Skip to content

Coralogix integration

Connect DXDT to Coralogix for read-only observability: run DataPrime and Lucene queries over your logs, spans, and metrics, and see alert definitions and incidents. DXDT never modifies anything in Coralogix — it only reads.
Setup time ~5 minutes
Difficulty Easy

Access required: Any user who can create a personal API key; team admin for a team key

Prerequisites

  • An active Coralogix team — any region (EU1/EU2/US1/US2/AP1/AP2/AP3).
  • Your Coralogix domain — the part after your team name in the browser URL. If you sign in at acme.app.eu2.coralogix.com, the domain is eu2.coralogix.com. Legacy domains such as coralogix.us or coralogixsg.com also work.
  • Permission to create an API key in Coralogix.

Setup

1. Open the API Keys page

Sign in to Coralogix and go to Settings → API Keys (also reachable via Data Flow → API Keys in some versions).

2. Create a read-only key

Create a new Personal Key (or a Team Key if your org prefers not to tie the connection to a person) and grant it read permissions:

  • Name it something identifiable, e.g. DXDT (read-only).
  • Grant the data querying permissions — this is what powers DataPrime/Lucene log search.
  • Optionally add alerts:ReadConfig and incidents:read so DXDT can also list alert definitions and incidents.
  • Do not grant any write, config-change, or send-data permissions — DXDT never needs them.

3. Copy the key value

Copy the generated key immediately — Coralogix shows it only once. If you lose it, revoke and recreate.

Note

Send-Your-Data ingestion keys will NOT work here — they cannot query. Use a personal or team key with query permissions.

Configuration fields

Field Where to find it
API Key (api_key) The key you copied in Step 3.
Coralogix Domain (domain) e.g. eu2.coralogix.com — the part after <team>.app. in your Coralogix URL. A region code like EU2 or US1 is also accepted.

Verify the connection

Open the Configuration tab, paste the values, and click Install & Configure. DXDT validates the key by running a one-row sample log query; the Live Status panel on the Overview tab should show your domain and a green connected indicator.

Security

Credentials are stored encrypted per-tenant and used only for read-only DataPrime queries and management reads (alert definitions, incidents).

Troubleshooting

401/403 Unauthorized on install

The key is wrong, revoked, or lacks data-querying permissions — or it is a Send-Your-Data ingestion key. Recreate the key under Settings → API Keys with the data querying permission preset and paste the full value with no extra spaces.

Connection fails / host not found

Wrong Coralogix domain. Take the domain from your browser URL: everything after <team>.app. (e.g. eu2.coralogix.com), or just enter your region code (EU1/EU2/US1/US2/AP1/AP2/AP3).

Log queries work but list alerts / list incidents return Unauthorized

The key lacks the alerts/incidents read scopes. Edit the key (or create a new one) and add alerts:ReadConfig and incidents:read permissions.

Archive-tier queries return no data

No S3/GCS archive is configured for the team, or the query window predates archiving. Check Data Flow → Setup Archive in Coralogix, or query the default frequent-search tier instead.

Vendor documentation: https://coralogix.com/docs/developer-portal/apis/getting-started/getting-started-with-coralogix-apis/