What is Cordo?
You will learn the mental model for streams, fields, shapes, views, Insights, patterns, and findings.
Cordo is a schema-learning log platform. You send JSON events into a stream. Cordo discovers the fields those events contain, materializes them for fast query, and lets you filter and aggregate without writing JSON path extracts by hand.
The loop
Every production path follows the same pipeline:
- Ingest — JSON events land in a stream (native HTTP, OpenSearch bulk, OTLP Logs, collectors, or MCP sample ingest).
- Observe — Cordo learns field paths and types, fingerprints recurring event shapes, and groups log messages into patterns.
- Materialize — Learned fields become queryable columns in the analytics store (this can lag slightly behind ingest).
- Query — You filter, look back, aggregate, save views, and use Insights starters on the schema your logs already taught.
You do not define a schema up front. The catalog grows as real events arrive.
Core nouns
| Noun | What it is |
|---|---|
| Stream | A named destination for events. Settings, retention, and ingest API keys belong to the stream. |
| Field | A learned JSON path and type (for example level, http.method, items[].id). Browse them on Fields. |
| Shape | A structural fingerprint: which shallow keys appear together on an event. Insights ranks shapes by how often they appear. |
| View | A saved query: columns, filters, time mode, and optionally a shape cohort. |
| Insights | Ranked shapes plus suggested views you can create in one or two clicks. |
| Metric | An aggregate query recorded on a schedule as a time series you can watch and keep. |
| Pattern | A log line template with ids, numbers, and other variable parts masked. Browse them on Patterns. |
| Finding | Something unusual anomaly detection spotted by comparing a stream with its own history — a new pattern, a spike or drop, an error-rate or volume shift, or an unusual metric. |
| Monitor | A detection rule over a view or metric (threshold, absence, change, or baseline), or over findings. |
| Alert | A fired monitor with a firing → resolved lifecycle and immutable evidence. |
| Notification channel | A reusable destination — webhook, email, Slack-compatible, or PagerDuty. |
| Stream API key | Secret for ingest (lax_…), sent as X-API-Key (or as the Basic password for OpenSearch-compatible bulk). Shown once when created. |
| Personal access token | User-scoped token (lxp_…) for MCP and agent workflows — not for production log shipping. |
What Cordo is not
- Not a place you design a rigid schema before the first event
- Not a traces or external-metrics backend — Cordo ingests OTLP Logs only and records metrics from your logs, rather than scraping Prometheus or ingesting OTLP metrics. Log-derived metrics and alerting are core; see Detect and alert.
- Not a replacement for free-form Query — Insights and views accelerate common cohorts, and findings point at what changed; Query stays available for exploration
Next
Create a place to receive events: Create your first stream.