One agent turned three log lines into fifty spans

Picture your backend a year ago. An API request came in, and it wrote three log lines: request received, request processed, response sent. Cheap. Boring. Predictable.

Now picture the same endpoint after you put an AI agent in front of it. A single request becomes: receive the user message, load the system prompt, fetch the tool manifest, call the model, fire three tool calls, parse three tool responses, call the model again, run a validation pass, retry once because a provider rate-limited you, then emit the final answer. In observability terms, every one of those steps is a span. And each span drags along the full prompt text, tool arguments, model output, token counts, latency, and cost. Three log lines became several dozen spans and a few hundred kilobytes of payload.

Here's the deal: almost every observability vendor prices that by ingested gigabyte or by indexed volume. Which is why the same conversation has been playing out in engineering orgs all year. "Why is the monitoring bill up again?" "We shipped the agent." "Then log less." "If we log less we can't see why the agent got it wrong." That deadlock is quietly rewriting a $50B-plus software category.

The numbers back it up. Datadog's State of AI Engineering report, published April 21, 2026 and drawn from LLM telemetry across thousands of production customers, found that tokens per request more than doubled year over year for the median organization and quadrupled for heavy users at the 90th percentile. Sixty-nine percent of input tokens in customer traces weren't user questions at all — they were system prompts, policy definitions, and tool guidance. Nearly one in twenty production AI requests fails, and close to 60% of those failures come from capacity limits. Sixty-nine percent of companies now run three or more models. Every bit of that is telemetry, and telemetry is an invoice.

Which brings us to the company in this story. Coralogix, founded in Tel Aviv in 2014. It raised a $115M Series E on June 17, 2025 that pushed it past a $1B valuation, and then, eleven months later in early June 2026, a $200M Series F at $1.6B. Total raised to date: $550M. What makes this interesting isn't the money. It's that a stubborn architectural bet the company made a decade ago — don't index the data, process it in the stream — happens to line up exactly with the problem the market just developed.

One date note before we go further, because the headlines are confusing: the "$115M Series E" story still circulating in feeds is from June 2025. As of August 2026 the current round is the $200M Series F from early June. This piece reads both as one trajectory, because the real question is why the valuation moved 60% in eleven months.

The Tel Aviv shop and the money lined up behind it

Coralogix was co-founded in 2014 by CEO Ariel Assaraf and CTO Yoni Farin. The founding motivation was almost boringly plain — in the company's own words from its Series E announcement, it started ten years ago with the belief that "there must be an easier way to track logs." Back then it was a log management tool competing in a category where Splunk and Datadog owned all the oxygen.

The cap table tells you how the company grew up. The June 2025 Series E was led by NewView Capital, with the Canada Pension Plan Investment Board (CPPIB) and NextEquity — founded by former Apple executives Avie Tevanian and Fred Anderson — coming in new. Every existing backer returned: Advent International, Brighton Park Capital, Revaia, Greenfield Partners, Red Dot Capital Partners, O.G. Tech, Joule Capital Partners, and Maor Investments. The name to notice there is CPPIB. When a national pension fund writes a Series E check, it isn't making a venture bet on a moonshot. It's underwriting something it expects to look like infrastructure in a few years.

Eleven months later, that read got confirmed. The $200M Series F was co-led by Advent, CPPIB, and Greenfield, with Brighton Park Capital participating. Note what didn't happen: the company didn't go find a new lead. The large pools of capital already inside wrote bigger checks. Rounds led by private equity and pension money have a different flavor than venture rounds. Venture asks how many times this can multiply. This kind of money asks when free cash flow turns positive. Assaraf told TechCrunch the company is targeting profitability within a few years and running with public-company financial discipline, which is exactly the language you'd expect.

The company is also past startup scale by most definitions. More than 5,000 customers, with IBM, Tradeweb, and JFrog among the named ones. Over 600 employees worldwide — roughly 300 in Israel and 300 in the US per Calcalist, plus a London office and operations across India, Asia, and South America. It processes petabytes of production data daily across eight regions, including GovCloud, and has cleared procurement requirements for US government entities.

Revenue is the one thing the company hasn't put an official number on. TechCrunch reported that annual recurring revenue crossed $100M over a year ago, that growth is running above 60% year over year, and that about 30 enterprise customers pay more than $1M a year. Calcalist put the annualized run rate in a $150M-$200M range. Neither figure is company-confirmed, so treat both as order-of-magnitude rather than precise.

What actually happens when you delete the index

Coralogix's technical identity comes down to one engine called Streama. Conventional observability platforms take incoming telemetry, store it, index it, then let you search it. Indexing buys fast search, and the price is that cost scales linearly with volume — sometimes worse. So organizations pick one of three bad options: index everything and eat the bill, sample and create blind spots, or shorten retention and destroy the evidence you'll need later. The company's own engineering blog notes that most organizations can only afford to retain 1-5% of their CDN and WAF logs on traditional platforms.

