Linking Coralogix as a source

Alpha release

This source is currently in alpha. The interface and available tables may change.

The Coralogix connector syncs your logs and trace spans into the PostHog Data warehouse via the DataPrime query API, so you can analyze reliability, errors, and telemetry alongside your product data.

Prerequisites

You need a Coralogix account and permission to create a personal or team API key. The key must include the DataQuerying permission preset. To use the Archive query tier, your Coralogix account must have archiving enabled.

Adding a data source

In PostHog, go to the Sources tab of the data pipeline section.
Click + New source and click Link next to this source.
Enter your credentials (see Configuration below) and click Next.
Select the tables you want to sync, choose a sync method and frequency, then click Import.

Once the syncs are complete, you can start querying this data in PostHog.

When linking Coralogix, you'll need:

Coralogix domain – the domain your account lives on, shown in your Coralogix URL (for example coralogix.us for US1 or eu2.coralogix.com for EU2). Querying the wrong domain fails with a permission error.
API key – create a personal or team key in Coralogix under Settings → API keys and grant it the DataQuerying permission preset.
Query tier – Frequent search queries your indexed retention and works out of the box. Archive queries your S3 archive instead, which reaches further back but requires archiving to be enabled.

Sync modes

Each table can be synced in one of several modes, depending on what the source supports:

Webhook (when available) – the source pushes changes to PostHog in real time. Fastest freshness, lowest ongoing cost, and the only mode that reliably captures updates and deletes.
Incremental – only new or updated rows are synced on each run, using a cursor field (such as an updated_at timestamp). Cheaper than a full refresh, but deletes aren't captured.
Append only – new rows are appended using a cursor field; existing rows are never updated. Ideal for immutable, append-only tables like event logs.
Full refresh – the whole table is reloaded on every sync. Use it when a table has no reliable cursor or when you need deletions reflected.

See sync methods for a full explanation of how each mode works and how to choose between them.

Logs and spans are immutable, so append is the recommended sync method: each run picks up from the newest previously synced timestamp. The initial sync (and every full refresh) pulls the last 7 days of data.

Configuration

Option	Type	Required
`Coralogix domain`	select	Yes
`API key`	password	Yes
`Query tier`	select	Yes

Supported tables

Each row carries the record's metadata (like timestamp, severity, and logid) and labels (like applicationname and subsystemname) as columns, with the raw log or span body as a JSON string in the user_data column.

Table	Description	Sync method	Incremental field	Primary key
`logs`	Raw logs queried via DataPrime (`source logs`). Only syncs the last 7 days on initial sync and full refresh.	Append only, Full refresh	timestamp	logid
`spans`	Raw spans queried via DataPrime (`source spans`). Only syncs the last 7 days on initial sync and full refresh.	Append only, Full refresh	timestamp	—

Troubleshooting

If you see an authentication or permission error, the API key is invalid, is missing the DataQuerying permission preset, or the selected domain doesn't match your Coralogix account. Fix the key or domain, then reconnect.
If archive syncs fail while frequent search works, check that archiving is enabled on your Coralogix account.

If your sync is failing or data looks wrong, see the Data warehouse troubleshooting guide. If that doesn't help, contact support – we're happy to help.