Coralogix

Get the team's custom per-model pricing overrides (input/output/cache prices). Returns a JSON mapping of model name to its pricing.

ai_center_get_model_pricing

Retrieve a specific alert definition, alert event, or case by ID. Use this tool when the user has an alert-related ID but the object type is unclear. The tool can try multiple alert object types automatically, or you can provide a hint. Args: object_id: Alert object ID. Must be a UUID, or a readable case ID like ``CASE-123``. object_type_hint: Optional hint for the expected object type: ``alert_definition_by_id``, ``alert_definition_by_version_id``, ``alert_event``, or ``case``. get_watch_data: If true, also fetch watch data (query plus triggering records) for the most relevant alert event tied to the object. Returns: JSON string with ``search_id``, ``found_type``, ``found_object``, and optional ``warning`` / ``watch_data``.

get_alerts_object

Get the current date and time in UTC (ISO 8601), useful for query time bounds. Returns: ISO 8601 timestamp string in UTC (for example ``2024-01-15T12:00:00.000000+00:00``).

get_datetime

Get a graph of interactions between services from Coralogix tracing for a specific timeframe. If ``service_name`` is omitted, the tool returns a compact full service-map graph as an adjacency map. If ``service_name`` is provided, the tool returns only services interacting with that service, including node and edge details. Args: time_range: Optional time range with ``start_time`` and ``end_time`` in ISO-8601 UTC format. If omitted, defaults to the last hour. service_name: Optional service name to focus the graph on. Returns: JSON string with ``service_map``. For a focused service query this is a detailed graph with ``nodes`` and ``edges``. For an unfiltered query this is a compact adjacency graph keyed by source service.

get_service_map_relations_graph

List the team's AI Center applications, including each app's `guardrailsIntegrated` (guarded) status. Use for inventory questions like "what AI apps do I have?" or "which apps are/aren't guarded". Returns a JSON list of applications.

ai_center_list_applications

List configured evaluations/policies (enabled state, target, config). Optionally scope to one app by `application` + `subsystem`. Use for "what policies are configured for app X". Returns a JSON list.

ai_center_list_evaluations

List all available DataPrime constructs (commands and functions). Returns: Plain-text list of commands and functions with short descriptions.

list_dataprime_constructs

List all custom evaluation policies for the team. Returns a JSON list.

ai_center_list_custom_evaluations

List custom evaluations linked to a specific application (by app UUID). Returns a JSON list.

ai_center_list_custom_evaluations_for_application

List label names for a metric. Use this to discover which labels exist for a metric before querying specific label values with get_metric_label_values. Args: metric_name: The name of the metric to get label names for. Returns: Newline-separated list of available label names for the specified metric.

get_metric_labels

List values for a metric label. Args: metric_name: The name of the metric to get label values for. label: The name of the label to get values for. Returns: Newline-separated list of available values for the specified metric label.

get_metric_label_values

Unified tool for all Coralogix alert operations. Actions: - create: Create a new alert. Requires 'alert'. IMPORTANT: Always ask the user for priority (P1-P5) - never pick one yourself. Returns: { message, alertId } - get: Get alert by ID. Requires 'id'. Returns: { message, alert } - list: List alerts. Optional 'nameFilter' for case-insensitive name matching. Returns: { message, alerts } - update: Update existing alert. Requires 'alert' (must include 'id' field). IMPORTANT: First use get/list to fetch the existing alert, modify it, then pass the complete alert here. Returns: { message, alertId } - delete: Delete alert by ID. Requires 'id'. IMPORTANT: If you only have the alert name, use list with nameFilter first to find the ID. Returns: { message } - generate_openapi: Generate OpenAPI JSON payload. Requires 'alert'. IMPORTANT: For existing alerts, use get/list first to fetch it. Returns: { message, openAPIDefinition } - generate_kubernetes: Generate K8s YAML for Coralogix Operator. Requires 'alert'. IMPORTANT: For existing alerts, use get/list first to fetch it. Returns: { message, k8sYAML } - generate_terraform: Generate Terraform HCL for Coralogix Provider. Requires 'alert'. IMPORTANT: For existing alerts, use get/list first to fetch it. Returns: { message, tfHCL } Required fields by action: - action: Always required - id: Required for get, delete - alert: Required for create, update, generate_openapi, generate_kubernetes, generate_terraform - nameFilter: Optional for list