Streama analyzes data in-stream, before storage. Alerting, metric extraction, and anomaly detection all happen while the data is moving, without an index, and the raw records land in the customer's own cloud object storage in an open format. That decouples two things that used to be welded together on your invoice: keeping data for a long time, and being able to search it fast. On top of that sits a policy layer, the TCO Optimizer, that routes each stream into one of three tiers — Frequent Search for anything needing millisecond queries, Monitoring for data that only powers dashboards and alerts, and Compliance for long-term retention. Coralogix says customers average 40-70% total-cost-of-ownership savings and cites one configuration where routing CDN and WAF logs alone saved $243,000 a year. Those are self-reported vendor figures, not independently audited numbers.

Three layers of AI got stacked on top of that foundation. The first was the December 2024 acquisition of Aporia, an Israeli company building AI model monitoring and guardrails; Calcalist reported the deal at roughly $50M, a figure Coralogix has not officially confirmed. The second was AI Center, launched in 2025 on the back of that technology, giving real-time visibility into the quality, performance, and security of LLM applications. The third is Olly, the AI agent unveiled alongside the Series E, which lets someone who doesn't know the query language ask "why did payment failures spike at 3am?" and get a root-cause answer stitched across logs, metrics, and traces.

Then in 2026 Olly stopped being something only humans talk to. The MCP server release notes trace the arc: natural-language querying in August 2025, OAuth in January 2026, RUM tooling in March, alert and parsing-rule management on March 30, eleven new management tools on May 10, MCP server v2 on May 27, and — on June 3, the same day the Series F went out — "Olly through MCP." That last one lets coding agents in Cursor, Claude Code, or Codex send investigation requests to Olly and get back downloadable artifacts containing logs, traces, metrics, and alert data. Assaraf's line to TechCrunch summarizes the shift precisely: "The architecture was already there. Engineers are no longer the only consumers of observability data. AI systems are becoming operational participants themselves." The company says more than half of its enterprise customers now use Olly or their own AI models against the platform.

Item Detail Source
Founded 2014, Tel Aviv (Ariel Assaraf, Yoni Farin) Company statements, APMdigest
Series E $115M, June 17, 2025, led by NewView Capital (CPPIB, NextEquity new) Coralogix blog, APMdigest
Series E valuation Over $1B Coralogix blog
Series F $200M, early June 2026, co-led by Advent, CPPIB, Greenfield Coralogix blog, Advent
Series F valuation $1.6B (up ~60%) Calcalist, TechCrunch
Total raised $550M Coralogix blog
Customers 5,000+ (IBM, Tradeweb, JFrog) Coralogix blog
Revenue ARR crossed $100M over a year ago; 60%+ YoY growth; ~30 customers at $1M+/yr TechCrunch (no official company figure)
Headcount 600+ globally TechCrunch
Aporia acquisition December 2024, reported at ~$50M Coralogix blog, Calcalist
TCO claim 40-70% average savings (self-reported) Coralogix engineering blog
Analyst position Leader, Gartner Magic Quadrant for Observability Platforms (published July 13, 2026) Coralogix

The most important row in that table is the revenue row, specifically the part where there is no official number. That means the $1.6B valuation implies somewhere in the range of eight to ten times revenue if you trust the reported estimates — richer than the public SaaS average, cheaper than what category leaders like Datadog command. Assaraf's own framing was: "In the AI era, execution and speed matter more than any point-in-time valuation." That's a polite deflection of the valuation question, but it also describes the round accurately. This isn't a price-maximizing raise. It's a land-grab raise.

Who actually gets something out of this

The most direct beneficiaries are engineering teams currently pinned under a telemetry bill. The real value of an index-free architecture isn't the headline savings percentage; it's that it gives you a third option besides "pay more" and "see less." Until now, when costs spiked there was one lever: sampling. And sampling is uniquely destructive for agent debugging. When your agent misbehaves one time in ten, and that one trace gets sampled away, the failure becomes unreproducible. Conventional application logs are homogeneous enough that 1% shows you the pattern. Agent failures are sparse and heterogeneous. "Keep everything, but tier it" is a fundamentally better fit for that shape of data.

The second beneficiary is regulated industry. Finance, healthcare, and government have retention periods written into law, and seven-year retention on an index-priced platform is a budget-destroying event. So everyone shoves old data into an archive, and then, when an investigation comes up, runs a rehydration — re-indexing archived data so it becomes searchable again. That takes hours to days, and waiting through it mid-incident is genuinely painful. Coralogix says it queries archives remotely with no rehydration step. That's also the context for the company's investment in GovCloud and FedRAMP; in January 2026 it announced US Department of Education sponsorship for FedRAMP authorization.

