Coralogix

​

Overview

• Search logs across applications and subsystems
• Query metrics for anomaly detection
• Access alert history and context
• Integrate with Olly (Coralogix’s AI SRE agent)

​

Prerequisites

• Coralogix account with API access
• API key with read permissions
• Knowledge of your Coralogix domain

​

Configuration

​

Step 1: Create a Coralogix API Key

1. Log in to your Coralogix dashboard
2. Navigate to Settings (left navbar) > API Keys
3. Click + Team Key (bottom right)
4. Configure the key:
   • Key name: IncidentFox (or any descriptive name)
   • Role Presets: Select DataQuerying
5. Click Create
6. Copy the API key

​

Step 2: Identify Your Domain

​

Step 3: Connect to IncidentFox

1. Open the IncidentFox app in Slack (click the bot’s avatar → Open App)
2. Under Available Integrations, find Coralogix and click Connect (or Edit if already configured)
3. In the modal:
   • Watch the video walkthrough for step-by-step guidance
   • Paste your API Key
   • Select your Domain from the dropdown (based on your Coralogix URL)
   • Optionally, add Custom Context to help the AI understand your Coralogix setup (e.g., application names, team conventions, important subsystems)
4. Click Save

​

Custom Context for AI (Optional)

• “Our main applications are payments-api and checkout-service”
• “Production logs use subsystem prod-backend, staging uses staging-backend”
• “Critical alerts come from the sre-alerts application”

​

Available Tools

​

search_coralogix_logs

@incidentfox search coralogix logs for "error" AND "payments" in the last hour

• query - Lucene query string
• application - Application filter (optional)
• subsystem - Subsystem filter (optional)
• time_range - Time range (default: 1 hour)

​

get_coralogix_metrics

@incidentfox get coralogix metrics for request_latency_p99 in payments service

• metric_name - Name of the metric
• filters - Label filters
• aggregation - Sum, avg, max, min, etc.
• time_range - Time range for query

​

get_coralogix_alerts

@incidentfox show coralogix alerts for the last 24 hours

• severity - Filter by severity (optional)
• status - Active, resolved, all
• time_range - Time range

​

get_coralogix_traces

@incidentfox get traces for the checkout flow with high latency

• service - Service name
• operation - Operation/endpoint (optional)
• min_duration - Minimum trace duration
• time_range - Time range

​

Olly Integration

​

How It Works

1. Query Coralogix data directly
2. Request Olly’s analysis of specific issues
3. Combine Olly’s insights with data from other sources

​

Example: Combined Investigation

@incidentfox investigate high error rates in the checkout service, use Olly for analysis

1. Query Coralogix logs for errors
2. Ask Olly to analyze the error patterns
3. Correlate with metrics from other sources
4. Provide combined findings

​

Use Cases

​

Log Search During Incidents

@incidentfox search coralogix for exceptions in payments-service since the alert fired

• Query recent logs matching the criteria
• Identify error patterns
• Correlate with recent deployments

​

Metrics Correlation

@incidentfox check if latency spike in coralogix correlates with database connection issues

​

Alert Investigation

@incidentfox get context for the latest coralogix alert on cart-service

​

Troubleshooting

​

Connection Failed

1. Verify API key is valid and not expired
2. Check domain is correct for your region
3. Ensure network allows outbound HTTPS to Coralogix

​

Empty Results

1. Verify application/subsystem names are correct
2. Check time range - data may be outside the range
3. Verify the query syntax (Lucene format)

​

Rate Limiting

1. Reduce query frequency
2. Use more specific queries
3. Contact Coralogix to increase limits

​

Best Practices

1. Set default filters in configuration to reduce noise
2. Use specific time ranges - don’t query more data than needed
3. Leverage Olly for pattern recognition in large log volumes
4. Combine with other sources - Coralogix for logs, Grafana for metrics

​

Security Considerations

​

What IncidentFox Can Access

​

What IncidentFox Cannot Do

• Create, modify, or delete alerts
• Change any Coralogix configurations
• Access team admin settings
• Manage API keys or users
• Send or ingest data

​

Best Practices

• All permissions are read-only - no write or management access
• You control the key - revoke anytime from your Coralogix dashboard
• No data storage - IncidentFox queries on-demand; logs stay in Coralogix
• Store keys in your secrets manager
• Rotate keys periodically
• Monitor API usage for anomalies

​

Revoking Access

1. Go to Settings > API Keys in your Coralogix dashboard
2. Find the IncidentFox key
3. Click Delete

​

Next Steps