Skip to content

Create and manage streams

You will learn how to create, rename, and manage streams.

A stream is the destination for events, fields, views, and ingest API keys.

Before you start

Sign in. See Sign up, sign in and sessions.

Create a stream

From the sidebar

  1. In the Streams section, click New stream.
  2. In Create stream:
  3. Name (required) — for example api-prod
  4. Description (optional)
  5. Retention — how long to keep events (presets such as 3 days, 7 days, 30 days, 90 days, 1 year)
  6. Max stored bytes — leave empty for no size limit
  7. Parse user agents — optional; adds {field}_parsed browser/OS/device details beside detected user-agent fields
  8. Redact sensitive fields on ingest — optional; replaces passwords, tokens, and configured paths with [REDACTED] before storage (cannot undo for already-ingested events)
  9. Extra field paths — when redaction is on, optional one-path-per-line list (for example headers.cookie)
  10. Click Create stream.

Cordo selects the new stream in the sidebar.

From the Streams page

  1. Open Streams.
  2. Click New stream and use the same dialog.

Select a stream

Click a stream name in the sidebar. Fields, Insights, Query, Events, and API keys all use the selected stream.

Edit a stream

  1. Select the stream.
  2. Open Streams.
  3. Edit name, description, retention, max stored bytes, or Parse user agents.
  4. Save the changes.

Read usage

On Streams (and Events), Cordo shows approximate usage: event count, raw size, and analytics sizes. Use this when deciding whether to tighten retention or set a max stored bytes cap.

Details: Configure retention.

Schema learning

On Streams, Schema learning shows field and shape catalog limits (Within limits or Limits active). Crossing a hard cap skips new paths or fingerprints; events still store. This is separate from type conflicts and analytics sync. Fields and Insights show the same banner when a limit applies.

Ingest refused

If producers hit a storage cap, rate/byte budget, or request-size limit, Streams shows Ingest refused: with a reason code and count (for example storage_cap, rate_events). Fix the producer or raise the cap — those refusals never stored a payload.

Send events next

Mint a key, then pick an ingest path:

  1. Manage stream API keys
  2. Ingest your logs — every supported method

Next

Return to Workflows.