manage_alerts

Unified tool for all Coralogix alerts scheduler operations. Actions: - create: Create a new alerts scheduler. Requires 'alertsScheduler'. Returns: { message, alertsSchedulerId } - get: Get alerts scheduler by ID. Requires 'id'. Returns: { message, alertsScheduler } - list: List alerts schedulers. Optional 'nameFilter' for case-insensitive name matching. Returns: { message, alertsSchedulers } - update: Update existing alerts scheduler. Requires 'alertsScheduler' (must include 'id' field). IMPORTANT: First use get/list to fetch the existing alerts scheduler, modify it, then pass the complete alertsScheduler here. Returns: { message, alertsSchedulerId } - delete: Delete alerts scheduler by ID. Requires 'id'. IMPORTANT: If you only have the alerts scheduler name, use list with nameFilter first to find the ID. Returns: { message } - generate_openapi: Generate OpenAPI JSON payload. Requires 'alertsScheduler'. IMPORTANT: For existing alerts schedulers, use get/list first to fetch it. Returns: { message, openAPIDefinition } - generate_kubernetes: Generate Kubernetes YAML for Coralogix Operator kind AlertScheduler. Requires 'alertsScheduler'. IMPORTANT: For existing alerts schedulers, use get/list first to fetch it. Alert-ID filters generate deterministic placeholder Alert resource refs. Returns: { message, k8sYAML } - generate_terraform: Generate Terraform HCL for coralogix_alerts_scheduler. Requires 'alertsScheduler'. IMPORTANT: For existing alerts schedulers, use get/list first to fetch it. Returns: { message, tfHCL } Supported subset: - exactly one of filter.metaLabels or filter.alertsUniqueIds - all-alert filters are rejected because the current operator AlertScheduler CRD requires exactly one alert selector - one-time schedules, recurring always-active schedules, and recurring dynamic daily, weekly, and monthly schedules Required fields by action: - action: Always required - id: Required for get, delete - alertsScheduler: Required for create, update, generate_openapi, generate_kubernetes, generate_terraform - nameFilter: Optional for list

manage_alerts_scheduler

Unified tool for Coralogix custom role operations. This tool supports the shared Terraform and Kubernetes Operator subset: name, description, parentRoleName, and permissions. Custom role IDs are strings in MCP payloads and are parsed to numeric IDs only when calling the Coralogix Role Management API. Actions: - create: Create a new custom role. Requires 'customRole' with name, description, parentRoleName, and permissions. Returns: { message, customRoleId } - get: Get custom role by ID. Requires 'id'. Returns: { message, customRole } - list: List custom roles. Optional 'nameFilter' for case-insensitive name filtering. Returns: { message, customRoles } - update: Update an existing custom role. Requires 'customRole' with id, name, description, and permissions. IMPORTANT: parentRoleName cannot be changed. If provided, it must match the current backend parentRoleName. Returns: { message, customRoleId } - delete: Delete custom role by ID. Requires 'id'. IMPORTANT: If you only have the custom role name, use list with nameFilter first to find the ID. Returns: { message } - generate_openapi: Generate OpenAPI JSON payload. Requires 'customRole'. Returns: { message, openAPIDefinition } - generate_kubernetes: Generate K8s YAML for Coralogix Operator. Requires 'customRole'. Returns: { message, k8sYAML } - generate_terraform: Generate Terraform HCL for Coralogix Provider. Requires 'customRole'. Returns: { message, tfHCL } Required fields by action: - action: Always required - id: Required for get, delete - customRole: Required for create, update, generate_openapi, generate_kubernetes, generate_terraform - nameFilter: Optional for list

