Open in ChatGPTOpen in Claude

Schema explorer

Overview

Schema Explorer helps you unify and control the structure of your logs in Coralogix. Since logs often come from many sources with different naming conventions, inconsistencies can quickly make analysis harder.

The Schema Explorer automatically detects, highlights, and reports on these differences so you can:

• Prevent duplicate fields.
• Reduce query errors caused by inconsistent keys.
• Discover and resolve duplicate or conflicting fields.
• Provide feedback to developers when fields are misaligned.

How it works

1. Ingestion – Coralogix ingests all log fields, regardless of structure or naming convention.
2. Detection – Schema Management identifies duplicate or similar keys.
3. Analysis – You can explore how each field is used, how often it appears, and its unique values.
4. Unification – Align conflicting keys into a single schema, ensuring consistency across teams and services.

Select a dataspace and dataset

Schema Explorer scopes every report to a single dataset. Two selectors at the top of the report control what you're viewing:

• Dataspace — the data tier. Options appear in a fixed order: default, then frequentsearch (when your account sends Frequent Search data), then any others, with system last.
• Dataset — the data type within that dataspace, such as logs or spans.

Select a dataspace, then a dataset, to load its report. Switching either selector loads the matching schema.

View your Frequent Search logs schema

The logs dataset in the default dataspace covers all your logs. If your account sends high-priority Frequent Search logs, the frequentsearch dataspace appears as its own entry, letting you inspect the hot-tier logs schema on its own — the same field-level report you get for every other dataset.

To view it:

1. Go to Data Flow, then Schema Manager, and select the Schema explorer tab.
2. Select frequentsearch as the dataspace.
3. Select logs as the dataset.

The report shows the fields, mapping status, popularity, and cardinality for your Frequent Search logs only. The default logs report is unchanged and continues to cover all logs, so you can switch between the two to compare the hot-tier schema against your full log schema.

Note

The frequentsearch dataspace appears only if your account has Frequent Search data. This split applies to logs, not spans.

Key features

Schema Explorer provides a complete view of the fields ingested across your logs. For each field, you can see:

• Path — The field name and location.
• Mapping status — Indexing status for the selected time range:
  • Mapped — Indexed.
  • Unmapped — Not indexed.
  • Partially mapped — Indexed for part of the time range.
• Mapping exceptions — The count of mapping exceptions, which occur when multiple applications send the same field with different data types.
• Type — Data type (string, numeric, object, and so on).
• Popularity over time — How frequently the field appears.
• Cardinality — Number of unique values and how it changes over time.
• First seen / Last seen — When the field was ingested.

This helps you identify fields that may be redundant, inconsistent, or unexpectedly missing. To see what a field represents, how it is trending, and which applications and subsystems send it, drill down into the keypath.

Report frequency and retention

Schema Explorer captures schema reports on a recurring schedule so you can track how your fields change over time. Use the report frequency selector to select how often Coralogix generates a report:

Frequency	Retention
Daily	30 days
Weekly	12 weeks
Monthly	24 months

Daily and weekly reports are best for catching recent mapping exceptions and naming drift. Monthly reports give you a longer-term view of schema growth for governance and capacity planning.

Drill down into a keypath

Select any keypath row in the report to open its drilldown. The drawer opens over the report and keeps the selected row highlighted, so you can read a field's description, its trends, and its sources without losing your place. Select the fullscreen icon to expand the drawer, and the close icon or Escape to return to the report.

The drawer header repeats the keypath, its data types, and its mapping status, followed by its Popularity, Cardinality, First seen, and Last seen values for the selected period. First seen and Last seen are shown in UTC.

The report frequency and period selectors in the drawer header start from the report's current selection. Change either one to recalculate this keypath's figures, charts, and sources. The report behind the drawer keeps its own selection.

Note

Schema data is summarized once a day at 00:00 UTC, and a report can take several hours to become available. The drilldown reflects the last completed report for the selected period rather than live traffic.

Overview tab

The Overview tab covers what the field is and how it is behaving over time:

• AI Description: a short description of the field generated by Olly. See Field descriptions.
• Popularity over time: how often the field appears across the selected period.
• Cardinality over time: how the field's number of unique values changes across the selected period.

The two charts share a cursor, so hovering one marks the same point on the other. Read them together to tell a field that is growing from one that is stable before you decide to index, drop, or reshape it.

Field descriptions

AI Description is a short, AI-generated explanation of what the field represents, scoped to the dataset you are viewing. Descriptions are stored separately from schema reports, so an edit takes effect immediately and does not wait for the next report to generate.

