Use this skill when the user asks to "check data usage", "list TCO policies", "reduce Coralogix costs", "optimize observability spend", "lower our logging bill", "data budget exceeded", "TCO policy", "retention tier", "archive storage", "ingestion costs", "frequent search vs archive", "why is our bill so high", "spending too much on logs", "data retention settings", "cost analysis", "usage breakdown", "optimize log volume", "control data ingestion", "archive cold data", "billing units", "plan co
This skill guides an agent through investigating and reducing Coralogix observability spend using the `cx` command-line tool. It addresses the recurring problem of runaway logging and telemetry bills by covering the full cost-management lifecycle: measuring current data consumption, reviewing TCO (Total Cost of Ownership) policies that route logs between expensive Frequent Search and cheap Archive tiers, adjusting retention periods, and configuring archive storage for cold data. The emphasis is on grounding any billing answer in authoritative, tenant-specific data rather than guesswork.
The workflow centers on a mandatory two-step usage pattern: first run `cx usage capabilities` to discover the labels, measurements, units, and request limits the Data Usage Query API supports for the current tenant, then build a `cx usage query` request derived only from that response. Beyond usage measurement, it documents commands for TCO policy management (`list`, `get`, `create`, `update`, `delete`, `reorder`), retention control (`cx retentions`), logs and metrics archive configuration, and PromQL-based metrics queries. Most steps are read-only diagnostics; write operations such as enabling archive are explicitly gated behind user approval and `--from-file` inputs. A companion reference file documents the query API schemas and limits.
The target users are DevOps engineers, SREs, platform teams, and FinOps practitioners running Coralogix who need to diagnose why a bill is high and act on it. Typical use cases include answering "why is our logging bill so high", identifying high-volume low-value logs to move to archive, trimming over-long retention on cold data, and spotting usage anomalies or overage against a daily plan.
It provides a structured workflow and command reference for investigating and lowering Coralogix data costs via the `cx` CLI — measuring usage, reviewing TCO policies, adjusting retention, and configuring archive storage.
Through a mandatory two-step flow: run `cx usage capabilities` to get the tenant's currently valid dimensions and limits, then build and run `cx usage query` using only that response, rather than guessing labels or intervals.
The Coralogix `cx` CLI installed and configured with a profile (commands support `-p <profile>`), plus `jq` for sorting JSON output in some examples. All commands support `-o json` for structured output.
Most steps are read-only diagnostics. Write actions such as creating TCO policies, updating retention, or enabling archive use `--from-file` inputs and are called out to require user approval before execution.
High-volume low-value logs on the expensive Frequent Search tier, unnecessarily long retention on cold data, missing archive configuration, and usage anomalies or overages against a plan.
Quick Setup:
.claude/skills/Repository
coralogix/cx-cli