coralogix/cx-cli

# Coralogix docs (`cx docs search`, `cx docs fetch`)

These commands read **official Coralogix product documentation** from [coralogix.com/docs](https://coralogix.com/docs). They answer **how the platform works** and **how to configure or use it**. They do **not** query your tenant's logs, spans, metrics, or alerts.

No Coralogix API key is required.

## CLI commands

| Command | Purpose |
|---------|---------|
| `cx docs search <query>` | Find doc pages by keyword. Returns numbered titles + path suffixes. |
| `cx docs fetch <suffix>` | Download one page as markdown. Pass the suffix from search. |

### Flags

# AI Center Skill

**This is the tool for anything about AI/GenAI applications** — both **questions** about their
behavior (prompts/responses, quality, hallucinations, guardrails, security, cost/tokens, errors,
latency — everything AI apps expose through their GenAI spans/tags) and **actions** to manage them
(applications, evaluations/policies, policy↔app links, model pricing). If a request touches an AI
application or its GenAI telemetry, use this skill.

Coralogix **AI Center** observes, evaluates, and guards GenAI/LLM applications. This skill
answers questions about AI apps from two sources:

- **Configuration** (this skill's `cx ai-center` commands): the AI application inventory,
  configured evaluations/policies, coverage, custom evaluations, and model pricing — none of
  which live in span telemetry.

# Alert Management Skill

Use this skill to list, inspect, create, delete, enable, and disable Coralogix alert definitions using the `cx alerts` CLI commands.

## CLI Commands

| Command | Purpose | Key flags |
|---|---|---|
| `cx alerts list` | List all alert definitions | `--name <filter>` |
| `cx alerts get <id>` | Get a single alert definition by ID | - |
| `cx alerts create` | Create an alert from a JSON definition | `--from-file <path>` (default: stdin) |
| `cx alerts delete <id>` | Delete an alert | - |
| `cx alerts enable <id>` | Enable an alert | - |
| `cx alerts disable <id>` | Disable an alert | - |

# Cases Management Skill

A **Case** groups related alert events into one investigation unit with a status,
priority, category, and assignee. Use this skill to inspect cases and drive them
through their lifecycle (active → acknowledged → resolved → closed).

## CLI Commands

| Command | Purpose |
|---|---|
| `cx cases get <id>` | Get a single case by ID |
| `cx cases update <id> [--title] [--resolution-reason]` | Update mutable fields |
| `cx cases comment <id> --text <text>` | Add a comment to the case timeline |
| `cx cases assign <id> --user <email>` | Assign a case (email, or raw user ID) |

# cx-cli

Cross-cutting behaviors for all cx CLI commands.

---

## Update Notifications

After running any cx command, check for update notices using the channels below (in priority order). If a newer version is available, finish answering the user's request first, then mention the update once at the end.

An update notice always has **two parts** — binary upgrade and skills refresh. Offer both commands; don't mention only the version number or only the binary upgrade.

### 1. Primary — toon mode (`-o toon`)

# Coding Agents Skill

Use this skill as the entry point for any investigation or data question about AI Center Coding Agents. It identifies which data source each agent uses and tells you which reference files to load before querying.

## Supported Agents

| Agent | Data Type | Source Identifier |
|---|---|---|
| Claude Code | Metrics | `claude_code_*` metric family |
| Claude Code (session text) | Logs | `source ai_sessions_claude` |
| Codex | Logs | `service.name == 'codex_cli_rs'` or `'codex-app-server'` |
| Codex (latency) | Spans | `$l.serviceName == 'codex_cli_rs'` or `'codex-app-server'` |
| Cursor | Spans | `$l.serviceName == 'cursor-agent'` |
| Gemini CLI | Metrics | `gemini_cli_*` metric family |

# Cost Optimization Skill

Use this skill when investigating or reducing Coralogix data costs. It covers the full cost management lifecycle: measuring current spend, reviewing TCO policies, adjusting retention periods, and configuring archive storage for cold data.

