Live Data
Live Data captures pipeline messages at a chosen processing stage, so you can watch real data as it moves through a component. Use it to verify transformations, diagnose routing, and inspect message content at a specific point in the chain.
A capture is a bounded session, not a continuous tail: you set a duration and an event limit, start it, and the results stay on screen as a searchable table you can export.
Availability
Live Data appears on the detail pages of the following components:
| Component | Navigation Path |
|---|---|
| Director | |
| Cluster | |
| Device | |
| Agent device | |
| Target | |
| Advanced Route |
The Pipeline Debugger also offers Live Data as a dataset provider, so a capture can become debugger input.
Running a Capture
With nothing captured yet, the tab shows an empty state and a
| Setting | Notes |
|---|---|
| The processing stage to intercept at — see Capture Locations | |
| 5 to 60; defaults to 60 | |
| 100 to 5,000; defaults to 1,000 | |
| Restricts the capture to messages containing this text |
Click
Once they confirm, the bar switches to the running view, reporting that it is capturing and counting the events received;
A capture stops when its time elapses, when it reaches its event limit, or when you stop it — whichever comes first. Its results stay on screen until you clear them.
Two rows mark the boundaries of the session in the table itself, recording when the capture started and when it completed. They are markers rather than data, so they are not counted in the event totals.
If the connection drops or the server fails the capture, the status bar says so and asks you to start a new one; partial results already received remain.
Capture Locations
The capture location is the pipeline stage at which messages are intercepted. Which locations are offered depends on where you are.
Directors and Clusters
| Location | Description |
|---|---|
| Before pre-processing | Raw data as received, before any pre-processing pipeline runs |
| After pre-processing | Data after pre-processing |
| Before route | Data as it enters routing |
| After route | Data after routing has selected its destinations |
| Before post-processing | Data before the post-processing pipeline runs |
| After post-processing | Final data, as delivered to the target |
Directors and clusters default to Before post-processing.
Devices and Targets
Devices and targets offer the four pipeline stages — before and after pre-processing, before and after post-processing. Devices default to Before pre-processing, targets to After post-processing, since a target sits at the end of the chain and the interesting question there is what actually arrived.
Devices that receive a framed TCP stream additionally offer Raw data, which captures the bytes before any pipeline sees them. This covers TCP devices, and Syslog devices only when they listen over TCP or TLS — over UDP there is no framed stream to capture, so the option is not offered.
Agent devices do not offer raw capture.
Advanced Routes
| Location | Description |
|---|---|
| Before route | Data as it enters the route, before route processing (default) |
| After route | Data after route processing completes |
What a Capture Sees
The component you started from determines the scope:
- Director — everything flowing through that Director, across all devices, targets, and routes
- Cluster — everything flowing through the cluster
- Device — only data originating from that device
- Agent device — only data collected by that agent
- Target — only data destined for that target
- Advanced Route — only data flowing through that route
The Results Table
Captured events appear as a table. Its columns depend on the page, because what usefully identifies an event differs by context:
| Page | Related column | Source | Target | Route |
|---|---|---|---|---|
| Director, Cluster, Advanced Route | Yes | Yes | Conditional | |
| Device | Yes | Yes | Conditional | |
| Agent device | No | Yes | Conditional | |
| Target | No | No | Always |
Every table also carries
A target page relates events to the device they came from rather than showing a Source column, since the page is the source's destination. On an agent device the data source is the device itself, so Source is dropped there too.
The Route Column
One source event produces one row per route it travelled. Without a route column those rows read as duplicate delivery, which is why the column exists.
Routing happens between pre-processing and post-processing, so a record captured before that point does not yet know its route. The column therefore appears only when capturing at Before post-processing or After post-processing. On a target page it is always shown; on an Advanced Route page it never is, because every row there belongs to that one route.
Routes created as quick routes are labelled
Where an event names a device, target, route, or dataset, the cell links through to that component.
Searching and Exporting
| Control | Effect |
|---|---|
| Copies the captured output to the clipboard | |
| Saves the capture as CSV, JSON, or ZIP | |
| Clears the results and returns the tab to its empty state |
An exported file carries both the displayed date and the original wire timestamp, so a script reading it never has to infer a timezone. If a search term was active when you exported, the file records it along with the filtered and total counts — a filtered export is otherwise indistinguishable from a complete one.
Prerequisites
Live Data needs the component to be enabled and to have an active data path. When it does not, the tab explains which condition failed instead of offering a capture:
| Component | Enabled Condition | Connected Condition |
|---|---|---|
| Director | Director must be enabled | Director must be connected |
| Cluster | Cluster must be enabled | Cluster must be connected |
| Device | Device must be enabled | At least one associated Director must be connected |
| Target | Target must be enabled | At least one route must be sending data to the target |
| Advanced Route | Route must be enabled | The route must be running on a connected Director |
Permissions
Viewing the