:00:00Z`). The window must be 192 hours or less, per the Frequent Search limit. |
| **End Time** | End of the search window. Pick a predefined relative time from the list, or pass an ISO 8601 timestamp (e.g. `2025-10-07T16:00:00Z`). |
| **Limit**   *(Optional)* | Maximum number of log entries to return. Maximum: 1000. This is applied as the DataPrime query limit; if the query already ends with its own limit, the smaller of the two wins. |

## Outputs

| Name | Description |
| :--- | :---------- |
| **Logs** | Array of log entries retrieved. Each entry includes timestamp, severity, applicationName, subsystemName, message, and a fields object holding the full userData verbatim (the message and every custom field). |
| **Log Count** | Total number of log entries returned. |
| **Query Used** | The DataPrime query sent to Coralogix. |
| **Time Range Start** | The start time used for the search. |
| **Time Range End** | The end time used for the search. |
| **Result** | Value that shows if the action was successful or not. Either `Success` or `Failed`. |
| **Result Summary** | Brief description of what the action did or if it failed. |
| **Error** | Brief description that is populated if the action failed. |