> ## Documentation Index
> Fetch the complete documentation index at: https://docs.incident.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Coralogix

> Query your Coralogix logs, metrics, and traces to see what your systems were doing during an incident.

<Note>
  Connecting Coralogix is currently in **Private Beta**. Get in touch by [email](mailto:support@incident.io) or our
  shared Slack channel if you'd like to try it out.
</Note>

Coralogix is one connection that covers logs, dimensional metrics, and traces, queried with Coralogix's DataPrime query language (and PromQL for metrics) over your Coralogix account. Investigations query it to see what your services were doing around the time of an incident: the log lines, the metric that moved, and the slow or failing span behind a bad request.

<Note>
  You connect Coralogix directly, with an API key and your region. A single connection brings logs, metrics, and traces,
  and you choose which ones investigations can use.
</Note>

## What we support

Connecting Coralogix gives investigations three capabilities, each of which you can enable independently, plus your dashboards:

| Capability | What it queries                                                        |
| ---------- | ---------------------------------------------------------------------- |
| Logs       | Log lines from your services, and trends derived from those logs       |
| Metrics    | Dimensional metrics, graphed for the incident window                   |
| Traces     | Traces and spans across your services to find slow or failing requests |
| Dashboards | The queries built into your own dashboards                             |

### Logs

Investigations search your Coralogix logs with DataPrime to read what a service was logging at the time of an incident, scoped by the application and subsystem the logs belong to. The same query language turns logs into time-series, so an error rate climbing or a request volume dropping away shows up as a graph even where you never set up a dedicated metric for it.

### Metrics

Investigations query your dimensional metrics with PromQL and graph them for the incident's time window, so a resource spike, a latency change, or a growing error count shows up against the period that matters.

### Traces

Investigations use your traces and spans in three ways: searching for the spans behind a problem (a slow endpoint, a failing dependency, a particular service), pulling a specific trace by ID to see the full span tree and where it broke, and aggregating spans into throughput, latency, and error-rate signals for a service.

### Dashboards

Your Coralogix dashboards are discovered automatically once you connect, and read for the DataPrime and PromQL behind their widgets, so investigations learn the applications, fields, and filters your team already queries.

Investigations learn the structure of your Coralogix data automatically: your applications and subsystems, the fields on your logs, your metric names, and the services your spans belong to. How that works is covered in [How telemetry works](/investigations/connect/telemetry/how-it-works#learning-your-stack).

## Connecting Coralogix

You connect Coralogix directly. There's no provider in front of it.

**What you'll need:**

* A Coralogix **API key** with permission to run queries, created under **API keys** in your Coralogix account. We recommend a key scoped to read-only access, so investigations can only read.
* Your Coralogix **region**, matching the domain you log in to (for example, `eu2` for `eu2.coralogix.com`). Coralogix is region-pinned, so a key used against the wrong region is rejected.

1. From the [Investigations settings](https://app.incident.io/~/investigations), add a telemetry data source and choose **Coralogix**.
2. Enter your API key and region, then test the connection. We check the key authenticates against that region.
3. Choose which capabilities (logs, metrics, traces) investigations can use. The ones you select are enabled once you connect.

Your dashboards are discovered automatically once Coralogix is connected — there's nothing extra to set up.

## Best practices

* Use a dedicated API key scoped to read-only access, so investigations can't do anything Coralogix itself wouldn't allow a viewer to do.
* Check the region matches the account you want to query. A key from a different region won't authenticate.
* Enable logs, metrics, and traces together where your team uses them. With more than one connected, an investigation can move from a log line to the trace behind it, or from a metric to the logs explaining it.

## Related

<CardGroup cols={2}>
  <Card title="Telemetry overview" icon="database" href="/investigations/connect/telemetry/overview">
    How data sources and capabilities fit together.
  </Card>

  <Card title="How telemetry works" icon="magnifying-glass" href="/investigations/connect/telemetry/how-it-works">
    Routing, query planning, guidance, and memory.
  </Card>
</CardGroup>