The third beneficiary is investors, and this is where the math gets interesting. Observability used to be a line item inside the IT budget. AI workloads expand that market along two axes at once. One is volume — more data, bigger bill. The other, and the more consequential one, is that the object of observation changed. The old question was "is the system up?" The new question is "did the agent make the right call?" That's closer to quality assurance and audit than to APM, and the budget for it may come out of risk and compliance rather than infrastructure. Advent's Alek Ferro said the quiet part directly: "AI is fundamentally changing how enterprises operate, and observability is evolving into a core business intelligence layer."

Who doesn't benefit? Small teams. An index-free streaming design gets better the more data you push through it, which means at fifty gigabytes of logs a day the advantage over an open-source stack is thin. A Grafana and Loki setup, or your cloud provider's built-in logging, is still cheaper at that scale. And flip the Coralogix numbers around: 5,000 customers but only about 30 paying over $1M a year tells you the growth story is enterprise expansion, and the long tail is not the priority.

There's also a data-sovereignty angle that's easy to skip past. The fact that Streama leaves raw records in your own object storage in an open format is more than a marketing bullet. The strongest form of vendor lock-in is having your history trapped inside somebody else's proprietary index, where leaving means starting your history over. A large share of why Splunk was so hard to escape came down to exactly that.

Splunk and New Relic already ran this experiment

This market has filmed this movie before. Case one is Splunk. From the late 2000s through the mid-2010s, Splunk was synonymous with log analytics, and it monetized through per-indexed-volume pricing with spectacular margins. Then cloud-native architectures arrived, log volume exploded, and the very pricing model that built the company became the reason customers left. "The Splunk tax" became an industry punchline, and engineers started deliberately not logging things. The ending is on the record: Cisco completed its acquisition of Splunk on March 18, 2024 at $157 per share, roughly $28 billion in equity value. A company that created a category got destabilized by that category growing.

Case two is New Relic. It pioneered APM, went public on the NYSE in 2014, and then slowed under the combination of Datadog's unified-platform assault and a bumpy pricing-model transition. On July 31, 2023, Francisco Partners and TPG agreed to take it private at $87 a share, roughly $6.5 billion, ending nine years as a public company. The lesson here is different from Splunk's. New Relic didn't lose because the technology was bad. It lost because it redrew its product boundaries too slowly. When logs, metrics, and traces converged into one purchase, being excellent at only APM stopped being enough.

Now the wins. Datadog started with infrastructure monitoring and kept extending sideways — logs, APM, security, RUM, and now LLM observability — and in Q1 2026 it crossed $1 billion in quarterly revenue for the first time, growing 32% year over year and actually accelerating from 29% the prior quarter. It ended the quarter with roughly 4,550 customers at $100K+ in ARR, up 21% from about 3,770 a year earlier. The takeaway is blunt: in observability, "everything in one pane" beats "one thing done beautifully." Coralogix moving from logs into SIEM and then into AI Center is walking that same road.

The other success worth studying is Grafana Labs, which built its position on the opposite of lock-in: we don't own your data, we connect to the hundred sources you already have. It was named a Leader in the 2026 Gartner Magic Quadrant for Observability Platforms for the third year running and placed furthest on completeness of vision for the second year in a row. SiliconANGLE reported in February 2026 that it was raising at a $9 billion valuation led by GIC — a report, not a company announcement, so treat it accordingly. Either way the direction is the same: right now, not locking up customer data is a competitive advantage rather than a giveaway.

How the competition punches back

The first counter-punch is Datadog, and it isn't hypothetical — Datadog is already winning AI workloads. Per its Q1 2026 results, more than 6,500 customers use its AI integrations. That cohort is 20% of the customer base but roughly 80% of ARR, including 22 customers spending over $1M annually and five over $10M. The usage metrics are the eye-opening part: SRE agent investigations more than doubled quarter over quarter, LLM observability span volume nearly tripled, and MCP server calls quadrupled sequentially. In one quarter. The market Coralogix is aiming at is one Datadog is already expanding into fast.

The second is Palo Alto Networks. On November 19, 2025 it announced a definitive agreement to acquire Chronosphere for $3.35 billion in cash and replacement equity. Chronosphere, a Prometheus-based metrics platform at massive scale, had ARR above $160 million as of September 2025 with triple-digit growth and counted two leading large language model providers among its customers. The significance is the pairing more than the price. A security company buying an observability platform is a bet that telemetry budgets and security budgets are about to come out of the same wallet. Coralogix reads the board the same way — it has been folding SIEM into its platform — so this is a head-on collision.

