Coralogix lands $115 million to push AI observability harder, and that says a lot about where ops tools are headed

Coralogix has raised a $115 million Series E at a valuation above $1 billion, joining the unicorn club on the strength of a pretty direct bet: observability is becoming an AI product, not just a storage-and-dashboards business.

The company says the new round will fund more AI R&D, more product work around its agent Olly, and a larger engineering footprint in India. It plans to grow its local team from about 100 engineers to 200 across Gurugram, Bengaluru, and Mumbai.

The funding matters for a reason beyond the headline. Observability vendors have spent years fighting over ingest volume, query speed, retention tiers, and brutal pricing. Now most of them are converging on the same problem: modern systems produce too much telemetry for humans to sort through in real time, so the product has to handle triage, correlation, and explanation.

Coralogix wants to be one of the companies that makes that shift stick.

Why this round matters

Two things stand out.

First, investors still see observability as a category big enough to produce new billion-dollar companies, even after enterprise buyers got a lot less tolerant of expensive infrastructure tooling.

Second, AI features in ops tools are moving closer to the center of the product. That doesn’t make every “copilot for on-call” pitch good. Plenty aren’t. But the direction is real. Teams are tired of bouncing between logs, traces, metrics, deployment history, and incident channels while production is on fire.

Coralogix is betting that an observability system should answer operational questions, not just expose raw data.

That’s a stronger goal than basic natural-language querying, which is where a lot of these products stall out. Asking your logs a question is useful. It’s also table stakes. If the system can’t connect the result to service topology, recent deploys, access events, business context, and known failure patterns, you’re still looking at expensive autocomplete over telemetry.

What Olly is trying to do

The interesting part of Coralogix’s pitch is the architecture behind Olly, its AI agent for observability.

According to the company’s technical outline, the platform ingests logs, metrics, traces, and metadata through real-time streaming systems like Kafka or Kinesis. A remote query layer built on stream-processing tools such as Flink or Beam then turns raw events into data that’s easier to search and richer in context.

That stack makes sense. If you want an agent to answer operational questions fast, you can’t wait for batch jobs to clean up and enrich telemetry after the fact. The correlation and indexing have to happen while the incident is unfolding.

Coralogix then adds a semantic layer. Service names, deployment markers, user IDs, docs, and external security context such as CVEs get stitched into a graph model. The source material points to graph backends like Neo4j or AWS Neptune, plus embeddings generated from individual logs and metrics with a smaller fine-tuned transformer.

That’s the important move. Traditional observability systems are good at filtering and querying structured records. They’re weaker at representing relationships across systems and over time. A graph plus embeddings gives the agent something closer to usable context, which is what human responders usually end up rebuilding by hand at 2 a.m.

The query flow is straightforward on paper:

1. A user asks a question in plain language.
2. A lightweight classifier decides whether this is anomaly detection, root-cause analysis, feature analysis, or something else.
3. The LLM pulls relevant graph nodes, traces, and references.
4. It returns an explanation with citations and suggested remediation.

A sample query looks like this:

curl -X POST https://api.coralogix.com/olly/query \
-H "Authorization: Bearer $API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"prompt": "Which microservice is causing the 503 errors in the payments pipeline?",
"timeRange": "last_2_hours",
"filters": { "service": "payments" }
}'

The expected answer points to a specific service, a likely failure cause, and a fix recommendation, along with references to a log snippet and trace span.

That reference layer matters. If an AI observability product can’t show its work, it has no business near incident response.

Good pitch, harder reality

This category has a problem vendors tend to glide past: AI observability is only as good as the telemetry discipline underneath it.

If services are poorly tagged, spans are inconsistent, logs are half-structured, and nobody agrees on naming, the agent will still answer questions. The quality of those answers is the issue.

That’s why the practical advice around tools like Olly is boring and correct:

• use OpenTelemetry or something close to it
• define semantic attributes early
• emit business events, not just infrastructure events
• test prompts against real incidents before widening access

None of that makes for a flashy demo. It matters more than the demo anyway.

A lot of teams will buy into AI-assisted observability before they’ve done the cleanup work. Those teams are likely to get confident-looking answers built on messy inputs, which is a bad trade during incident response. The upside is real, but the floor is still set by instrumentation quality.

Coralogix’s raise suggests investors think that trade is worth betting on. They may be right. The next phase of observability probably does look more like guided investigation and less like manual dashboard spelunking. But the vendors that win won’t be the ones with the prettiest chat box. They’ll be the ones that can tie an answer back to the system, the deploy, and the evidence.

What to watch

The harder part is not the headline capacity number. It is whether the economics, supply chain, power availability, and operational reliability hold up once teams try to use this at production scale. Buyers should treat the announcement as a signal of direction, not proof that cost, latency, or availability problems are solved.