To edit a description:

1. On the Overview tab, select Edit description.
2. Update the text. A description holds up to 500 characters.
3. Select Save.

Your edit persists across sessions and is reflected in Olly's subsequent analysis of the field. Olly does not overwrite descriptions you have edited. Editing requires TEAM-SCHEMA-MANAGER:MANAGE. See Permissions.

Data source tab

The Data source tab answers where a keypath is coming from. Each row is one distinct combination of the labels Coralogix recorded for that keypath:

• One column per label. applicationName and subsystemName appear as tags. Any other label keeps its own name as the column header.
• First seen and Last seen: when that combination was first and last ingested, in UTC.
• Cardinality: the number of unique values that combination sent. The table opens sorted by cardinality, highest first.

The table shows 20 rows per page. Use Search values to narrow it to a single application, subsystem, or other label value.

Continue in Explore Logs

Two actions on the Data source tab carry the keypath into investigation. Both use the dataset and the time window currently selected in the drawer:

• Open in Explore Logs opens Explore Logs in a new tab, with a DataPrime query already filtered to the keypath.
• View query opens a panel showing the query behind the table: the same keypath filter, grouped by the table's label columns, with a distinct-value count and a total count. Copy the query, or run it from the panel in Explore Logs.

View query is unavailable for a keypath that returned no labels to group by. Use Open in Explore Logs instead. For a keypath inside an array, the query shows the keypath filter on its own, because grouping over array elements inflates the counts.

Example scenario

You have three services sending user data:

• Service A uses surname
• Service B uses familyname
• Service C uses family-name

Without Schema Management, your queries might miss data because the fields don’t match. With Schema Management, you can detect these variations and map them to a unified key such as last_name.

Explore fields in Schema Explorer

1. Go to Data Flow, then Schema Manager, and select the Schema explorer tab.
2. Use the search bar to find specific fields.
3. Review each field's popularity, type, mapping status, and cardinality to identify duplicates or inconsistencies.
4. Select a keypath row to drill down into it for its description, trends, and sources.
5. Use Mapping Exceptions to align similar fields into a single schema.

Filter and sort fields

A single report can list thousands of fields. Use filters and sorting to focus on the fields that need attention.

Filter fields

Select Filtered by to build one or more filters and combine them:

• Type — filter by data type, such as string or numeric.
• Mapping status — Mapped, Unmapped, or Partially mapped.
• Issues — show only fields flagged with a schema issue.
• Popularity, Cardinality, and Mapping Exceptions — numeric filters. Use >= to set a minimum or < to set a maximum. For example, filter Mapping Exceptions >= 1 to show only fields that have type collisions.

To find a field by name, enter its keypath in the Search table box.

Sort fields

Select a column header to sort by that column. You can sort by Keypath, Popularity, Cardinality, First seen, Last seen, Mapping status, and Mapping Exceptions. Schema Explorer sorts by one column at a time.

Switch between tree and flat views

By default, Schema Explorer shows fields in a tree view that nests keypaths under their parents, so you can see the structure of your data. To list every field on its own row instead, turn on the Flat view toggle above the grid. Turn it off to return to the tree view.

Best practices

• Regularly check for new fields ingested to catch inconsistent naming early.
• Standardize field names with your development teams to reduce mapping exceptions.
• Reserve fields for critical identifiers that must remain consistent across services.

To take schema governance a step further, Coralogix provides Reserved Fields which are a way to explicitly define the fields that matter most for your queries, alerts, and dashboards. While Schema Explorer helps you discover and analyze fields, Reserved Fields let you lock in critical ones, ensuring they are always indexed with the correct type and available for use.

Next steps

Explicitly define fields of importance for querying and monitoring with Reserved fields.

Permissions

Permissions

Resource	Description	System roles	API presets
TEAM-SCHEMA-MANAGER:READCONFIG	View field names, types, cardinality, popularity, and other schema-level metrics.	Data Admin, Observability Lead, Platform Admin, Read-Only User, Security User, Standard User	—
TEAM-SCHEMA-MANAGER:MANAGE	Edit, reserve, or map schema fields.	Data Admin, Observability Lead, Platform Admin	—
GLOBAL-MAPPING:READCONFIG	View Label Mapping.	Data Admin, Observability Lead, Platform Admin, Read-Only User, Standard User	—
GLOBAL-MAPPING:UPDATECONFIG	Manage Label Mapping.	Data Admin, Observability Lead, Platform Admin	—