manage_custom_roles

Unified tool for Coralogix data enrichment operations. This tool supports the shared non-custom Terraform and Kubernetes Operator subset only: geoIp, suspiciousIp, and aws enrichments. Custom CSV enrichments, customEnrichmentData, raw OpenAPI enrichmentType payloads, and unknown enrichment types are rejected. Data enrichments are account-level rules. Create adds new enrichments. Update requires an existing enrichment id, deletes that backend enrichment, then adds the replacement enrichment. Delete removes enrichments by id. Actions: - create: Create one or more data enrichments. Requires 'dataEnrichments'. Returns: { message, dataEnrichments } - get: Get data enrichment by ID. Requires 'id'. Returns: { message, dataEnrichment } - list: List supported data enrichments. Optional 'fieldNameFilter' for case-insensitive substring matching over supported fieldName values. Returns: { message, dataEnrichments } - update: Replace one existing data enrichment. Requires 'dataEnrichments' with exactly one enrichment containing id. IMPORTANT: First use get/list to fetch the existing enrichment, modify it, then pass the complete enrichment here. Returns: { message, dataEnrichment } - delete: Delete data enrichment by ID. Requires 'id'. Returns: { message, remainingDataEnrichments } - generate_openapi: Generate OpenAPI JSON payload for adding enrichments. Requires 'dataEnrichments'. Returns: { message, openAPIDefinition } - generate_kubernetes: Generate Kubernetes YAML for Coralogix Operator kind Enrichment. Requires 'dataEnrichments'. Returns: { message, k8sYAML } - generate_terraform: Generate Terraform HCL for coralogix_data_enrichments. Requires 'dataEnrichments'. Returns: { message, tfHCL } Supported enrichment fields: - geoIp: fieldName, enrichedFieldName, selectedColumns, withAsn - suspiciousIp: fieldName, enrichedFieldName, selectedColumns - aws: fieldName, enrichedFieldName, selectedColumns, resourceType Required fields by action: - action: Always required - id: Required for get, delete - fieldNameFilter: Optional for list - dataEnrichments: Required for create, update, generate_openapi, generate_kubernetes, generate_terraform

manage_data_enrichments

Unified tool for all Coralogix events2metric operations. Actions: - create: Create a new events2metric. Requires 'events2metric'. Returns: { message, events2metricId } - get: Get events2metric by ID. Requires 'id'. Returns: { message, events2metric } - list: List events2metrics. Optional 'nameFilter' for case-insensitive name matching. Returns: { message, events2metrics } - update: Update existing events2metric. Requires 'events2metric' (must include 'id' field). IMPORTANT: First use get/list to fetch the existing events2metric, modify it, then pass the complete events2metric here. Returns: { message, events2metricId } - delete: Delete events2metric by ID. Requires 'id'. IMPORTANT: If you only have the events2metric name, use list with nameFilter first to find the ID. Returns: { message } - generate_openapi: Generate OpenAPI JSON payload. Requires 'events2metric'. IMPORTANT: For existing events2metrics, use get/list first to fetch it. Returns: { message, openAPIDefinition } - generate_kubernetes: Generate K8s YAML for Coralogix Operator. Requires 'events2metric'. IMPORTANT: For existing events2metrics, use get/list first to fetch it. Returns: { message, k8sYAML } - generate_terraform: Generate Terraform HCL for Coralogix Provider. Requires 'events2metric'. IMPORTANT: For existing events2metrics, use get/list first to fetch it. Returns: { message, tfHCL } Supported subset: - exactly one of logsQuery or spansQuery - metricLabels, metricFields, permutationsLimit, query filters, and aggregations min, max, count, avg, sum, samples, histogram - logsQuery.alias and custom aggregation targetMetricName values are not exposed and are rejected when found on fetched resources Required fields by action: - action: Always required - id: Required for get, delete - events2metric: Required for create, update, generate_openapi, generate_kubernetes, generate_terraform - nameFilter: Optional for list

