Concepts

You will learn the core building blocks that appear throughout Cordo.

This page is a compact map of the terms you will see first. Use the deeper concept pages below when you need the full model for an area. Hands-on steps live under Workflows.

Deeper concept pages

Streams and ingest — destinations, pipeline, retention
Fields and shapes — learned catalog and structure
Views — saved queries and cohorts
Query and aggregates — search, filters, charts
Insights — shapes and suggested views
Detect and alert — metrics, monitors, alerts, channels
API keys and personal access tokens
Accounts and security

Stream

A stream is a named destination for JSON events. Each stream has its own field catalog, materialization, views, API keys, and retention settings.

Field

A field is a learned path and type from ingested JSON, such as status or request.duration_ms. You filter and aggregate on fields without writing JSON extracts.

Shape

A shape is a recurring structural fingerprint of events in a stream (which keys appear together). Insights uses shapes to show dominant patterns and suggest views that match those cohorts — see Insights.

View

A view is a saved query configuration: columns, filters, time mode, optional structural shape matching, and optional aggregates. Views can resolve to event rows or chart series, including a live tail. Each view is Private (creator only) or Stream (anyone who can query that stream).

Metric, monitor, alert

A metric is an aggregate query recorded on a schedule as a time series. A monitor is a detection rule over a view or metric; when its condition holds it opens an alert (firing → resolved) and delivers it through a reusable notification channel. See Detect and alert.