What is Cordo?
You will learn the mental model for streams, fields, shapes, views, and Insights.
Cordo is a schema-learning log platform. You send JSON events into a stream. Cordo discovers the fields those events contain, materializes them for fast query, and lets you filter and aggregate without writing JSON path extracts by hand.
The loop
Every production path follows the same pipeline:
- Ingest — JSON events land in a stream (native HTTP, OpenSearch bulk, OTLP Logs, collectors, or MCP sample ingest).
- Observe — Cordo learns field paths and types, and fingerprints recurring event shapes.
- Materialize — Learned fields become queryable columns in the analytics store (this can lag slightly behind ingest).
- Query — You filter, look back, aggregate, save views, and use Insights starters on the schema your logs already taught.
You do not define a schema up front. The catalog grows as real events arrive.
Core nouns
| Noun | What it is |
|---|---|
| Stream | A named destination for events. Settings, retention, and ingest API keys belong to the stream. |
| Field | A learned JSON path and type (for example level, http.method, items[].id). Browse them on Fields. |
| Shape | A structural fingerprint: which shallow keys appear together on an event. Insights ranks shapes by how often they appear. |
| View | A saved query: columns, filters, time mode, and optionally a shape cohort. |
| Insights | Ranked shapes plus suggested views you can create in one or two clicks. |
| Metric | An aggregate query recorded on a schedule as a time series you can watch and keep. |
| Monitor | A detection rule over a view or metric (threshold, absence, change, or baseline). |
| Alert | A fired monitor with a firing → resolved lifecycle and immutable evidence. |
| Notification channel | A reusable destination — webhook, email, Slack-compatible, or PagerDuty. |
| Stream API key | Secret for ingest (lax_…), sent as X-API-Key (or as the Basic password for OpenSearch-compatible bulk). Shown once when created. |
| Personal access token | User-scoped token (lxp_…) for MCP and agent workflows — not for production log shipping. |
What Cordo is not
- Not a place you design a rigid schema before the first event
- Not a traces or external-metrics backend — Cordo ingests OTLP Logs only and records metrics from your logs, rather than scraping Prometheus or ingesting OTLP metrics. Log-derived metrics and alerting are core; see Detect and alert.
- Not a replacement for free-form Query — Insights and views accelerate common cohorts; Query stays available for exploration
Next
Create a place to receive events: Create your first stream.