Skip to main content

Overview

DataStream converts pipelines written for another telemetry platform into native DataStream pipelines. The conversion is performed by VirtualMetric's hosted MCP server, which an AI coding agent drives on your behalf — see Testing for how to connect an agent.

Conversion produces a native pipeline: name, description, and an ordered list of processors. There are no vendor-specific processors in the result, and no compatibility layer at runtime. A converted pipeline is an ordinary DataStream pipeline that you can read, edit, and run like any other.

Available Paths​

Source platformGuide
Cribl StreamFrom Cribl
Azure Sentinel ASIM parsers, and KQL queriesFrom KQL
LogstashFrom Logstash

Workflow​

Migration is a conversion followed by a verification. The conversion is mechanical; the verification is where you confirm the converted pipeline behaves the way the original did.

  1. Convert. Give the agent your exported source pipeline. It returns a DataStream pipeline in YAML.

  2. Read the warnings. A source function with no native equivalent does not abort the conversion — it is preserved as a Comment processor carrying its original configuration, and a warning line is added to the pipeline's description. These warnings are the list of things still to do by hand.

  3. Test. Run a representative event through the converted pipeline with the test_pipeline tool. Use the same sample data you tested with on the source platform, so the two outputs can be compared directly.

  4. Validate. If you have an expected output, confirm parity with validate_pipeline (pass/fail) or diff_pipeline (a unified diff of expected against actual).

What Conversion Does Not Do​

Conversion translates pipeline logic only. Sources, destinations, and routing are not part of a pipeline export and are not converted — configure them as Devices, Targets, and Routes.

A converted pipeline is a faithful copy of the original, not an optimized one. It reproduces the source pipeline's structure, including any steps that were disabled at the time of export.