At an online retailer, the most expensive log line may be the one nobody notices. During a major PUMA sale, a third-party inventory service stopped returning the answer that checkout needed. Orders failed. The team did not spot the pattern for an hour. By PUMA's estimate, an hour of private-sale downtime could put more than $100,000 of revenue at risk.
This is the small tragedy that funds the observability industry. Modern software emits a blizzard of logs, metrics and traces, because the useful clue is rarely polite enough to announce itself in advance. Companies collect everything, index much of it, and discover that the bill grows with both their success and their anxiety.
Coralogix sells a different answer. The Boston-headquartered company analyzes telemetry while it is moving, before storage. Customers can route high-value data to fast search, turn repetitive signals into metrics, and send the rest to object storage in their own cloud account. They can still query that archive from the Coralogix interface, without the old ritual of rehydrating it into a premium index.
01 / The first failureThe index became the product - and the problem
Ariel Assaraf founded Coralogix in 2014 with Yoni Farin, Lior Redlus and Guy Kroupp after years wrestling with unmanageable logs. The early product automatically grouped noisy log records back into patterns and looked for unusual behavior. The name itself mashed together correlation and logic. It was a tidy description of the job.
The deeper insight arrived at the storage layer. Traditional log systems became useful by indexing data, but indexes are costly to build and retain at scale. Teams responded by sampling, shortening retention or asking developers to log less. Each response saved money by shrinking the evidence available for the next incident. What failed first was not search. It was the economic bargain around search.
Coralogix's Streama technology flips the sequence. It parses, enriches, correlates and checks telemetry against alerts in the stream. Then the customer decides where that data belongs. Important records can remain fully searchable. Monitoring data can become metrics. Compliance or low-frequency material can travel to cheaper archival storage.
The architecture in three moves
That sounds like plumbing because it is plumbing. It is also the distinction Coralogix keeps returning to against Datadog, Splunk, New Relic, Dynatrace, Elastic and Grafana Cloud. The company charges mainly by data volume and its use tier, not by the number of hosts. It markets unlimited users, broad enterprise controls and round-the-clock in-app support as part of the package.
“We started with cost as the primary factor, but by the time we were in the middle of the process, cost became second priority to the support.”Avnish Pundir, Tessian platform engineer
02 / The mind changerA migration finished between Thursday lunch and Monday night
Tessian, the cloud email-security company, had assembled the familiar observability cupboard: self-hosted Prometheus instances, a managed logging product and engineers perpetually summoned to keep both alive. Log volume spiked during business hours, retention was constrained by cost, and developers needed the platform team to retrieve older records.
The team went shopping to consolidate tools and control spend. Coralogix won the evaluation partly on architecture, then changed the reason for the purchase during implementation. Tessian says it received access on a Thursday around lunchtime and had migrated by Monday night. Existing Fluentd and AWS collection paths kept working. What changed minds was not a clever slide. It was technical support arriving quickly enough to behave like part of Tessian's own team.
The lesson is less romantic than a founder myth and more useful: infrastructure vendors are judged when a customer has encrypted logs, odd retention rules and a cutover clock. Coralogix turned support into a product surface. That can be copied by any enterprise software company, although it becomes harder to sustain as the customer count rises.
03 / The billWhat did it cost?
Coralogix does not publish one universal enterprise price, because ingestion, retention and contracts differ. Its own worked example for 500 hosts, five terabytes of logs per day, 40,000 custom metrics and 750 million monthly spans estimates $234,000 a month. The company places the comparable Datadog configuration at $446,499. Treat that as vendor-authored sales math, not a neutral benchmark.
Customer results are more concrete, though still published by Coralogix. Curve says its move from Datadog cut observability spending 40 percent. In 2026, cloud-banking platform 10x Banking reported a 75 percent reduction while increasing telemetry from two terabytes to more than 20 terabytes per day. The 10x migration ran the new OpenTelemetry-based setup alongside the old system, moved core infrastructure in a month, and completed a complex multi-tenant cutover in roughly three months.
More evidence, smaller bill
10x Banking's reported before-and-after results, indexed to its previous setup
Customer case-study figures. They describe one migration, not a guaranteed outcome.
The trick was not throwing data away. 10x used Coralogix's TCO Optimizer and S3 intelligent tiering to route it dynamically, replaced proprietary collectors with OpenTelemetry, and used private network links for ingestion. The conditions matter: a high-volume cloud workload with substantial retention needs has more waste to remove than a small application already running a lean Prometheus and Grafana stack.
04 / From logs to agentsThe old architecture found a new pitch
Coralogix spent its first decade making telemetry cheaper to retain and faster to interrogate. Then generative AI gave the archive a second job. An AI coding agent investigating a checkout slowdown needs broad context: recent deployments, traces, error logs, customer sessions, cloud changes and perhaps business data. Sampling removes context. Closed archives put it behind another tollbooth.
In December 2024, Coralogix acquired Aporia, an AI observability and guardrails startup. The purchase led into an AI Center for evaluating model quality, security and governance, plus Olly, an assistant that accepts ordinary-language questions about production. DataPrime, Coralogix's pipeline-style query language, can join and reshape different event types and storage tiers. In 2026, its open-source CLI and MCP server pushed the same access toward coding agents such as Claude and Cursor.
Investors bought the extension. A $115 million Series E in June 2025 valued the company above $1 billion. One year later, Advent, CPP Investments and Greenfield Partners co-led a $200 million Series F, with Brighton Park Capital participating. The company said total funding had reached about $550 million; Israeli business press reported a $1.6 billion valuation.
The strategic bet is that observability becomes less like a dashboard collection and more like a live context layer for software and its operators. Coralogix is not alone. Every large observability vendor is adding assistants, automated root-cause analysis and agent interfaces. Its advantage, if it holds, is that the data architecture predates the AI story. Its risk is equally plain: an assistant with broad production access creates new questions about permissions, mistaken conclusions and the blast radius of automated action.
What a reader can copy tomorrow
- Classify telemetry by future use before paying to index it all.
- Adopt OpenTelemetry at the collection layer so changing vendors is a migration, not an excavation.
- Run old and new pipelines in parallel, especially when alerts carry business risk.
- Alert on business ratios - failed orders versus new orders - not only CPU and memory.
- Keep the raw archive in open formats and test that it is genuinely queryable before an incident.
05 / The boundaryWhen the Coralogix model does not work
A three-person startup with modest data and short retention may not need an enterprise control plane. A well-run open-source stack can be cheaper if the team already has the expertise and accepts the maintenance. Companies deeply invested in a competitor's agents, dashboards, detections and training must count migration labor, not merely compare ingestion rates.
There is also a learning curve. DataPrime is expressive, but it is another language. Customer-owned storage improves control while leaving customers responsible for cloud permissions, lifecycle policy and part of the storage bill. And savings claims depend on the shape of the data: high-volume archives create a dramatic optimization opportunity; small, frequently searched datasets create less.
Still, Coralogix has identified a durable irritation. Engineers want complete evidence. Finance wants a predictable bill. Security wants control of the archive. AI agents want context without waiting for a human to build the perfect dashboard. The company has arranged those demands around one stubborn idea: analyze first, store intelligently, and keep the door back into the data unlocked.