Concepts

You will learn the core building blocks that appear throughout Cordo.

This page is a compact map of the terms you will see first. Use the deeper concept pages below when you need the full model for an area. Hands-on steps live under Workflows.

Deeper concept pages

Streams and ingest — destinations, pipeline, retention
Fields and shapes — learned catalog and structure
Views — saved queries and cohorts
Query and aggregates — search, filters, charts
Insights — shapes and suggested views
Detect and alert — metrics, monitors, alerts, channels
Patterns and findings — log patterns and anomaly detection
API keys and personal access tokens
Accounts and security

Stream

A stream is a named destination for JSON events. Each stream has its own field catalog, materialization, views, API keys, and retention settings.

Field

A field is a learned path and type from ingested JSON, such as status or request.duration_ms. You filter and aggregate on fields without writing JSON extracts.

Shape

A shape is a recurring structural fingerprint of events in a stream (which keys appear together). Insights uses shapes to show dominant patterns and suggest views that match those cohorts — see Insights.

View

A view is a saved query configuration: columns, filters, time mode, optional structural shape matching, and optional aggregates. Views can resolve to event rows or chart series, including a live tail. Each view is Private (creator only) or Stream (anyone who can query that stream).

Metric, monitor, alert

A metric is an aggregate query recorded on a schedule as a time series. A monitor is a detection rule over a view or metric; when its condition holds it opens an alert (firing → resolved) and delivers it through a reusable notification channel. See Detect and alert.

Pattern, finding

A pattern is a log line template with the variable parts masked, so lines that differ only by ids or numbers count together. With anomaly detection on, Cordo compares the stream with its own history and raises a finding for anything unusual: a new pattern, a spike or drop, an error-rate or volume shift, or a recorded metric far from usual. See Patterns and findings.