Views

You will learn how saved views capture columns, filters, time modes, and optional structural cohorts — and who can see them.

A view is a named, saved query configuration for a stream. Opening a view resolves or live-tails events (or an aggregate chart) without rebuilding the query from scratch.

What a view stores

Piece	Role
Columns	Projection — which fields appear in the table
Filters	Value predicates on learned fields (`eq`, `contains`, …)
Time mode	Relative lookback, absolute range, or live tail
Shape (optional)	Structural cohort — `exact` fingerprint or `contains` required paths
Aggregate settings (optional)	Chart mode (count, sum, …) instead of an event table; optional Prior period compare
Table layout	Column widths, column order, and UTC vs Local timestamp display
Visibility	Private (creator) or Stream (query members)

Columns and shape matching are intentionally separate: columns decide what you see; shape (and filters) decide which rows belong.

Visibility

Each view is either Private or Stream. This is independent of stream visibility (Private vs Workspace).

Visibility	Who can list, open, resolve, or tail
Private	The creator only
Stream	Anyone who can already query that stream

New views default to Private. Existing views created before this model were kept Stream so previously shared lists did not disappear.

Only the owner (the person who created the view) can rename it, change visibility, edit the saved query, or delete it. Opening a Stream-visible view does not grant ingest keys, stream settings, or other members’ private views.

Private view names are unique per owner on a stream. Stream-visible names are unique across that stream.

Creating views

Common entry points:

Views — create a blank view and edit filters/columns
Query — run a search, then save as a view
Insights — one-click or preview/create from a suggested view or any observed shape

Suggestions from Insights include a create-ready cohort so the saved view matches the events the suggestion described. See Use Insights.

Opening a view

The sidebar and Views list show your private views plus every Stream-visible view on streams you can query.
Absolute / relative views resolve through the query engine (including shape matchers when set).
Live views tail matching events as they arrive; structural matching still applies.
Aggregate views show charts and can auto-refresh. Prior period compare stays on the view when you save it from Query.

Live event tails and aggregate auto-refresh show connection copy: Connected, Retrying, or Connection failed, plus when the last successful update landed.

Views in the sidebar can be drag-and-drop reordered to customize your list. Your custom order is persisted per user on the server, follows you across devices, and does not alter anyone else's sidebar. New or unranked views append at the bottom in alphabetical order.

Cross-stream views and token boundaries

Views saved from a multi-stream Query keep those source streams in the saved query. The view's home stream owns its name, visibility, and edit permissions, but access to the home stream alone is not enough to run it.

You must retain the Query role or higher on every referenced stream.
A personal access token with a stream allowlist must include the home stream and every referenced stream.
Cordo checks the complete set before creating, updating, previewing, resolving, tailing, or exporting the view. If one stream is unavailable, the whole operation returns not found; it never returns partial events, aggregates, cursors, freshness data, export bytes, or MCP name candidates.

Global REST/MCP view lists include only views whose home stream is inside the token allowlist. Filtering happens before saved sidebar order and name ambiguity are calculated, so excluded views cannot affect visible ordering or resolver candidates. Reading a view definition requires events:read; previewing or saving/deleting a view, reading or changing its table layout, and changing sidebar order require views:write.

The same checks apply when MCP resolves a view UUID or name without an explicit stream_id. An unrestricted token still follows current stream membership. Interactive web sessions keep the same valid cross-stream behavior.

If you own the view, edits to name, filters, columns, time mode, and visibility autosave on the Views page. If you do not own it, you can still explore; use Save as new to keep your own copy (default Private). Structural shape matching is preserved across save and “Save as new” when present.

Event vs aggregate views

A view can open as:

An event table (search-style projection)
An aggregate chart or summary (count, sum, percentiles, …)

Time mode is independent of that choice: relative lookback, absolute range, or live tail (live applies to matching events as they arrive). Absolute and relative views can also set Time basis to Receipt (ingest time) or Event time (producer time derived at ingest). Live tails always use receipt time.

Event table layout

On an event table you can:

Drag a column header (or use arrow keys) to reorder columns — order sticks with the view and the Columns menu.
Resize columns; widths stick per account.
Switch Timestamp display between UTC and Local (browser time zone). That choice is saved with the view’s table layout.

Envelope originals such as log._raw stay out of Events and field lists so extracted children stay readable. Copy still includes the stored payload.