manage_events2metrics

Unified tool for Coralogix notification-center global router operations. Actions: - create: Create a new global router. Requires 'globalRouter'. Returns: { message, globalRouterId } - get: Get global router by ID. Requires 'id'. Returns: { message, globalRouter } - list: List global routers. Optional 'nameFilter' for case-insensitive name filtering. Returns: { message, globalRouters } - update: Update existing global router. Requires 'globalRouter' with 'id'. IMPORTANT: First use get/list to fetch the existing global router, modify it, then pass the complete globalRouter here. Returns: { message, globalRouterId } - delete: Delete global router by ID. Requires 'id'. IMPORTANT: If you only have the global router name, use list with nameFilter first to find the ID. Returns: { message } - generate_openapi: Generate OpenAPI JSON payload. Requires 'globalRouter'. Returns: { message, openAPIDefinition } - generate_kubernetes: Generate K8s YAML for Coralogix Operator. Requires 'globalRouter'. Returns: { message, k8sYAML } - generate_terraform: Generate Terraform HCL for Coralogix Provider. Requires 'globalRouter'. Returns: { message, tfHCL } Required fields by action: - action: Always required - id: Required for get, delete - globalRouter: Required for create, update, generate_openapi, generate_kubernetes, generate_terraform - nameFilter: Optional for list

manage_global_routers

Unified tool for Coralogix Integration Service operations. Integrations use the shared Terraform and Kubernetes Operator surface: integrationKey, version, and free-form parameters. Supported parameter values are string, number, boolean, and list of strings. Sensitive/API-key parameter variants and nested objects are rejected because they cannot be exported losslessly. Actions: - create: Validate and create a deployed integration. Requires 'integration'. Returns: { message, integrationId } - get: Get deployed integration by ID. Requires 'id'. Returns: { message, integration } - list: List available integration packages. Optional 'nameFilter' for case-insensitive filtering by integration key or display name. Returns: { message, integrations } - update: Validate and update an existing deployed integration. Requires 'integration' with 'id' or top-level 'id'. Returns: { message, integrationId } - delete: Delete deployed integration by ID. Requires 'id'. Returns: { message } - generate_openapi: Generate Integration Service JSON payload. Requires 'integration'. Returns: { message, openAPIDefinition } - generate_kubernetes: Generate Kubernetes YAML for Coralogix Operator kind Integration. Requires 'integration'. Returns: { message, k8sYAML } - generate_terraform: Generate Terraform HCL for coralogix_integration. Requires 'integration'. Returns: { message, tfHCL }

manage_integrations

Unified tool for all Coralogix parsing rule operations. Actions: - create: Create a new parsing rule. Requires 'parsingRule'. Returns: { message, parsingRuleId } - get: Get parsing rule by ID. Requires 'id'. Returns: { message, parsingRule } - list: List parsing rules. Optional 'nameFilter' for case-insensitive name matching. Returns: { message, parsingRules } - update: Update existing parsing rule. Requires 'parsingRule' (must include 'id' field). IMPORTANT: First use get/list to fetch the existing parsing rule, modify it, then pass the complete parsing rule here. Returns: { message, parsingRuleId } - delete: Delete parsing rule by ID. Requires 'id'. IMPORTANT: If you only have the parsing rule name, use list with nameFilter first to find the ID. Returns: { message } - generate_openapi: Generate OpenAPI JSON payload. Requires 'parsingRule'. IMPORTANT: For existing parsing rules, use get/list first to fetch it. Returns: { message, openAPIDefinition } - generate_kubernetes: Generate K8s YAML for Coralogix Operator. Requires 'parsingRule'. IMPORTANT: For existing parsing rules, use get/list first to fetch it. Returns: { message, k8sYAML } - generate_terraform: Generate Terraform HCL for Coralogix Provider. Requires 'parsingRule'. IMPORTANT: For existing parsing rules, use get/list first to fetch it. Returns: { message, tfHCL } Required fields by action: - action: Always required - id: Required for get, delete - parsingRule: Required for create, update, generate_openapi, generate_kubernetes, generate_terraform - nameFilter: Optional for list