The third is open standards. OpenTelemetry becoming the de facto instrumentation layer has slashed the cost of switching vendors. That cuts both ways for Coralogix. Poaching Datadog customers got easier, and so did losing your own. In a market with weak lock-in, you re-earn every account on price and product velocity each quarter. That's precisely why Grafana keeps hammering its "big tent" pitch.

The fourth is the hyperscalers. AWS, Google, and Microsoft all ship observability stacks, and since AI workloads run on their infrastructure, they can capture the telemetry more cheaply than anyone. Independent vendors have historically won on product depth, but agent observability is a new category where everyone starts near the same line. If the company selling you the model bundles the tooling to watch the model, a separate contract becomes a harder sell.

The fifth is the new specialists. LangSmith, Langfuse, Braintrust, and similar LLM-native tracing and evaluation tools spread fast among developers. They don't do infrastructure observability at all; they do prompt versioning, eval sets, and trace comparison — the workflows AI teams touch daily. Coralogix and Datadog argue that if you run those separately, you can't see an infrastructure outage and an agent malfunction on one screen. The specialists argue that the tool AI teams actually open every morning is theirs. That fight isn't settled, and it's too early to call.

So what actually changes

For a general user, essentially nothing directly. Indirectly, one thing: when an AI feature inside a product you use gives you a wrong answer or takes a wrong action, whether that company can find and fix the cause depends on infrastructure like this. A company that can't reconstruct why its agent decided what it decided will ship the same failure again. Observability is invisible to users, but it shows up as how fast product quality recovers.

For developers and operators, three things are worth doing this week. First, break your last six months of monitoring spend down by telemetry type and look specifically at how fast LLM spans and tool-call traces climbed as a share. Datadog saw LLM span volume nearly triple across its own customer base in a single quarter — the odds that your curve looks different are not great. Second, if you're sampling, find out exactly what's getting dropped. Agent failures live in the long tail, and uniform sampling is structurally bad at catching them. Third, before your next renewal, read the data-ownership clause. Where the raw records land and in what format is the whole of your negotiating leverage; just getting a real migration quote changes how the next renewal conversation goes.

For investors, two signals. One is that capital in this category has changed character from growth money to infrastructure money. Both the Series E and Series F are anchored by a pension fund (CPPIB) and private equity (Advent, Brighton Park), and the founder is talking about profitability and public-company discipline. That's a cap table built for an IPO or a large acquisition in a three-to-four-year window, and Chronosphere selling at $3.35 billion just set a comparable for whoever gets to similar revenue scale. The other signal is that the multiple has thin support. Valuing a $1.6B company without a disclosed ARR means leaning on reported estimates, which are unverified. If you care about this name, the number worth waiting for is the audited one that shows up at the next round or in IPO prep.

For policy and compliance people, one line. Once agents start executing real work, telemetry stops being operational data and becomes evidence. "Can you reconstruct why the AI made this decision?" is very likely to become an audit requirement, and the answer depends entirely on what percentage of your logs you kept. If cost pressure has you retaining 1-5% today, you will not have time to reverse that decision at the moment a regulator asks. Retention policy has moved from a budget question to a risk question.

One last framing for the whole story. In 2024 there was a fashionable thesis that AI would kill observability companies — if the AI debugs itself, who needs dashboards? The opposite happened. Assaraf told Calcalist that while there were early concerns that AI tools could replace parts of the business, demand instead rose sharply because data volumes exploded. Turns out that when you multiply the number of things that need watching, the watching business does fine.

🥄 Three Things You're Probably Wondering

— So what does this mean for me? Directly, not much. But if you build or operate AI features at work, there's a good chance your next quarterly monitoring bill jumps more than you budgeted. Adding one agent isn't adding a few log lines — it's adding dozens of spans and hundreds of kilobytes of payload per request.

— Why is this happening now? Through 2024 most AI was demos, and demos barely generate telemetry. What changed in 2025 and 2026 is agents reaching production. By Datadog's own measurements, tokens per request more than doubled for the median org in a year and quadrupled for heavy users, and LLM span volume nearly tripled in a single quarter. Index-based pricing has just hit the point where it can't absorb that curve.

— Is Coralogix ahead of Datadog now? No, and the scale gap is enormous. Datadog booked over $1 billion in Q1 2026 revenue alone; Coralogix hasn't even published an official ARR. That said, both sit in the Leaders quadrant of Gartner's 2026 observability platforms evaluation, and Coralogix is playing a different game on the cost axis with its index-free design. Whether that structural edge converts into revenue at scale is still being tested, so it's too early to call.

Sources

Numbers and criteria are as of announcement and may change. Investment calls are yours to make!