Skip to content

Create and manage streams

You will learn how to create, rename, and manage streams.

A stream is the destination for events, fields, views, and ingest API keys.

Before you start

Sign in. See Sign up, sign in and sessions.

Create a stream

You must be a current member of the selected workspace. Workspace owners, admins, and members can all create streams there.

From the sidebar

  1. In the Streams section, click New stream.
  2. In Create stream:
  3. Name (required) — for example api-prod
  4. Description (optional)
  5. Visibility — Private (invited people plus workspace owners/admins) or Workspace (every workspace member can query). Change this later on Members.
  6. Retention — how long to keep events (presets such as 3 days, 7 days, 30 days, 90 days, 1 year)
  7. Max stored bytes — leave empty for no size limit
  8. Parse user agents — optional; adds {field}_parsed browser/OS/device details beside detected user-agent fields
  9. Redact sensitive fields on ingest — optional; replaces passwords, tokens, and configured paths with [REDACTED] before storage (cannot undo for already-ingested events)
  10. Extra field paths — when redaction is on, optional one-path-per-line list (for example headers.cookie)
  11. Click Create stream.

Cordo selects the new stream in the sidebar.

From the Streams page

  1. Open Streams.
  2. Click New stream and use the same dialog.

Select a stream

Click a stream name in the sidebar. Fields, Insights, Query, Events, and API keys all use the selected stream.

Edit a stream

  1. Select the stream.
  2. Open Streams.
  3. Edit name, description, retention, max stored bytes, or Parse user agents.
  4. Save the changes.

Clear a stream

Use Clear content & learnings when you want to keep the stream (same id, settings, ingest keys, members, views, monitors, channels, and metric definitions) but wipe everything ingested and learned — as if the stream had just been created. Prefer this over deleting and rebuilding the stream.

Delete removes the stream itself. Retention only drops old events (and usage counts) and leaves the learned catalog and findings in place.

From Streams

  1. Select the stream → open Streams.
  2. Open the stream’s … menu → Clear content & learnings….
  3. Review what is kept vs permanently cleared.
  4. Check the acknowledgment that the action cannot be undone.
  5. Type the exact stream name to enable Clear stream.
  6. Confirm.

After a clear, events and usage counters are empty, the field/shape/pattern catalog and schema-learning skips are gone, anomaly findings and mutes are removed, and the detection learning window restarts (a full learning period on the next enable, or immediately if detection is already on). Recorded metric series and monitor/alert history are cleared; metric and monitor definitions remain.

Alerts and pattern filters

  • Open alerts close. Each channel that was told an alert fired gets a resolved notification marked stream cleared (if resolve notifications are on for that monitor's channel). PagerDuty incidents close. The message has no investigation link because the alert itself is deleted.
  • Pattern-scoped config is disabled, not widened. Pattern ids are never reused, so after a clear the old ids match nothing. Cordo disables:
  • findings monitors limited to specific patterns (their pattern list is emptied),
  • metrics whose query filters on patterns (including metrics created with Watch),
  • monitors on those metrics, and monitors on views that filter on patterns.

Each one shows why it was disabled on the Monitors or Metrics page. Pick new patterns once the stream has re-learned them, then enable it again; the note clears when you do. Saved views keep their pattern filters, which stop matching until you update them. - Monitors wait for a full window of new data. A window that starts before the clear would only see part of its events, so absence and "count below N" monitors could fire on a healthy stream. Monitor history shows those windows as skipped ("stream was cleared at …") until the first window that starts after the clear. Change monitors also hold until their previous window is after the clear, and baseline monitors only use periods after the clear.

Agents: manage_streams with action: clear, confirm: true, and confirm_name set to the exact stream name. See MCP tools.

Read usage

On Streams (and Events), Cordo shows approximate usage: event count, raw size, and analytics sizes. Use this when deciding whether to tighten retention or set a max stored bytes cap.

Details: Configure retention.

Schema learning

On Streams, Schema learning shows field and shape catalog limits (Within limits or Limits active). Crossing a hard cap skips new paths or fingerprints; events still store. This is separate from type conflicts and analytics sync. Fields and Insights show the same banner when a limit applies.

Ingest refused

If producers hit a storage cap, rate/byte budget, or request-size limit, Streams shows Ingest refused: with a reason code and count (for example storage_cap, rate_events). Fix the producer or raise the cap — those refusals never stored a payload.

Send events next

Mint a key, then pick an ingest path:

  1. Manage stream API keys
  2. Ingest your logs — every supported method

Next

Return to Workflows.