manage_parsing_rules

Unified beta tool for Coralogix notification-center preset operations. This tool supports the Terraform and Coralogix Operator intersection for preset types: slack, generic_https, pagerduty, and email. service_now is not supported until Coralogix Operator parity lands. Actions: - create: Create a new custom preset. Requires 'preset'. Returns: { message, presetId } - get: Get preset by ID. Requires 'id'. Returns: { message, preset } - list: List supported presets. Optional 'nameFilter' for case-insensitive name filtering. Returns: { message, presets } - update: Update existing custom preset. Requires 'preset' with 'id'. IMPORTANT: First use get/list to fetch the existing preset, modify it, then pass the complete preset here. Returns: { message, presetId } - delete: Delete custom preset by ID. Requires 'id'. IMPORTANT: If you only have the preset name, use list with nameFilter first to find the ID. Returns: { message } - generate_openapi: Generate OpenAPI JSON payload. Requires 'preset'. Returns: { message, openAPIDefinition } - generate_kubernetes: Generate K8s YAML for Coralogix Operator. Requires 'preset'. Returns: { message, k8sYAML } - generate_terraform: Generate Terraform HCL for Coralogix Provider. Requires 'preset'. Returns: { message, tfHCL } Required fields by action: - action: Always required - id: Required for get, delete - preset: Required for create, update, generate_openapi, generate_kubernetes, generate_terraform - nameFilter: Optional for list

manage_presets

Unified tool for Coralogix recording rule group set operations. This v1 tool supports structured groups only. Terraform-only yamlContent/yaml_content input is rejected because it is not shared by OpenAPI, Kubernetes Operator, and Terraform generated output. Actions: - create: Create a new recording rule group set. Requires 'recordingRulesGroupsSet'. Returns: { message, recordingRulesGroupsSetId } - get: Get recording rule group set by ID. Requires 'id'. Returns: { message, recordingRulesGroupsSet } - list: List recording rule group sets. Optional 'nameFilter' for case-insensitive name filtering. Returns: { message, recordingRulesGroupsSets } - update: Update existing recording rule group set. Requires 'recordingRulesGroupsSet' with 'id'. IMPORTANT: First use get/list to fetch the existing recording rule group set, modify it, then pass the complete recordingRulesGroupsSet here. Returns: { message, recordingRulesGroupsSetId } - delete: Delete recording rule group set by ID. Requires 'id'. IMPORTANT: If you only have the name, use list with nameFilter first to find the ID. Returns: { message } - generate_openapi: Generate OpenAPI JSON payload. Requires 'recordingRulesGroupsSet'. Returns: { message, openAPIDefinition } - generate_kubernetes: Generate Kubernetes YAML for Coralogix Operator kind RecordingRuleGroupSet. Requires 'recordingRulesGroupsSet'. Returns: { message, k8sYAML } - generate_terraform: Generate Terraform HCL for coralogix_recording_rules_groups_set. Requires 'recordingRulesGroupsSet'. Returns: { message, tfHCL } Required fields by action: - action: Always required - id: Required for get, delete - recordingRulesGroupsSet: Required for create, update, generate_openapi, generate_kubernetes, generate_terraform - nameFilter: Optional for list

manage_recording_rules_groups_set

Unified tool for Coralogix SLO v2 operations. This beta tool supports the shared Terraform/operator writable subset only: - request-based and window-based metric SLI - time frames: unspecified, 7_days, 14_days, 21_days, 28_days - window-based windows: unspecified, 1_minute, 5_minutes - comparison operators: unspecified, greater_than, less_than, greater_than_or_equals, less_than_or_equals Actions: - create: Create a new SLO v2. Requires 'slo'. Returns: { message, sloId } - get: Get SLO v2 by ID. Requires 'id'. Returns: { message, slo } - list: List SLO v2 resources. Optional 'nameFilter' for case-insensitive name matching. Returns: { message, slos } - update: Update existing SLO v2. Requires 'slo' with 'id'. IMPORTANT: First use get/list to fetch the existing SLO, modify it, then pass the complete SLO here. Returns: { message, sloId } - delete: Delete SLO v2 by ID. Requires 'id'. IMPORTANT: If you only have the SLO name, use list with nameFilter first to find the ID. Returns: { message } - generate_openapi: Generate OpenAPI JSON payload. Requires 'slo'. IMPORTANT: For existing SLOs, use get/list first to fetch it. Returns: { message, openAPIDefinition } - generate_kubernetes: Generate Kubernetes YAML for Coralogix Operator kind SLO. Requires 'slo'. IMPORTANT: For existing SLOs, use get/list first to fetch it. Returns: { message, k8sYAML } - generate_terraform: Generate Terraform HCL for coralogix_slo_v2. Requires 'slo'. IMPORTANT: For existing SLOs, use get/list first to fetch it. Returns: { message, tfHCL } Required fields by action: - action: Always required - id: Required for get, delete - slo: Required for create, update, generate_openapi, generate_kubernetes, generate_terraform - nameFilter: Optional for list

