MCPInstall

cx-cost-optimization

by coralogixDevOps & Cloud

Use this skill when the user asks to "check data usage", "list TCO policies", "reduce Coralogix costs", "optimize observability spend", "lower our logging bill", "data budget exceeded", "TCO policy", "retention tier", "archive storage", "ingestion costs", "frequent search vs archive", "why is our bill so high", "spending too much on logs", "data retention settings", "cost analysis", "usage breakdown", "optimize log volume", "control data ingestion", "archive cold data", "billing units", "plan consumption", "daily plan", "overage", "PAYG", "usage anomaly", "usage trend", "cxdatausageunits", or wants to investigate, analyze, or reduce Coralogix data costs.

Installs
3.4K
Last 24h
+75
Trending rank
#2442
Security
Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/coralogix/cx-cli --skill cx-cost-optimization
  1. 01

    Install

    Run the command in your project. The CLI asks which agents to install for.

  2. 02

    Describe the task

    Ask your agent for something this skill covers. It loads cx-cost-optimization automatically when relevant.

  3. 03

    Review the result

    The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

Cost Optimization Skill

Use this skill when investigating or reducing Coralogix data costs. It covers the full cost management lifecycle: measuring current spend, reviewing TCO policies, adjusting retention periods, and configuring archive storage for cold data.

CLI Commands

CommandSubcommandsPurpose
cx usagesummary, daily, logs-count, spans-count, export-status, capabilities, queryMeasure current data consumption and billable usage
cx tcolist, get, create, update, delete, reorder, test, settings, settings-updateManage TCO (Total Cost of Ownership) policies
cx retentionslist, update, activate, statusManage data retention periods
cx archive logsget, setConfigure logs archive target
cx archive metricsget, create, update, enable, disable, validateConfigure metrics archive storage
cx metrics query<promql> (positional), --timeQuery billing and usage metrics via PromQL (instant)
cx metrics query-range<promql> (positional), --start/--endQuery billing and usage metrics via PromQL (range)

Key flags:

  • All commands support -o json for structured output and -p <profile> for profile selection
  • cx usage daily accepts --type processed-gbs|units|evaluation-tokens and --start/--end time filters
  • cx usage summary accepts --start/--end time filters
  • cx usage logs-count and cx usage spans-count accept --start/--end time filters, defaulting to the last 24h, plus --resolution (default 1h), --subsystem-aggregation, --application-aggregation, and repeated --param KEY=VALUE for API filter query params
  • Data usage summary and count endpoints are documented as newline-delimited JSON over Accept: text/event-stream; the CLI handles that transport and normalizes count chunks into .result.logsCount[] or .result.spansCount[].
  • cx usage capabilities is the required first step: it returns the labels, measurements, units, and request limits that the public Data Usage Query API currently supports for the selected tenant
  • cx usage query is the required second step: submit only a JSON request derived from the immediately preceding capabilities response with exactly one of --query '<json>' or --from-file <path> (--from-file - reads stdin)
  • cx tco create/update, cx retentions update, cx archive logs set, cx archive metrics create/update/validate use --from-file <path> (or - for stdin)

Authoritative Billable Usage Queries

For billable totals, quota units, plan consumption, or a supported usage breakdown, use this mandatory two-step workflow:

  1. Run cx usage capabilities in the current session.
  2. Build and run cx usage query using only that response.

Do not call cx usage query first and do not guess labels, measurement kinds, units, filter values, intervals, or request limits. They are tenant-specific and can change.

# Inspect the currently valid dimensions and constraints
cx usage capabilities -o json

# Submit a capabilities-derived request inline
cx usage query --query '{"daily":{"relativeRange":"DAILY_RELATIVE_RANGE_LAST_7_DAYS"}}' -o json

# Or read the same request from a file or stdin
cx usage query --from-file usage-query.json -o json
printf '%s' '{"daily":{"relativeRange":"DAILY_RELATIVE_RANGE_LAST_7_DAYS"}}' \
  | cx usage query --from-file - -o json

Load references/data-usage-query-api.md before creating the query body. It defines the capability and response schemas, valid interval forms, and limits.

