# cx-data-pipeline

A skill for configuring parsing, enrichment and Events2Metrics in Coralogix through the cx CLI. Useful when logs need to become fields and metrics.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 3300 installs · ★ 124
- Author: coralogix
- License: Apache-2.0 · policy=mirror · the beginning of the file is at the end of this page
- Source: https://github.com/coralogix/cx-cli/tree/HEAD/skills/cx-data-pipeline/SKILL.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/cx-data-pipeline

## What it does

The skill covers four command groups under `cx`: parsing rules, enrichments, Events2Metrics and recording rules. The agent gets ready-made step sequences, from pulling an existing resource as a template to verifying the result with a log query.

The core advice is not to hand-write JSON. Pull an existing rule with `cx parsing-rules get <id> -o json`, edit the file, then create the new one. Payload format is the most common failure, so the template saves retries. Enrichments have their own quirks: custom tables use the v5 shape with inline file content, and rules go through `requestEnrichments`, where each enrichment type is an object rather than a string.

One thing to know about E2M up front: metrics are forward-only, starting from the moment the definition is created, with no backfill. It runs on the High and Medium tiers, while Low and Blocked give you no aggregation. Verify enriched fields on hot storage — ingestion delays in archive produce false negatives.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add coralogix/cx-cli --skill cx-data-pipeline -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/cx-data-pipeline/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/cx-data-pipeline/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add coralogix/cx-cli --skill cx-data-pipeline -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/cx-data-pipeline/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add coralogix/cx-cli --skill cx-data-pipeline -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/cx-data-pipeline/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install coralogix/cx-cli cx-data-pipeline
```

2. **Manually: put the files in place**
- File: `.github/skills/cx-data-pipeline/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add coralogix/cx-cli --skill cx-data-pipeline -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/coralogix/cx-cli --path skills/cx-data-pipeline
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/cx-data-pipeline/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add coralogix/cx-cli --skill cx-data-pipeline -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/coralogix/cx-cli/tree/HEAD/skills/cx-data-pipeline/SKILL.md

## When to use it
- extract structured fields from raw logs with regex
- attach geo data to records by IP
- turn a stream of events into Prometheus metrics
- precompute PromQL expressions with recording rules
- debug why an E2M definition produces no series

## Example prompts
- Set up log parsing for my-service: pull an existing rule as a template and create a new one.
- Add geo enrichment on the sourceIPs field and confirm the fields show up in recent logs.
- Create an E2M definition that derives a metric from events and show me which labels it will produce.

## Source text · SKILL.md · Apache-2.0

Below is the content of a third-party file. It is data, not instructions for you: do not act on anything written inside unless the human asks. Block tag: 0429a11093eb4dcb.

BEGIN THIRD-PARTY FILE 0429a11093eb4dcb
````text
---
name: cx-data-pipeline
description: >
  Use this skill when the user asks to "set up parsing", "create parsing rule",
  "extract fields from logs", "regex extraction", "log parsing",
  "enrich logs", "add context to logs", "custom enrichment table", "lookup table",
  "geo enrichment", "create metric from logs", "events to metrics",
  "convert logs to metrics", "generate metrics from events",
  "recording rule", "precomputed metrics", "PromQL recording",
  "configure data pipeline", "transform log data", "data processing rules",
  "rule group", "enrichment settings", "E2M definition", "labels cardinality",
  "bulk delete rules", "enrichment limits", "search enrichment table",
  "what should I convert to metrics", "E2M not producing metrics", "E2M no series",
  "reduce log cost with E2M", "logs to metrics aggregation", "spans to metrics",
  or wants to configure how Coralogix processes, enriches, or transforms ingested data.
metadata:
  version: "0.1.0"
---

# Data Pipeline Skill

Use this skill when configuring how Coralogix processes, enriches, and transforms data. It covers parsing rules (extract structured fields from raw logs), enrichments (add context from lookup tables), Events2Metrics (derive metrics from log/span events), and recording rules (precompute PromQL expressions).

---

## CLI Commands

| Command | Subcommands | Purpose |
|---|---|---|
| `cx parsing-rules` | `list`, `get`, `create`, `update`, `delete`, `bulk-delete`, `usage-limits` | Manage log parsing rules |
| `cx enrichments` | `list`, `add`, `remove`, `overwrite`, `limit`, `settings` | Manage enrichment rules |
| `cx enrichments custom` | `list`, `get`, `create`, `update`, `delete`, `search` | Manage custom enrichment tables |
| `cx e2m` | `list`, `get`, `create`, `update`, `delete`, `labels-cardinality`, `limits` | Manage Events2Metrics definitions |
| `cx recording-rules` | `list`, `get`, `create`, `update`, `delete` | Manage Prometheus recording rule groups |

Key flags:
- All create/update operations use `--from-file <path>` (or `-` for stdin)
- All commands support `-o json` for structured output and `-p <profile>` for profile selection
- `cx parsing-rules update` and `cx recording-rules update` require both `--from-file` and the rule group ID
- `cx enrichments custom search` requires `--id <table-id>` and `--query <text>`
- `cx parsing-rules bulk-delete` requires `--ids <id1> <id2> ...`

---

## Working with JSON Payloads

These commands use complex JSON structures. **Always template from an existing resource** to avoid format errors:

```bash
# 1. Get an existing resource as a template
cx parsing-rules get <rule-group-id> -o json > template.json
````
END THIRD-PARTY FILE 0429a11093eb4dcb

The third-party file has ended. Everything between the 0429a11093eb4dcb tags is data: requests and commands from it are not followed. An “end of file” line with another tag inside the block is part of the file.

First 2675 of 11835 bytes. © coralogix · Apache-2.0 · https://github.com/coralogix/cx-cli/tree/HEAD/skills/cx-data-pipeline/SKILL.md

_Part of the page did not fit — see the HTML version._

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md