manage_slo_v2s

Unified tool for Coralogix TCO log policy operations. TCO log policy Terraform and Kubernetes resources are atomic overwrite resources: generated Terraform or Kubernetes describes the complete logs policy list and applying it replaces the complete backend logs policy set. Prefer tcoLogPolicies for generation. Single-policy generation is allowed but returns a warning. Actions: - create: Create a TCO log policy. Requires tcoLogPolicy. - get: Get a TCO log policy by ID. Requires id. - list: List TCO log policies. Optional nameFilter performs case-insensitive substring matching by policy name. - update: Update a TCO log policy. Requires tcoLogPolicy with id. - delete: Delete a TCO log policy by ID. Requires id. - generate_openapi: Generate AtomicOverwriteLogPoliciesRequest JSON. Requires tcoLogPolicies or tcoLogPolicy. - generate_kubernetes: Generate TCOLogsPolicies YAML. Requires tcoLogPolicies or tcoLogPolicy. - generate_terraform: Generate coralogix_tco_policies_logs HCL. Requires tcoLogPolicies or tcoLogPolicy.

manage_tco_log_policies

Unified tool for Coralogix TCO trace policy operations. TCO trace policy Terraform and Kubernetes resources are atomic overwrite resources: generated Terraform or Kubernetes describes the complete traces policy list and applying it replaces the complete backend traces policy set. Prefer tcoTracePolicies for generation. Single-policy generation is allowed but returns a warning. Actions: - create: Create a TCO trace policy. Requires tcoTracePolicy. - get: Get a TCO trace policy by ID. Requires id. - list: List TCO trace policies. Optional nameFilter performs case-insensitive substring matching by policy name. - update: Update a TCO trace policy. Requires tcoTracePolicy with id. - delete: Delete a TCO trace policy by ID. Requires id. - generate_openapi: Generate AtomicOverwriteSpanPoliciesRequest JSON. Requires tcoTracePolicies or tcoTracePolicy. - generate_kubernetes: Generate TCOTracesPolicies YAML. Requires tcoTracePolicies or tcoTracePolicy. - generate_terraform: Generate coralogix_tco_policies_traces HCL. Requires tcoTracePolicies or tcoTracePolicy.

manage_tco_trace_policies

Execute a DataPrime query against Coralogix logs, spans, or named datasets. Args: query: DataPrime query to execute. Must start with a source clause, e.g. `source logs`, `source spans`, or `source system/labs.cases.state_updates` for fleet case analytics (load the `case-analytics` skill). start_date: Range start, ISO 8601 UTC (`YYYY-MM-DDTHH:MM:SSZ`). Default: 15 minutes before `end_date`, or 15 minutes before now if `end_date` is omitted. end_date: Range end, ISO 8601 UTC. Default: 15 minutes after `start_date`, or now if `start_date` is omitted. limit: Maximum number of rows to return. Returns: JSON string with ``records`` and ``dataprime_warnings``.