Cost Investigation Workflow

Follow these steps to diagnose and reduce costs:

Step 1: Measure Current Usage

For billable totals, quota units, plan consumption, or supported breakdowns, first follow the mandatory two-step workflow above:

cx usage capabilities -o json
cx usage query --from-file usage-query.json -o json

Build usage-query.json only from the immediately preceding capabilities response. Do not use the legacy commands below as a substitute for an authoritative billing answer.

For a legacy consumption overview and log/span record counts, use:

cx usage summary -o json
cx usage summary --start now-30d -o json
cx usage daily --type processed-gbs --start now-7d -o json
cx usage logs-count --start now-7d --end now -o json
cx usage spans-count --start now-7d --end now -o json

Identify which data types consume the most volume. Use jq to sort:

cx usage summary -o json | jq '[.[] | {name, daily_avg: .avg_daily_gb}] | sort_by(.daily_avg) | reverse'

Step 2: Review TCO Policies

cx tco list -o json
cx tco settings -o json

TCO policies control which logs go to Frequent Search (expensive, fast) vs. Archive (cheap, slower). Check if high-volume, low-value logs are on Frequent Search:

cx tco list -o json | jq '.[] | select(.priority == "LOW") | {name, application, subsystem, archive_retention}'

Step 3: Check Retention Settings

cx retentions list -o json
cx retentions status -o json

Long retention periods increase storage costs. Identify indices with unnecessarily long retention.

Step 4: Check Archive Configuration

cx archive logs get -o json
cx archive metrics get -o json

Verify that archive storage is configured for cold data. If no archive is set up, that's a cost-saving opportunity.

Step 5: Recommend Optimizations

Based on findings, recommend changes in priority order (highest impact first).

Common Optimization Patterns

SymptomDiagnosis CommandOptimization
High-volume low-value logscx usage summary -o jsonMove to archive tier via cx tco create --from-file policy.json
Long retention on cold datacx retentions list -o jsonReduce retention with cx retentions update --from-file
No cold storage configuredcx archive logs get -o jsonEnable archive with cx archive logs set --from-file --yes (after user approval)
Expensive metrics not queriedcx archive metrics get -o jsonEnable metrics archiving with cx archive metrics create --from-file --yes (after user approval)

jq Examples

Usage Analysis

# Top consumers by daily volume
cx usage summary -o json | jq '[.[] | {name, daily_avg: .avg_daily_gb}] | sort_by(.daily_avg) | reverse | .[0:10]'

# Daily trend for the past week
cx usage daily --type processed-gbs --start now-7d -o json | jq '[.[] | {date, gb: .processed_gbs}]'

# Total logs and spans counts
cx usage logs-count --start now-7d --end now -o json | jq '[.result.logsCount[]?.logsCount | tonumber] | add // 0'
cx usage spans-count --start now-7d --end now -o json | jq '[.result.spansCount[]? | ((.successSpanCount | tonumber) + (.errorSpanCount | tonumber) + (.lowSuccessSpanCount | tonumber) + (.lowErrorSpanCount | tonumber) + (.mediumSuccessSpanCount | tonumber) + (.mediumErrorSpanCount | tonumber))] | add // 0'

TCO Policy Analysis

# Policies routing to archive tier
cx tco list -o json | jq '[.[] | select(.archive_retention != null)]'

# Policies by priority
cx tco list -o json | jq 'group_by(.priority) | map({priority: .[0].priority, count: length})'

# Test if a log pattern matches a policy
cx tco test --from-file test-definition.json -o json

Retention Review

# All retention settings
cx retentions list -o json | jq '.[]'

# Check if retention is active
cx retentions status -o json

Archive Status

# Logs archive configuration
cx archive logs get -o json | jq '{active: .active, bucket: .bucket}'

# Metrics archive configuration
cx archive metrics get -o json | jq '{enabled: .enabled, bucket: .bucket}'

Applying Changes

IMPORTANT: NEVER pass --yes without explicit user approval. All write operations across archive, TCO, and retentions require interactive confirmation and the --yes flag to execute non-interactively. Before executing any write operation, describe the exact change to the user and wait for their approval before passing --yes.

