---
title: Default labels
description: Coralogix adds the env, envType, and serviceName labels to every log and span on ingest, so you can query service and environment with the same keys across sources.
url: https://coralogix.com/docs/user-guides/data-layer/default-labels/
product: dataengine
feature: Data Engine Overview
feature_id: dataengine-general
feature_identifier: dataengine/dataengine-general
last_updated: '2026-11-09'
---

# Default labels

On ingest, Coralogix adds three default labels to logs and spans: `$l.env`, `$l.envType`, and `$l.serviceName`. They sit next to the existing `$l.applicationName` and `$l.subsystemName` labels and use the same names on logs and spans, so one filter such as `$l.env == 'production'` works on both. Before these labels, the service and environment of a record sat in a different field depending on the source that sent it.

You don't need to set anything up. Coralogix fills the labels from fields your data already carries. To choose which fields fill each label, use the [Pipeline Label Mapping](#change-the-label-sources) page.

Note

Default labels are available in the EU2 region. Other regions will follow.

## What you need

* Logs or spans ingested in a region where default labels are available. Records ingested before the labels reached your region don't carry them.
* To view the label sources: the `default-labels:ReadConfig` permission.
* To change the label sources: the `default-labels:UpdateConfig` permission.

## How each label gets its value

For each label, Coralogix checks a list of sources in order and takes the first one that holds a non-empty value. If no source has a value, the record doesn't get that label.

The tables below list the default sources. You can change them for your account on the [Pipeline Label Mapping](#change-the-label-sources) page.

### Logs

| Label            | Sources, in order                                                                                                                                                                                                                                             |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `$l.serviceName` | 1. The OpenTelemetry resource attribute `service.name` (or `service_name`)<br />2. The subsystem name (`$l.subsystemName`)                                                                                                                                    |
| `$l.env`         | 1. The OpenTelemetry resource attribute `deployment.environment.name` (or `deployment_environment_name`)<br />2. The deprecated resource attribute `deployment.environment` (or `deployment_environment`)<br />3. The application name (`$l.applicationName`) |
| `$l.envType`     | No default source                                                                                                                                                                                                                                             |

The underscore forms cover logs processed by the Coralogix OpenTelemetry extension packs, whose parsing rule replaces dots in field names with underscores. RUM events follow the logs sources.

### Spans

| Label            | Sources, in order                                                                                                                                                                                                   |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `$l.serviceName` | Unchanged. Spans already carry `$l.serviceName` from the span's process service name.                                                                                                                               |
| `$l.env`         | 1. The process tag `deployment.environment.name`<br />2. The span tag `deployment.environment.name`<br />3. The deprecated process tag `deployment.environment`<br />4. The application name (`$l.applicationName`) |
| `$l.envType`     | No default source                                                                                                                                                                                                   |

Because spans already used `$l.serviceName`, a log and a span from the same service now match on the same `$l.serviceName` value when the log carries `service.name` or a matching subsystem name.

### Environment type

`$l.envType` is reserved for the type of environment, such as production or staging. OpenTelemetry has no stable attribute for it, so Coralogix doesn't fill it from a default source and the label is empty on most records. To fill it, add a source field for **Environment type** on the [Pipeline Label Mapping](#change-the-label-sources) page.

Records ingested before default labels reached your region, or before you added a source for environment type, have no `$l.envType`. A filter such as `$l.envType == 'production'` doesn't match them, and when you group by `$l.envType` they appear with an empty value.

## Change the label sources

The **Pipeline Label Mapping** page shows the source fields of each label, in order, and lets you change them. Logs and spans have separate settings.

1. Navigate to **Data Flow**, then **Pipeline Label Mapping**.

2. In the **Logs** or **Spans** card, find the label to change: **Environment**, **Environment type**, or **Service name**. The fields under each label are its sources, in priority order. The first field with a value wins.

3. Change the sources:

   <!-- -->

   * To add a field, select **+** and choose from **Labels**, such as application and subsystem name, or **Fields** inside the record, such as OpenTelemetry attributes. The picker lists the fields Coralogix saw on that signal over the last day. A label takes up to 10 fields.
   * To change the order, drag a field to a new position.
   * To remove a field, select **×** on it.
   * To go back to the default sources, select **Reset to default**.

4. Select **View changes** to review your edits, then select **Save changes**.

Changes apply to everyone in the account, for new data only. Records already stored keep the values they had when they were ingested.

Spans don't have a **Service name** row, because spans take `$l.serviceName` from the span's process service name.

## Query default labels

Use the labels in DataPrime and Lucene queries the same way as any other label.

Find the error logs of one service in production:

```
source logs

| filter $l.serviceName == 'checkout' && $l.env == 'production'

| filter $m.severity == ERROR
```

Count logs per environment and service:

```
source logs

| countby $l.env, $l.serviceName
```

Filter spans by environment in Lucene:

```
$l.env:"production"
```

The labels are also available in TCO policy expressions, where `$l.env` and `$l.serviceName` apply to logs and `$l.env` applies to spans.

## Get accurate values

* Set `service.name` and `deployment.environment.name` as resource attributes in your OpenTelemetry instrumentation. These take priority over the application and subsystem names.
* If your OpenTelemetry SDK can't find a service name, it sends a default value such as `unknown_service`, and that value becomes `$l.serviceName`. Set `service.name` explicitly to avoid it.
* For data that doesn't come from OpenTelemetry, the labels follow your [application and subsystem names](https://coralogix.com/docs/user-guides/account-management/account-settings/application-and-subsystem-names.md): `$l.env` takes the application name and `$l.serviceName` takes the subsystem name.

## Related resources

* [Access mechanisms](https://coralogix.com/docs/dataprime/language-reference/access_mechanisms.md)
* [How data is processed](https://coralogix.com/docs/user-guides/data-layer/data-processing.md)
* [Application and subsystem names](https://coralogix.com/docs/user-guides/account-management/account-settings/application-and-subsystem-names.md)