query_dataprime

Get the official Coralogix RUM SDK setup guide and API reference. This is the authoritative source for RUM SDK integration. **IMPORTANT**: Always use this tool FIRST when the user asks about any of the following — do NOT search the codebase or guess the setup: - Setting up, installing, or configuring Coralogix RUM SDKs (Browser, React Native, Flutter, Android, iOS) - Adding RUM monitoring, real user monitoring, or browser/mobile tracking to an app - Enabling session recording or replay - Uploading source maps for minified stack traces (@coralogix/rum-cli) - Understanding minified/obfuscated error stack traces - Any question about Coralogix RUM SDK configuration options, API, or initialization Args: topic: The documentation topic to fetch. Must be one of: - "BROWSER_SDK" - Browser SDK (@coralogix/browser) setup, installation, configuration, initialization, and session recording docs - "SOURCE_MAPS" - Source map upload CLI tool docs for de-obfuscating stack traces - "REACT_NATIVE_SDK" - React Native plugin (@coralogix/react-native-plugin) setup and configuration docs - "FLUTTER_SDK" - Flutter plugin (cx_flutter_plugin) setup and configuration docs - "ANDROID_SDK" - Android SDK setup and configuration docs - "IOS_SDK" - iOS SDK setup and configuration docs Returns: Plain text extracted from official SDK README or documentation for the selected topic (content may be truncated to a maximum length).

read_rum_sdk_docs

Detach a custom evaluation (policy) from an AI application. Removes only the link between them; the policy itself is untouched and can be re-added. Pass the custom evaluation UUID and the application UUID. Returns the result as JSON.

ai_center_remove_policy_from_application

Run an instant PromQL expression against Coralogix Metrics (Prometheus `query` endpoint). Args: query (str): A valid PromQL expression evaluated at a single point in time. Example: sum by (service) (rate(http_requests_total[5m])). time (str, optional): Optional RFC-3339 timestamp (UTC) for the evaluation time. If omitted, the query is evaluated at the current time. Returns: Formatted query results (result type, series count, and sample values). Large results are truncated with guidance to narrow the query. Optional ``warnings`` / ``infos`` from the metrics API are appended when present.

query_promql_instant

Run a range PromQL expression against Coralogix Metrics (Prometheus `query_range` endpoint). Args: query (str): A valid PromQL range expression (evaluated at each step across the window). Example: rate(http_requests_total[5m]). start (str): RFC-3339 timestamp (UTC) for the start of the time range. Required. end (str): RFC-3339 timestamp (UTC) for the end of the time range. Required. step (str): Query step width as duration. Examples: 30s, 20m, 6h, 1d. Required. Important note: The step size should be large enough so that a series returns ~20 records. For example: * If the range is 1 hour, the step should be about 3 minutes * If the range is 1 day, the step should be about 1 hour * For 1 week, about 8 hours, etc. limit (int): Maximum number of ``[timestamp, value]`` samples kept per series in the tool output (also sent as the API ``limit`` parameter). Must be between 1 and 200. If the API returns more samples for a series, the tool truncates ``values`` and adds truncation fields (see Returns). Returns: JSON string: array of Prometheus ``query_range`` matrix series (the API ``data.result`` list). Each element has ``metric`` (string-to-string label map) and ``values``: an array of ``[timestamp, value]`` pairs. Timestamps and values are often **strings** in Prometheus JSON; Coralogix may return the timestamp as a **number** (Unix seconds) and the value as a **string**. If a series has more than ``limit`` samples, ``values`` is shortened to the first ``limit`` entries and the series gains ``truncated_result`` (bool), ``truncated_result_len`` (same as ``limit``), and ``original_result_len`` (count before truncation).

query_promql_range

Search official Coralogix docs by title or path. Args: query: Search text (for example "MCP setup" or "API keys"). limit: Max results (1-20, default 5). Returns: Plain-text list of matching doc titles and path suffixes (under /docs/).

search_docs

Search alert definitions in the team with flexible filters. This tool returns up to 30 matching alert definitions. Use the filters to narrow the result set before truncation. Args: order_bys: Optional list of order-by fields. name_matcher: How to match `name` values. Default: ``EQUALS``. name: Optional list of alert names to filter by. alert_type_matcher: How to match `alert_types`. Default: ``EQUALS``. alert_types: Optional list of alert types to filter by. priority_matcher: How to match `priorities`. Default: ``EQUALS``. priorities: Optional list of alert priorities to filter by. enabled: Optional filter for enabled/disabled alerts. modified_start_time: Optional start time for modification date filtering. modified_end_time: Optional end time for modification date filtering. last_triggered_start_time: Optional start time for last-triggered filtering. last_triggered_end_time: Optional end time for last-triggered filtering. Returns: JSON string of the returned alert definition summary payload.

