---
title: Access mechanisms
description: Schema of the DataPrime `$m` metadata, `$l` label, and `$p` parameter keypaths, with field types, datasets, and accepted aliases.
url: https://coralogix.com/docs/dataprime/language-reference/access_mechanisms/
product: dataengine
feature: DataPrime Language
feature_id: dataprime-language
feature_identifier: dataengine/dataprime-language
last_updated: '2026-11-12'
---

# Access mechanisms

Note

Metadata fields (`$m`) aren't shown as structured key/value rows in the [Log details panel](https://coralogix.com/docs/user-guides/data_exploration/logs/info_panel.md#view-metadata-fields). They appear only nested in the panel's raw JSON. Querying them with the `$m.<field>` mechanisms below is the most reliable way to read and inspect metadata values.

## `$m.<field>` Schema

Field names below are listed as the schema stores them. Several of them have a second accepted spelling, and queries resolve either one. See [Canonical names and accepted aliases](#canonical-names-and-accepted-aliases).

\`$m.\<field>\`

Metadata and runtime characteristics sourced from log and span records, used in enrichment and analytics contexts.

branchid

Branch identifier for the source system.<br /><!-- -->Type: `string`<br /><!-- -->Dataset: `logs`

cxEventId

Coralogix event identifier for a span.<br /><!-- -->Type: `string`<br /><!-- -->Dataset: `spans`

duration

Duration of the span in time units.<br /><!-- -->Type: `number`<br /><!-- -->Dataset: `spans`

endTime

Span end time.<br /><!-- -->Type: `number`<br /><!-- -->Dataset: `spans`

ingressTimestamp

Ingestion time into the logging system.<br /><!-- -->Type: `timestamp`<br /><!-- -->Dataset: `logs`

logid

Unique identifier for a log record.<br /><!-- -->Type: `string`<br /><!-- -->Dataset: `logs`

priorityclass

Log priority classification.<br /><!-- -->Type: `string`<br /><!-- -->Dataset: `logs`

processingOutputTimestampMicros

Processing timestamp in microseconds.<br /><!-- -->Type: `number`<br /><!-- -->Dataset: `logs`

processingOutputTimestampNanos

Processing timestamp in nanoseconds.<br /><!-- -->Type: `number`<br /><!-- -->Dataset: `logs`

severity

Severity level of the log.<br /><!-- -->Type: `Severity`<br /><!-- -->Dataset: `logs`

templateid

Template identifier for log parsing.<br /><!-- -->Type: `string`<br /><!-- -->Dataset: `logs`

timestamp

Timestamp of the log event or start time of the span.<br /><!-- -->Type: `timestamp`<br /><!-- -->Dataset: `logs`, `spans`

timestampMicros

Timestamp in microseconds.<br /><!-- -->Type: `number`<br /><!-- -->Dataset: `logs`

timestampMillis

Span start time in milliseconds.<br /><!-- -->Type: `number`<br /><!-- -->Dataset: `spans`

### Possible `$m` keys

| keypath                            | json\_type | dataset     |
| ---------------------------------- | ---------- | ----------- |
| $m.branchid                        | string     | logs        |
| $m.cxEventId                       | string     | spans       |
| $m.duration                        | number     | spans       |
| $m.endTime                         | number     | spans       |
| $m.ingressTimestamp                | timestamp  | logs        |
| $m.logid                           | string     | logs        |
| $m.priorityclass                   | string     | logs        |
| $m.processingOutputTimestampMicros | number     | logs        |
| $m.processingOutputTimestampNanos  | number     | logs        |
| $m.severity                        | Severity   | logs        |
| $m.templateid                      | string     | logs        |
| $m.timestamp                       | timestamp  | logs, spans |
| $m.timestampMicros                 | number     | logs        |
| $m.timestampMillis                 | number     | spans       |

***

## `$l.<field>` Schema

\`$l.\<field>\`

Label metadata associated with the source or origin of a log or span.

applicationname

Name of the application that emitted the log or span.<br /><!-- -->Type: `string`<br /><!-- -->Dataset: `logs`, `spans`

category

Logical category or classification of the log source.<br /><!-- -->Type: `string`<br /><!-- -->Dataset: `logs`

computername

Hostname or identifier of the machine where the log originated.<br /><!-- -->Type: `string`<br /><!-- -->Dataset: `logs`

env

Environment of the log or span, added on ingest.<br /><!-- -->Type: `string`<br /><!-- -->Dataset: `logs`, `spans`

envType

Environment type of the log or span, added on ingest.<br /><!-- -->Type: `string`<br /><!-- -->Dataset: `logs`, `spans`

operationName

Span operation name representing the traced action.<br /><!-- -->Type: `string`<br /><!-- -->Dataset: `spans`

serviceName

Service name associated with the log or span's origin. On logs, added on ingest.<br /><!-- -->Type: `string`<br /><!-- -->Dataset: `logs`, `spans`

subsystemname

Subsystem identifier within the application or service.<br /><!-- -->Type: `string`<br /><!-- -->Dataset: `logs`, `spans`

