> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Coralogix

> Connect Coralogix to CloudThinker for log search, metrics, traces, incident triage, and pipeline health investigation

Connect your Coralogix account to enable CloudThinker agents to search logs, query metrics and traces, triage incidents, and inspect data pipeline health across your observability stack.

Coralogix authenticates with an **API key** scoped to a **region**. CloudThinker resolves the right Coralogix endpoint from the region, so the same setup works across all US, EU, and AP data centers.

***

## Supported regions

Pick the region that matches your Coralogix team login domain.

| Data center  | Regions             |
| ------------ | ------------------- |
| US           | `us1`, `us2`, `us3` |
| Europe       | `eu1`, `eu2`        |
| Asia Pacific | `ap1`, `ap2`, `ap3` |

***

## Prerequisites

* A **Coralogix account** with access to the team you want to investigate.
* An **API key** with the read permissions for the observability data CloudThinker should reach.
* The **region** of your Coralogix team.

<Info>
  Use an API key with the least permissions needed for read-only investigation. CloudThinker's setup verification only reads data — it never mutates Coralogix resources.
</Info>

***

## Setup

<Steps>
  <Step title="Open Coralogix">
    Sign in to your Coralogix account. Your login URL follows the format `https://<team>.app.<region>.coralogix.com` — the `<region>` segment is your region.
  </Step>

  <Step title="Create an API key">
    Go to **Settings → Users and Teams → API Keys** and click **Add key**:

    * **Name**: `cloudthinker`
    * **Type**: pick **Team Key** — it's shared and stays valid even if the creating user's access expires, unlike a Personal Key, which is tied to an individual and meant for testing
    * **Permissions**: grant the read permissions for the data CloudThinker should access

    Copy the key immediately — it may not be shown again.
  </Step>

  <Step title="Add the connection in CloudThinker">
    Navigate to **Connections → Coralogix** and enter:

    * **API Key**: the key you just created
    * **Region**: the region from your login URL (e.g. `eu2`)

    Click **Connect**. CloudThinker verifies the credentials and shows a **Connected** status.
  </Step>
</Steps>

<Warning>
  Copy the API key immediately after creation. You'll need to create a new key if it's lost.
</Warning>

***

## Connection details

| Field                   | Description                        | Example |
| ----------------------- | ---------------------------------- | ------- |
| **CORALOGIX\_API\_KEY** | Coralogix API key                  | —       |
| **CORALOGIX\_REGION**   | Region from your team login domain | `us2`   |

<Note>
  CloudThinker derives the Coralogix API endpoint from the region, so no manual URL configuration is required.
</Note>

***

## Required permissions

Grant the API key the **read** permissions for the observability data CloudThinker investigates — logs, metrics, traces, incidents, alerts, connectors, parsing rules, presets, and dashboards.

<Tip>
  Follow least privilege: a read-only key is enough for investigation. Keep mutating permissions off the key CloudThinker uses unless a write workflow specifically requires them.
</Tip>

***

## Agent capabilities

Once connected, agents have read access to your Coralogix observability data.

| Capability              | Description                                                                                                        |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------ |
| **Discovery**           | Summarize account health — active incidents, connector count, disabled parsing rules, and metric no-match handling |
| **Incident triage**     | List and inspect active incidents and their context                                                                |
| **Logs**                | Search and analyze logs over a time window                                                                         |
| **Metrics**             | Query metrics and inspect the metric catalog                                                                       |
| **Traces**              | Inspect distributed traces                                                                                         |
| **Pipeline health**     | Review connectors, parsing rules, and presets for misconfiguration                                                 |
| **Alerts & dashboards** | Inspect alert definitions and dashboards                                                                           |

### Verify the connection

```text theme={null}
@alex run Coralogix discovery and summarize active incidents, connector count, disabled parsing rule count, and whether metric no-match handling is healthy
```

### Example prompts

```text theme={null}
@alex triage active Coralogix incidents and #report anything affecting production
@alex search Coralogix logs for 5xx errors in the api-gateway over the last hour
@alex check Coralogix pipeline health and list any disabled parsing rules
```

<Note>
  For large or noisy catalogs, scope requests with short time windows and a known metric or log query so the agent returns focused results.
</Note>

***

## Troubleshooting

<Accordion title="401 or 403 Unauthorized">
  The API key is missing, expired, or lacks the required permissions. Create a new Coralogix API key with the needed read permissions and reconnect.
</Accordion>

<Accordion title="404 Not Found">
  The API key belongs to a different Coralogix region. Check your team login domain and update **CORALOGIX\_REGION** to match.
</Accordion>

<Accordion title="No metrics found">
  The metric catalog has no matching metric, or the account has no metric data. Treat it as an empty result, then try a known metric name or continue with incidents and logs.
</Accordion>

<Accordion title="Discovery shows degraded status">
  One or more Coralogix list calls returned an error. Check the API key permissions and region, then rerun discovery.
</Accordion>

<Accordion title="Large or noisy output">
  Unbounded catalog or query usage returns too much data. Scope requests with short time windows and specific queries so results stay focused.
</Accordion>

***

## Security

* **Least privilege** — grant only the permissions the agents need for your use case; start read-only and widen later.
* **Read-only by default** — use read-only credentials unless you want agents to make changes through this connection.
* **Rotate credentials** — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
* **Revoke on offboarding** — remove the credential at the provider when you delete a connection or a teammate leaves.

- **Correct region** — match the API key's region to the Coralogix team login domain; mismatched regions cause 404 failures.

***

## Related

<CardGroup cols={2}>
  <Card title="Datadog Connection" icon="https://mintcdn.com/cloudthinker/aLd-ttc-SCW-aFky/images/icons/datadog.svg?fit=max&auto=format&n=aLd-ttc-SCW-aFky&q=85&s=e8382167f2a1eb1e00971b5f4d703d48" href="/guide/connections/datadog" width="24" height="24" data-path="images/icons/datadog.svg">
    Log search, metrics, and monitoring
  </Card>

  <Card title="Better Stack Connection" icon="https://mintcdn.com/cloudthinker/uIxpc0ZqZtveGXWt/images/icons/betterstack.svg?fit=max&auto=format&n=uIxpc0ZqZtveGXWt&q=85&s=61b580a94f2f0b8abd07eb7f494739c2" href="/guide/connections/betterstack" width="24" height="24" data-path="images/icons/betterstack.svg">
    Uptime, incidents, and log search
  </Card>
</CardGroup>