---

## CLI Commands

| Command | Subcommands | Purpose |
|---|---|---|
| `cx usage` | `summary`, `daily`, `logs-count`, `spans-count`, `export-status`, `capabilities`, `query` | Measure current data consumption and billable usage |
| `cx tco` | `list`, `get`, `create`, `update`, `delete`, `reorder`, `test`, `settings`, `settings-update` | Manage TCO (Total Cost of Ownership) policies |
| `cx retentions` | `list`, `update`, `activate`, `status` | Manage data retention periods |
| `cx archive logs` | `get`, `set` | Configure logs archive target |

# Create Coralogix Dashboard

Produces a Coralogix dashboard for a target service and deploys it via the `cx` CLI. Workflow: discover the service's telemetry, align on intent with the user, draft a plan, emit the JSON, live-verify every query through `cx`, then create the dashboard in a chosen folder.

Only use metric names, log fields, and span attributes you can cite from the service's code, README, configuration, or a live query that returned a result. Do not invent them.

---

## Reference files

Load these files for domain-specific guidance:

| Task | Reference |
|---|---|

# Data Pipeline Skill

Use this skill when configuring how Coralogix processes, enriches, and transforms data. It covers parsing rules (extract structured fields from raw logs), enrichments (add context from lookup tables), Events2Metrics (derive metrics from log/span events), and recording rules (precompute PromQL expressions).

---

## CLI Commands

| Command | Subcommands | Purpose |
|---|---|---|
| `cx parsing-rules` | `list`, `get`, `create`, `update`, `delete`, `bulk-delete`, `usage-limits` | Manage log parsing rules |
| `cx enrichments` | `list`, `add`, `remove`, `overwrite`, `limit`, `settings` | Manage enrichment rules |
| `cx enrichments custom` | `list`, `get`, `create`, `update`, `delete`, `search` | Manage custom enrichment tables |
| `cx e2m` | `list`, `get`, `create`, `update`, `delete`, `labels-cardinality`, `limits` | Manage Events2Metrics definitions |

# Infrastructure Resources

All commands live under `cx infra resources` and are read-only. Run
`cx infra resources <command> --help` for flags.

"Infrastructure monitoring is not enabled for this team" means the team has no
infrastructure data. Stop and say so. Do not retry or change filters.

A stderr line starting `warning: ... could not verify that infrastructure
monitoring is enabled` is informational: the enablement check itself failed and
the command still ran.

| Command          | Answers                                                        |
|------------------|----------------------------------------------------------------|

# Observability Setup Skill

Use this skill when setting up or configuring the observability stack - saved views, webhook integrations, notification channels, and external integrations. This is the "day 1 setup" skill for onboarding a new service or reconfiguring notification pipelines.

---

## CLI Commands

### Views

| Command | Purpose |
|---|---|
| `cx views list` | List all saved views |
| `cx views get <id>` | Get a view definition |

# Olly Observability Agent Skill

Use this skill to interact with Coralogix's Observability Agent (Olly) via the `cx olly` CLI commands. Olly can analyze your observability data, answer questions about alerts, metrics, logs, and generate artifacts like charts and reports.

`cx olly ask` defaults `--agent-to-agent-mode` to **false**. **If you're an LLM/agent, pass `--agent-to-agent-mode`** - see "Agent-to-agent mode" below.

## CLI Commands

| Command | Purpose | Key flags |
|---|---|---|
| `cx olly ask "message"` | Send a message to the Observability Agent | `--chat-id`, `--model`, `--timeout`, `--agent-to-agent-mode` |
| `cx olly artifacts list` | List all generated artifacts | - |
| `cx olly artifacts get <id>` | Get artifact content by ID | - |

# Platform Admin Skill

Use this skill for managing access, authentication, and authorization in Coralogix. It covers API key management, role and scope definitions, user administration, team groups, and IP access restrictions.

---

## Destructive Operation Safety

All write operations (create, update, delete, set-idp, set-active, set-status) require interactive confirmation. The CLI will prompt before executing. To skip the prompt in scripts, pass `--yes`.

**IMPORTANT: NEVER pass `--yes` without explicit user approval.** Before executing any write operation:
1. Describe the exact operation to the user (what will be created/modified/deleted)
2. Wait for the user to confirm
3. Only then execute with `--yes`

# Profiling Skill

Use this skill to answer **continuous-profiling** questions — which services
burn the most CPU or memory, and which functions inside a service are
responsible — via the Coralogix profiling API. Requires the
`profiles.cpu-profiles:Read` permission.