Read-only mode: Use --read-only (or CX_READ_ONLY=1) to safely explore cost data without risk of accidental writes. All query commands (usage, tco list/get, retentions list, archive get) work normally in read-only mode.

Agent mode: When running inside an AI agent, cx fails fast on write operations instead of hanging on a stdin prompt. Get user confirmation first, then re-run with --yes.

When modifying TCO policies, retention, or archive:

  1. Template from existing: Get the current configuration as JSON, modify it, then apply:

    cx tco get <policy-id> -o json > policy.json
# Edit policy.json
cx tco update --from-file policy.json

  2. Verify after changes: Re-run the diagnosis commands to confirm the change took effect.

  3. TCO policy ordering matters: Use cx tco reorder --from-file to set priority order. Policies are evaluated top-to-bottom; the first match wins.

Metrics-Based Cost Analysis

The cx usage API gives summaries, but for billing-accurate analysis, anomaly detection, and breakdown by pillar/feature, query the customer metrics exporter via PromQL.

Key Metrics

MetricMeaningQuery suffix
cx_data_usage_unitsDaily billable usage in units (canonical billing metric)No _total
cx_data_plan_units_per_dayCurrent daily plan quota in units (snapshot)No _total
cx_data_usage_payg_unitsDaily overage/PAYG usage in unitsNo _total
cx_data_usage_totalProcessed data size in bytes_total
cx_data_usage_tokens_totalAI evaluation tokens_total
cx_data_usage_samples_totalProcessed metric samples_total

Concept-to-Metric Mapping

  • Billing / plan usage / consumption -> cx_data_usage_units + cx_data_plan_units_per_day
  • Processed bytes / data volume -> cx_data_usage_total
  • AI evaluation tokens -> cx_data_usage_tokens_total
  • Metric samples -> cx_data_usage_samples_total
  • Overage / PAYG -> cx_data_usage_payg_units

Common PromQL Queries

# Today's billable units consumed so far
cx metrics query 'sum(cx_data_usage_units)' --time now -o json

# Units breakdown by pillar
cx metrics query 'sum by (pillar) (cx_data_usage_units)' --time now -o json

# Daily plan quota
cx metrics query 'cx_data_plan_units_per_day' --time now -o json

# Plan consumption percentage
cx metrics query '100 * sum(cx_data_usage_units) / cx_data_plan_units_per_day' --time now -o json

# Units by feature group
cx metrics query 'sum by (feature_group_id) (cx_data_usage_units)' --time now -o json

# PAYG overage (if any)
cx metrics query 'cx_data_usage_payg_units' --time now -o json

UTC-Day Bucketing Rules

All usage metrics accumulate from UTC midnight and reset at 00:00 UTC:

  • An instant query during the day returns "today so far"
  • For completed-day totals, use the last sample before midnight
  • Never subtract values across a UTC midnight boundary
  • For weekly/monthly analysis, derive completed daily totals first, then roll up
  • Exclude the current partial UTC day when computing trends or averages

Anomaly Detection

When investigating usage anomalies:

  1. Compare completed UTC days (exclude current partial day)
  2. Break down by: measurement_type -> pillar -> entity_type -> priority -> feature_group_id -> application_name -> subsystem_name
  3. Prefer same-weekday comparisons for seasonal traffic
  4. Use cx_data_usage_units for billing anomalies, cx_data_usage_total for volume anomalies

Breakdown Labels

Usage metrics support these grouping dimensions: pillar, entity_type, priority, measurement_type, feature_group_id, feature_id, application_name, subsystem_name.

Key Principles

  • Measure before changing - always run usage/summary commands before modifying policies
  • Use -o json with jq - structured output enables precise analysis
  • Verify changes - re-query after every modification to confirm it took effect
  • Multi-profile awareness - use -p <profile> or --all-profiles to compare costs across environments
  • Template from existing - get current config as JSON before creating or updating
  • TCO is the biggest lever - moving logs from Frequent Search to Archive tier has the largest cost impact

Related Skills

  • cx-telemetry-querying - investigate what data is being ingested (query logs, metrics, and spans to identify high-volume sources)

Reference Files

  • references/data-usage-query-api.md - capabilities and query schemas, interval rules, limits, and response interpretation

FAQ

What does the cx-cost-optimization skill do?

