Skip to content

Five-minute tour

You will learn the main navigation surfaces in Cordo.

Use this after you have a stream and a few ingested events. Keep that stream selected in the sidebar — most pages are stream-scoped.

Streams

The Streams section lists your streams. Click a name to select it. Open the Streams page to edit name, description, retention, and API keys for the selected stream. Schema learning shows catalog limits; Ingest refused appears when producers were rejected.

Create another stream anytime with New stream.

Fields

Fields is the learned catalog for the selected stream: paths, types, and samples. This is how Cordo turns free-form JSON into filterable columns.

If Fields looks empty, confirm you selected the right stream and that events have been ingested recently.

Insights

Insights shows:

  • Suggested views — create-ready starters from dominant shapes (and optional value filters)
  • A shapes table — every observed structural fingerprint, ranked by frequency

Use Create view or Preview on a suggestion when you want a saved cohort without rebuilding filters by hand. See Use Insights.

Query

Query is free-form exploration: filters, lookbacks, columns, and aggregates on learned fields. Run a search, then save it as a view when the result is worth keeping. On aggregates, Compare → Prior period overlays the previous window. Search results can Download CSV or Download NDJSON.

Events

Events shows recent events for the selected stream — useful for a quick “did ingest work?” check without building a full query. Live tail shows Connected, Retrying, or Connection failed plus the last update.

Views

The Views section lists saved views you can open: your Private views plus Stream-visible views on streams you can query. Open one to resolve or live-tail the saved configuration (columns, filters, time mode, optional shape matcher). Drag column headers to reorder; switch timestamps UTC / Local.

Create views from Views, from Query (“save as”), or from Insights suggestions. New views default to Private.

Patterns

Patterns groups the selected stream's log lines into templates, with ids, numbers, and addresses masked. Pick Last 1h, Last 24h, or Last 7d, then sort by Events, Change, or First seen to see what is loud, what changed, and what is new. Click a pattern for its chart, level mix, services, and recent examples.

Findings

Findings lists anything unusual Cordo spotted by comparing the stream with its own history: new patterns, spikes and drops, error-rate or volume shifts, and unusual recorded metrics. Turn it on once per stream with Turn on anomaly detection. See Patterns and findings.

Metrics, Monitors, and Alerts

The detect surfaces turn a query into something Cordo watches:

  • Metrics records aggregate queries as time series (Save as metric from Query).
  • Monitors evaluates a metric or view on a schedule and opens alerts, or alerts on findings.
  • Alerts lists what fired, with evidence and monitor history.

Notification channels (webhook, email, Slack, PagerDuty) live on the Streams page and attach to monitors. See Detect and alert.

Settings — API tokens

Under settings, API tokens manages personal access tokens (lxp_…) for MCP and agent workflows. These are not stream ingest keys.

Stream ingest secrets stay on the Streams page under API keys (lax_…).

Suggested first-day path

  1. Confirm events on Events or Query.
  2. Skim Fields so you know what you can filter on.
  3. Open Insights and create one suggested view if suggestions appear.
  4. Bookmark that view from the Views list.
  5. Open Patterns to see what your logs say most, then turn on anomaly detection from Findings.

Next