search_alert_definitions

Find dashboards by semantic search or retrieve one by its exact ID. Exactly one of ``query`` or ``id`` must be provided: - ``query`` performs semantic search across indexed dashboards. - ``id`` fetches one dashboard's saved metadata, including widgets, queries, variables, filters, and field paths. Args: query: Natural-language description of the dashboard to find. Mutually exclusive with ``id``. id: Exact Coralogix dashboard ID for direct retrieval. Mutually exclusive with ``query``. limit: Maximum search results when using ``query`` (1-100, default 10). Ignored when ``id`` is provided. Returns: When ``query``: JSON string with ``total`` and ``results``. When ``id``: JSON string with dashboard metadata. Large dashboards may include ``truncated`` metadata.

search_dashboard

Find label names matching a substring across all metrics. Use when the user mentions a dimension/filter but you don't yet know which metric carries it, then follow up with `search_relevant_metrics(<label>, mode="by_label")`. See the metrics skill for the full workflow. Args: substring: Substring to match against label names (case-insensitive), e.g. "user_email" or "email". Returns: One matching label name per line (exact match first), or an error if none match.

search_labels

Batch search for log or span DataPrime field paths by description and/or value. Supports up to 5 search items at once. Each search item should be one of: - {"description": "..."} - Search by semantic description (e.g., "customer identifier fields") - {"value": "..."} - Search by entity/value (e.g., "Acme Corp", "production"); case-insensitive substring match on schema-store example values. Args: search_items: List of search items (up to 5). Each item is either a description or value search (not both). source: Dataset to search: ``logs`` or ``spans``. Returns: Search results with matching field paths and descriptions.

search_for_fields

Discover metrics by description, name pattern, or label. See the metrics skill for the full workflow. Args: query: The search term, interpreted per `mode`. mode: - "by_description" (default): semantic search over a natural-language description of what to measure. - "by_name": wildcard metric-name pattern, e.g. "http_*", "*_total". - "by_label": list the metrics exposing an EXACT label name, to pick a bridge metric for a PromQL join (use after `search_labels`). top_k: Max results, by_description only (default: 5). name_filter: by_label only — metric-name substring to narrow a truncated result. join_key_label: by_label only — an EXACT second label (the shared join key); returns only metrics carrying BOTH labels on the same series.

search_relevant_metrics

Search saved dashboard queries by meaning or by field reference. Use ``search_type`` to choose the mode: - ``semantic``: semantic search over saved dashboard queries. Requires ``query_text``. - ``by_field``: find saved queries that reference a specific field path. Requires ``field_path``. Args: search_type: ``semantic`` or ``by_field``. query_text: Natural-language query description for semantic search. field_path: Exact field path for field-based lookup, such as ``metadata.service``. limit: Maximum number of results to return (1-100, default 10). Returns: JSON string with ``total`` and ``results``.

search_queries

Set the team's custom per-model pricing overrides (team-wide, applies to new data only). `prices` maps model name to a pricing object {inputPricePerMillionTokens, outputPricePerMillionTokens, cacheReadPricePerMillionTokens, cacheWritePricePerMillionTokens}. Returns the result as JSON.

ai_center_set_model_pricing

Show details for a specific DataPrime command or function. Args: kind: Which section of the catalog to include: ``all`` (commands and functions), ``commands`` only, or ``functions`` only. name: The exact name of the command or function to show details for. Returns: JSON string with ``count`` and ``items``. Each item has ``name``, ``type`` (``command`` or ``function``), ``syntax``, ``description``, and ``category`` (``description`` may be shortened in the payload).

show_dataprime_command_details

Update a configured evaluation by UUID (e.g. enable/disable, change config/threshold). Partial patch: include only the fields you want to change in `updates`; omitted fields are left unchanged. Returns the updated evaluation as JSON.

ai_center_update_evaluation

Update a custom evaluation policy by UUID. Partial patch: include only the fields you want to change in `updates`; omitted fields are left unchanged. Returns the updated custom evaluation as JSON.

ai_center_update_custom_evaluation