📘
Availability
See the Incident Workflow Actions Overview table for the plans this workflow is available on.

Description

Search for logs in Coralogix within a specified time range. This action retrieves diagnostic data from Coralogix programmatically during incident response, so your team can analyze logs as part of an automated workflow instead of running manual searches.

Prerequisites

A configured Coralogix connection to use for the query.

Instructions

If you have not done so, follow the instructions to Create an Incident Workflow.
When the instructions prompt you to add actions, select this action.
Enter the following Inputs and click Save.
Continue following instructions to Publish the Workflow.
When the action runs, you will see the Outputs listed below.

Inputs

📘
Field References
Fields with the {+} icon accept Field References, which can be useful for referencing incident data or outputs created in prior workflow steps. To add Field References, click {+}, or enter {{, and select relevant fields. Refer to the Field References article for more information.

🚧
Frequent Search Limit
The search window defined by Start Time and End Time must be 192 hours (8 days) or less, which is the Frequent Search limit in Coralogix.

📘
Numeric Field Comparisons
When comparing a numeric field that may be stored as text, cast it with :num (e.g. $d.status_code:num >= 500).

Name	Description
Connection Input	The Coralogix connection to use for the query.
Query	A DataPrime query (e.g. `source logs \| filter $d.status_code:num >= 500`). Use `source logs` to return all logs. When comparing a numeric field that may be stored as text, cast it with `:num`.
Start Time	Start of the search window. Pick a predefined relative time from the list, or pass an ISO 8601 timestamp (e.g. `2025-10-07T14:00:00Z`). The window must be 192 hours or less, per the Frequent Search limit.
End Time	End of the search window. Pick a predefined relative time from the list, or pass an ISO 8601 timestamp (e.g. `2025-10-07T16:00:00Z`).
Limit (Optional)	Maximum number of log entries to return. Maximum: 1000. This is applied as the DataPrime query limit; if the query already ends with its own limit, the smaller of the two wins.

Outputs

Name	Description
Logs	Array of log entries retrieved. Each entry includes timestamp, severity, applicationName, subsystemName, message, and a fields object holding the full userData verbatim (the message and every custom field).
Log Count	Total number of log entries returned.
Query Used	The DataPrime query sent to Coralogix.
Time Range Start	The start time used for the search.
Time Range End	The end time used for the search.
Result	Value that shows if the action was successful or not. Either `Success` or `Failed`.
Result Summary	Brief description of what the action did or if it failed.
Error	Brief description that is populated if the action failed.