## CLI Commands

| Command | Purpose | Key flags |
|---|---|---|
| `cx profiling services` | Profiled services ranked by CPU+wall seconds (`cpu`) or allocated+heap bytes (`memory`) | `--category` (required), `--environment`, `--limit` (default 20, max 100), `--offset`, `--include-time-series` |
| `cx profiling metadata <service>` | A service's language and which profile types have data | - |
| `cx profiling filters <service>` | Label keys a service's profiles can be filtered by, with their values | `--profile-type` (required), `--filter`, `--max-values-per-key` (default 50) |

# RUM Setup Skill

Use this skill to onboard an application to Coralogix Real User Monitoring (RUM): get a RUM API key, install the platform SDK, add the `init` call, and verify events land in the `rum.events` dataset.

---

## CLI Commands

| Command | Purpose |
|---|---|
| `cx iam api-keys list -o json` | List candidate keys and the team ID (no permissions in output) |
| `cx iam api-keys send-data-keys -o json` | List candidate send-data keys (no permissions in output) |
| `cx iam api-keys get <id> -o json` | Read a key's permissions (`keyInfo.keyPermissions`) and value |
| `cx iam api-keys create --from-file <file>` | Create the RUM key (write - needs approval + `--yes`) |

# Dashboard Search Skill

Use this skill to discover existing Coralogix dashboards and widgets using semantic or field-based search via the `cx dashboards` CLI commands. Before creating a new dashboard, always search first to avoid duplication.

## CLI Commands

| Command | Purpose | Key flags |
|---|---|---|
| `cx dashboards search "<description>"` | Find dashboards by natural-language description | `--limit` |
| `cx dashboards query-search --description "<text>"` | Find widgets whose queries match a description | `--limit` |
| `cx dashboards query-search --field "<field-path>"` | Find all widgets that reference a specific field | `--limit` |
| `cx dashboards catalog -o json` | List all dashboards | - |
| `cx dashboards get <id> -o json` | Get full dashboard definition | - |

# Service Catalog Skill

Use this skill to discover and query **Service Catalog entities** — services,
databases, operations, database operations, JVMs, JVM GC, Kubernetes pods, and
transactions — and their columnar metrics (latency, error rate, health, resource
usage, etc.) via the v2 Service Catalog API.

## CLI Commands

| Command | Purpose | Key flags |
|---|---|---|
| `cx service-catalog entity-types` | List entity types this account has data for | - |
| `cx service-catalog schema <entity-type>` | Columns/labels schema for one entity type | - |
| `cx service-catalog entities <entity-type>` | Known entities of one type (e.g. service names) | - |

# SLO Management Skill

An **SLO** (Service Level Objective) defines a reliability target for a service —
e.g. "99.9% of requests succeed over 28 days". Use this skill to inspect SLO
definitions, judge whether they are healthy, and manage their lifecycle.

## CLI Commands

| Command | Purpose |
|---|---|
| `cx slos list` | List all SLO definitions |
| `cx slos get <id>` | Get a single SLO by ID |
| `cx slos create --from-file <path>` | Create an SLO from a JSON definition [requires `--yes`] |
| `cx slos update --from-file <path>` | Replace an SLO definition from JSON [requires `--yes`] |

# Telemetry Querying Skill

Use this skill as the entry point for any investigation, debugging, or data question that may be answered from telemetry data. It helps you decide **where** the relevant signal lives (metrics, logs, traces, RUM) and tells you **which reference files to load** before querying.

## Loading References

Before querying, load the reference files for the chosen pillar:

| Pillar | Load these files |
|---|---|
| Logs | `references/dataprime-reference.md` + `references/logs-querying.md` |
| Spans / Traces | `references/dataprime-reference.md` + `references/spans-querying.md` |
| Metrics | `references/promql-guidelines.md` + `references/metrics-querying.md` |
| RUM (frontend) | `references/dataprime-reference.md` + `references/rum-querying.md` + `references/rum-fields.md` |