Use this skill when the user asks to "check data usage", "list TCO policies", "reduce Coralogix costs", "optimize observability spend", "lower our logging bill", "data budget exceeded", "TCO policy", "retention tier", "archive storage", "ingestion costs", "frequent search vs archive", "why is our bill so high", "spending too much on logs", "data retention settings", "cost analysis", "usage breakdown", "optimize log volume", "control data ingestion", "archive cold data", "billing units", "plan consumption", "daily plan", "overage", "PAYG", "usage anomaly", "usage trend", "cxdatausageunits", or wants to investigate, analyze, or reduce Coralogix data costs.

How do I install cx-cost-optimization?

Run npx skills add https://github.com/coralogix/cx-cli --skill cx-cost-optimization in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/cx-cost-optimization/ (personal) or .claude/skills/cx-cost-optimization/ (project).

Which AI agents can use cx-cost-optimization?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is cx-cost-optimization safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains cx-cost-optimization?

It is published by coralogix in coralogix/cx-cli. It has 3,389 recorded installs.

More from coralogix/cx-cli

View all →

cx-telemetry-querying

coralogix/cx-cli

Use this skill for any question involving telemetry data: "investigate an issue", "debug a problem", "find out why something is slow", "check error rates", "analyze user behavior", "understand a production incident", "query telemetry data", "look at logs", "search logs", "find errors", "find stack traces", "filter by severity", "check traces", "examine spans", "investigate request latency", "debug service-to-service calls", "look up a trace ID", "analyze RUM data", "query rum.events", "check frontend performance", "frontend errors", "Core Web Vitals", "JavaScript exceptions", "query metrics", "check CPU usage", "run a PromQL query", "check error rate", "look up a metric", "check memory usage", "how do I write a DataPrime query", "DataPrime syntax", or wants to answer questions using observability data from logs, metrics, traces, RUM, or APM.

Code Quality & Workflow4.8K installs

cx-search-dashboard

coralogix/cx-cli

This skill should be used when the user asks to "find a dashboard", "search dashboards", "does a dashboard exist for X", "find widgets that query Y", "which dashboards use this field", "find a dashboard about errors", "look up dashboards by description", "search for existing monitoring dashboards", "find widgets that reference a field", or wants to discover existing Coralogix dashboards or widgets using natural-language or field-based search.

Data & Databases3.9K installs

coralogix-docs

coralogix/cx-cli

Search and read official Coralogix platform documentation using cx docs search and cx docs fetch. Use when the user asks how Coralogix features work, how to configure or use the UI, set up integrations (OpenTelemetry, agents, collectors, webhooks), manage API keys, explore spans/traces/logs in the product, configure alerts/SLOs/dashboards, or needs authoritative product docs — not live tenant telemetry.

Docs & Writing3.8K installs

cx-alerts

coralogix/cx-cli

This skill should be used when the user asks to "manage alerts", "create alert", "list alerts", "delete alert", "check alert status", "enable alert", "disable alert", "investigate firing alerts", "check which alerts are active", "find alerting rules", "set up an alert", "configure alerting", "mute an alert", "silence an alert", "see alert definitions", "check alert priority", or wants to manage Coralogix alert definitions using the cx CLI.

3.6K installs

cx-cli

coralogix/cx-cli

This skill should be used whenever the user runs any cx command, uses the cx CLI, Coralogix CLI, or mentions cx in the context of Coralogix observability. This skill provides cross-cutting concerns like update notifications that apply to all cx commands.

DevOps & Cloud3.6K installs

cx-observability-setup

coralogix/cx-cli

Use this skill when the user asks to "set up monitoring", "configure observability", "onboard new service", "create saved view", "set up notifications", "configure webhook", "set up Slack integration", "outgoing webhook", "automation action", "webhook for alerts", "create view", "saved view", "view folder", "organize dashboards", "install integration", "configure extension", "contextual data", "connect external service", "create notification connector", "set up email alerts", "configure PagerDuty", "notification routing", "deploy extension", "test webhook", "notification preset", "test notification", "webhook actions", or wants to set up, configure, or manage the observability stack for a service or team.

