Default labels

Open in ChatGPTOpen in Claude

On ingest, Coralogix adds three default labels to logs and spans: $l.env, $l.envType, and $l.serviceName. They sit next to the existing $l.applicationName and $l.subsystemName labels and use the same names on logs and spans, so one filter such as $l.env == 'production' works on both. Before these labels, the service and environment of a record sat in a different field depending on the source that sent it.

You don't need to set anything up. Coralogix fills the labels from fields your data already carries. To choose which fields fill each label, use the Pipeline Label Mapping page.

Note

Default labels are available in the EU2 region. Other regions will follow.

What you need

• Logs or spans ingested in a region where default labels are available. Records ingested before the labels reached your region don't carry them.
• To view the label sources: the default-labels:ReadConfig permission.
• To change the label sources: the default-labels:UpdateConfig permission.

How each label gets its value

For each label, Coralogix checks a list of sources in order and takes the first one that holds a non-empty value. If no source has a value, the record doesn't get that label.

The tables below list the default sources. You can change them for your account on the Pipeline Label Mapping page.

Logs

Label	Sources, in order
$l.serviceName	1. The OpenTelemetry resource attribute service.name (or service_name) 2. The subsystem name ($l.subsystemName)
$l.env	1. The OpenTelemetry resource attribute deployment.environment.name (or deployment_environment_name) 2. The deprecated resource attribute deployment.environment (or deployment_environment) 3. The application name ($l.applicationName)
$l.envType	No default source

The underscore forms cover logs processed by the Coralogix OpenTelemetry extension packs, whose parsing rule replaces dots in field names with underscores. RUM events follow the logs sources.

Spans

Label	Sources, in order
$l.serviceName	Unchanged. Spans already carry $l.serviceName from the span's process service name.
$l.env	1. The process tag deployment.environment.name 2. The span tag deployment.environment.name 3. The deprecated process tag deployment.environment 4. The application name ($l.applicationName)
$l.envType	No default source

Because spans already used $l.serviceName, a log and a span from the same service now match on the same $l.serviceName value when the log carries service.name or a matching subsystem name.

Environment type

$l.envType is reserved for the type of environment, such as production or staging. OpenTelemetry has no stable attribute for it, so Coralogix doesn't fill it from a default source and the label is empty on most records. To fill it, add a source field for Environment type on the Pipeline Label Mapping page.

Records ingested before default labels reached your region, or before you added a source for environment type, have no $l.envType. A filter such as $l.envType == 'production' doesn't match them, and when you group by $l.envType they appear with an empty value.

Change the label sources

The Pipeline Label Mapping page shows the source fields of each label, in order, and lets you change them. Logs and spans have separate settings.

1. Navigate to Data Flow, then Pipeline Label Mapping.
2. In the Logs or Spans card, find the label to change: Environment, Environment type, or Service name. The fields under each label are its sources, in priority order. The first field with a value wins.
3. Change the sources:
   • To add a field, select + and choose from Labels, such as application and subsystem name, or Fields inside the record, such as OpenTelemetry attributes. The picker lists the fields Coralogix saw on that signal over the last day. A label takes up to 10 fields.
   • To change the order, drag a field to a new position.
   • To remove a field, select × on it.
   • To go back to the default sources, select Reset to default.
4. Select View changes to review your edits, then select Save changes.

Changes apply to everyone in the account, for new data only. Records already stored keep the values they had when they were ingested.

Spans don't have a Service name row, because spans take $l.serviceName from the span's process service name.

Query default labels

Use the labels in DataPrime and Lucene queries the same way as any other label.

Find the error logs of one service in production:

source logs
| filter $l.serviceName == 'checkout' && $l.env == 'production'
| filter $m.severity == ERROR

Count logs per environment and service:

source logs
| countby $l.env, $l.serviceName

Filter spans by environment in Lucene:

$l.env:"production"

The labels are also available in TCO policy expressions, where $l.env and $l.serviceName apply to logs and $l.env applies to spans.

Get accurate values

• Set service.name and deployment.environment.name as resource attributes in your OpenTelemetry instrumentation. These take priority over the application and subsystem names.
• If your OpenTelemetry SDK can't find a service name, it sends a default value such as unknown_service, and that value becomes $l.serviceName. Set service.name explicitly to avoid it.
• For data that doesn't come from OpenTelemetry, the labels follow your application and subsystem names: $l.env takes the application name and $l.serviceName takes the subsystem name.

Related resources

• Access mechanisms
• How data is processed
• Application and subsystem names