### Possible `$l` keys

Coralogix adds `$l.env`, `$l.envType`, and `$l.serviceName` (on logs) on ingest. See [Default labels](https://coralogix.com/docs/user-guides/data-layer/default-labels.md) for where each value comes from.

| keypath            | json\_type | dataset     |
| ------------------ | ---------- | ----------- |
| $l.applicationname | string     | logs, spans |
| $l.category        | string     | logs        |
| $l.computername    | string     | logs        |
| $l.env             | string     | logs, spans |
| $l.envType         | string     | logs, spans |
| $l.operationName   | string     | spans       |
| $l.serviceName     | string     | logs, spans |
| $l.subsystemname   | string     | logs, spans |

***

## Canonical names and accepted aliases

The same logical label or metadata field is spelled differently depending on which dataset holds it. A field written as `$l.applicationName` in one dataset is `$l.applicationname` in another, and `$m.cxEventId` is `$m.logid` for logs. Coralogix resolves both spellings, so a query written against one dataset returns the same records when it runs against another.

Reference either spelling and the query engine looks up both. You don't need `firstNonNull`, and there's nothing to enable.

| Canonical name       | Also accepted              | Difference      |
| -------------------- | -------------------------- | --------------- |
| `$l.applicationName` | `$l.applicationname`       | casing          |
| `$l.className`       | `$l.classname`             | casing          |
| `$l.computerName`    | `$l.computername`          | casing          |
| `$l.ipAddress`       | `$l.ipaddress`             | casing          |
| `$l.methodName`      | `$l.methodname`            | casing          |
| `$l.subsystemName`   | `$l.subsystemname`         | casing          |
| `$l.threadId`        | `$l.thread`, `$l.threadid` | name and casing |
| `$m.branchId`        | `$m.branchid`              | casing          |
| `$m.cxEventId`       | `$m.logid`                 | name            |
| `$m.priorityClass`   | `$m.priorityclass`         | casing          |
| `$m.templateId`      | `$m.templateid`            | casing          |

Resolution covers queries you run through the Coralogix query engine, which includes Explore, Custom Dashboards, and the query APIs. Alert matching is being aligned separately; for now, write alert conditions against the spelling the dataset actually stores. Prefer the canonical name in anything new. The aliases stay supported.

<!-- -->

### What resolution does and doesn't cover

* **Only one spelling holds a value in any given record**, so reading either one returns that value. In the rare case where a record carries both, the canonical name wins.
* **Aliases apply to `$l` and `$m` only.** User data under `$d` is passed through as written, so `$d.applicationname` and `$d.applicationName` stay two separate fields.
* **Resolution changes how a query matches, not how your data is stored.** `default/logs` is still written with the lowercase spelling and user-defined datasets with the canonical one. Records you export through the API or from Explore carry whichever spelling the producer wrote, so a script that reads `$l.applicationname` out of exported `default/logs` data keeps working unchanged.
* **The query editor recognizes both spellings too.** Query `default/logs` for `$l.applicationName`, or `default/spans` for `$l.applicationname`, and the editor accepts the keypath instead of reporting `keypath does not exist`. The editor doesn't rewrite your query. Autocomplete lists only the field names the schema returns for each dataset, so it doesn't suggest the other spelling.

### Where the original semantics still apply

Alias resolution happens in the Coralogix query engine. Queries that reach your data without passing through it keep the field names and match semantics of the underlying store, so use the spelling that store expects:

* [Tableau plugin](https://coralogix.com/docs/user-guides/visualizations/tableau-plugin.md), which connects through the Coralogix JDBC driver.
* [Grafana plugin](https://coralogix.com/docs/user-guides/visualizations/grafana-plugin.md), when Coralogix is added as an OpenSearch data source in an external Grafana.
* [OpenSearch API](https://coralogix.com/docs/user-guides/visualizations/hosted-opensearch-view/opensearch-api.md), and the [hosted OpenSearch view](https://coralogix.com/docs/user-guides/visualizations/hosted-opensearch-view.md) built on it.

***

## `$p.<field>` Schema

$p.\\\<field>

Parameter fields representing time window and resolution hints.

timeRange

Time bounding parameters and query resolution guidance.

startTime

The inclusive lower bound of the query time range.<br /><!-- -->Type: `timestamp`<br /><!-- -->Dataset: `logs`, `spans`

endTime

The exclusive upper bound of the query time range.<br /><!-- -->Type: `timestamp`<br /><!-- -->Dataset: `logs`, `spans`

suggestedInterval

Suggested resolution interval for aggregations (e.g. histogram buckets).<br /><!-- -->Type: `interval`<br /><!-- -->Dataset: `logs`, `spans`

### Possible `$p` keys

| keypath                        | json\_type | dataset     |
| ------------------------------ | ---------- | ----------- |
| $p.timeRange.endTime           | timestamp  | logs, spans |
| $p.timeRange.startTime         | timestamp  | logs, spans |
| $p.timeRange.suggestedInverval | interval   | logs, spans |