DevOps & Cloud3.5K installs

Popular devops & cloud skills

View category →

microsoft-foundry

microsoft/azure-skills

Build, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and resources end to end. USE FOR: foundry, azd ai agent, azd provision/deploy, hosted agent scaffold/develop/run/deploy/troubleshoot, prompt agent create, managed harness agent create, GitHub Copilot harness agent, create agent, update agent, add tool to agent, invoke agent, agent insights, evaluate agent, batch eval, continuous eval, continuous monitoring, agent CI/CD, optimize prompt, improve prompt, optimize agent instructions, Agent Optimizer scaffold, dataset curation from traces, deploy model, model fine-tuning (SFT/DPO/RFT), Foundry project, RBAC, role assignment, permissions, quota, capacity, region, deployment failure, AI Services, create Foundry resource, knowledge index, customize deployment, onboard, availability, training-data, grader, distillation, large file upload. DO NOT USE FOR: Azure Functions, App Service, general Azure deploy (use azure-deploy), general Azure prep (use azure

OfficialDevOps & Cloud579.1K installs

azure-diagnostics

microsoft/azure-skills

Debug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe triage. WHEN: debug production issues, troubleshoot app service, app service high CPU, app service deployment failure, troubleshoot container apps, container app 503 or target port mismatch, troubleshoot functions, function telemetry missing or stopped after a config/connection-string change, troubleshoot AKS, VM RDP, Linux SSH, VM black screen, can't connect to VM, reset VM password, NSG or firewall blocking, kubectl cannot connect, kube-system/CoreDNS failures, pod pending, crashloop, node not ready, upgrade failures, analyze logs, KQL, insights, image pull failures, cold start issues, health probe failures, resource health, root cause of errors, troubleshoot event hubs, troubleshoot service bus, messaging SDK error, AMQP connection failure, message lock lost, lock renewal during long-running processing, service bus dead letter.

OfficialDevOps & Cloud569.8K installs

azure-prepare

microsoft/azure-skills

Prepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wants to use azd as the deployment tool, or the project already has an azure.yaml file. DO NOT USE FOR: non-azd deployments, Python App Service code-only deploys (use python-appservice-deploy), or cross-cloud migration (use azure-cloud-migrate). WHEN: prepare app for azd, create azure.yaml, set up azd infrastructure, modernize app for Azure with azd, deploy with azd, function app, timer trigger, service bus trigger, event-driven function, managed identity, generate Bicep, generate Terraform, create and deploy to Azure.

OfficialDevOps & Cloud569K installs

azure-ai

microsoft/azure-skills

Use for Azure AI: Search, Speech, OpenAI, Document Intelligence. Helps with search, vector/hybrid search, speech-to-text, text-to-speech, transcription, OCR. WHEN: AI Search, query search, vector search, hybrid search, semantic search, speech-to-text, text-to-speech, transcribe, OCR, convert text to speech.

OfficialDevOps & Cloud568.8K installs

azure-deploy

microsoft/azure-skills

Execute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application — use azure-prepare instead. This skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery. Requires .azure/deployment-plan.md from azure-prepare and validated status from azure-validate. WHEN: "run azd up", "run azd deploy", "execute deployment", "push to production", "push to cloud", "go live", "ship it", "bicep deploy", "terraform apply", "publish to Azure", "launch on Azure". DO NOT USE WHEN: "create and deploy", "build and deploy", "create a new app", "set up infrastructure", "create and deploy to Azure using Terraform" — use azure-prepare for these.

OfficialDevOps & Cloud568.6K installs

azure-validate

microsoft/azure-skills

Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity permissions, and prerequisites before deploying. WHEN: validate my app, check deployment readiness, run preflight checks, verify configuration, check if ready to deploy, validate azure.yaml, validate Bicep, test before deploying, troubleshoot deployment errors, validate Azure Functions, validate function app, validate serverless deployment, verify RBAC roles, check role assignments, review managed identity permissions, what-if analysis, validate Container Apps deployment.

OfficialDevOps & Cloud568K installs