Skip to content

Create and manage views

You will learn how to save and open stream views.

A view stores columns, field filters, optional complete-event text search, time mode, optional shape matching, and optional aggregate settings so you can reopen the same exploration later.

Create a view

Common paths:

  1. Views — create a blank view, then set columns, filters, and time mode.
  2. Query — run a search or aggregate, then Save as view.
  3. Insights — create from a suggested view or any observed shape (one-click or preview/edit first). See Use Insights.

Suggested views from Insights include a structural cohort matcher so the saved view matches the events the suggestion described.

When you create or save, choose Visibility:

  • Private (default) — only you can see it.
  • Stream — every member who can query the stream can open it.

This is not the same as making the stream Private or Team. See Views.

Open a view

  1. Expand Views in the sidebar (or open the Views page). Private views show a Private badge; Stream-visible views are listed for every member who can query the stream.
  2. Click the view name.
  3. Confirm the selected stream matches the view’s stream.

Absolute and relative views resolve through Query. Live views tail matching events as they arrive; structural shape matching still applies when configured. Live tails and aggregate auto-refresh show Connected / Retrying / Connection failed plus the last successful update.

Edit and autosave

If you own the view, the Views page lets you adjust:

  • Name
  • Visibility — Private or Stream
  • Event text — case-insensitive Contains or RE2 Regex
  • Filters
  • Columns (projection)
  • Time mode — relative (lookback), absolute (range), or live
  • Event table vs Aggregate chart settings, including Prior period compare on aggregates

Those edits autosave. Rename, visibility, and delete stay owner-only.

If you open someone else’s Stream-visible view, you can change filters and columns for exploration, but Cordo does not write those changes back to the shared view. Use Save as new to duplicate the current configuration under a new name (default Private). Structural shape matching is preserved across save and save-as-new. Event text and learned-field filters combine with AND for relative, absolute, and live views.

Event vs aggregate

Mode What you see
Event table Matching rows for the window (or live tail)
Aggregate Count/sum/percentile style chart or summary

Switch modes when you need a different answer from the same cohort.

Columns and event detail

Choose which learned fields appear as columns. Drag a column header to reorder (or use arrow keys). Switch Timestamp display to UTC or Local. Open a row for event detail when you need the full payload context for one event. Envelope _raw fields stay hidden in the table and field list; Copy still includes the stored payload.

Event views can Download CSV or Download NDJSON the same way Query search does.

Next