Skip to content

Use Insights

You will learn how to explore shapes and create suggested views that match the events they describe.

Before you start

  1. Select a stream in the sidebar.
  2. Ingest some JSON events into that stream (see Ingest your logs).
  3. Wait until shapes appear — Insights ranks structures Cordo has already seen.

Open Insights from the app sidebar.

Read the shapes table

The shapes table lists observed key combinations, ranked by frequency.

Column Meaning
Keys Top-level and nested shallow paths for that fingerprint
Events / Share How often this exact shape has been seen on the stream
First / Last seen When the fingerprint first and most recently appeared

Expand a row to view a redacted sample log for that shape when a sample is available. The table always shows exact fingerprints for schema debugging — even when suggestions group near-identical shapes into families.

Use a suggested view (one click)

When Cordo has enough signal, a Suggested views section appears above the table.

  1. Read the name, reason, and field tags (required / optional when shown).
  2. Note any value filter line (for example level eq error).
  3. Click Create view.

Cordo opens a saved view with:

  • Columns ready for that structure
  • A structural cohort matcher (contains for everyday / family suggestions, or exact for wide shapes and shape-table starters)
  • Optional value filters when statistics support them

The view should show the cohort the suggestion described for the same lookback, not every event in the stream.

Preview and edit before creating

Use this when you want to verify or tweak a suggestion first.

  1. Click Preview on a suggestion card.
  2. Adjust name, lookback, filters, or columns as needed.
  3. Confirm match count / share and the redacted sample rows for that window.
  4. Click Create view in the preview panel.

Unchanged suggestions still support one-click Create. Preview and Create use the same normalized query, so results should not silently diverge for an unchanged window and data set.

Loading, empty cohorts, and query errors show inline in the preview panel.

Create from any shape

You are not limited to the top suggestions.

  1. Find a row in the shapes table.
  2. Click Create from this shape (or open its preview).
  3. Review the exact-shape cohort, adjust if needed, then create.

This is useful when a rare but important structure did not make the suggestion cap, or when you want exact fingerprint matching for schema work.

What good suggestions look like

Signal What it means
Reason mentions containing / exact / family matching The suggestion defines a real cohort
Required vs optional field groups Family suggestion spanning near-identical shapes
Filter reason cites recent count/share Value filter came from windowed stats, not one sample
Purpose-built name (for example “HTTP requests”) Familiar pattern recognised with enough confidence
Generic “Shape: …” / “Family: …” name Fallback for unfamiliar schemas — still useful

Reload Insights on unchanged data: ordering and names should stay stable.

After you create

  • Open the view and confirm the cohort for your lookback.
  • Edit filters or columns on the Views page as usual — structural shape matching is preserved when you save.
  • For free-form exploration without a saved view, use Query events.

Troubleshooting

Symptom What to check
No shapes yet Ingest JSON; wait for observe/materialize; select the correct stream
Suggestion looks right but view shows everything Confirm the view’s query includes a shape matcher; recreate from Insights after LATT-228
Preview count disagrees with the created view Use the same lookback; data may still be ingesting
Old events missing from a shape-matched view Shape metadata applies to newly materialized rows; older history may need rematerialization
Expected value filter missing Dominant-but-useless values and high-cardinality identifiers are excluded by design

Next