Edge Delta

https://docs.edgedelta.com/
Admin
Edge Delta is a real-time data observability platform that processes, analyzes, and routes logs,...
Tokens:1,120,380
Snippets:15,639
Trust Score:10
Update:3 months ago
Show doc for...
Tokens:
Raw
### Complete Same-Host Deployment Example

Source: https://docs.edgedelta.com/zero-code-instrument-golang-otel

This example demonstrates starting the Go application in the background and then running the instrumentation with all necessary environment variables configured.

```bash
# Start your application in the background
./myapp &

# Run instrumentation with all configuration
sudo OTEL_GO_AUTO_TARGET_EXE="/path/to/myapp" \
     OTEL_SERVICE_NAME="my-go-service" \
     OTEL_EXPORTER_OTLP_ENDPOINT="http://localhost:4318" \
     OTEL_EXPORTER_OTLP_PROTOCOL="http/protobuf" \
     OTEL_LOG_LEVEL="info" \
     otel-go-instrumentation

```

--------------------------------

### Install and Start Edge Delta Agent from Local Directory

Source: https://docs.edgedelta.com/install-linux

Navigates to the agent directory and installs and starts the Edge Delta agent service locally.

```bash
cd /opt/edgedelta/agent/
./edgedelta -s install
./edgedelta -s start
```

--------------------------------

### Redis Data Setup

Source: https://docs.edgedelta.com/redis-enrichment-processor

Example commands to set initial data in Redis for testing the enrichment processor.

```bash
SET "user:123" "John Doe"
SET "user:456" "Jane Smith"

```

--------------------------------

### Install and Start Edge Delta Service (Offline)

Source: https://docs.edgedelta.com/install-macos

After extracting the agent archive, navigate to the agent directory and use these commands to install and start the Edge Delta system service.

```bash
cd /opt/edgedelta/agent/
sudo ./edgedelta -s install
sudo ./edgedelta -s start
```

--------------------------------

### Get Query Examples

Source: https://docs.edgedelta.com/grafana-connector

Fetches example queries for a given datasource type. Useful for understanding how to query specific datasources.

```APIDOC
## get_query_examples

### Description
Gets example queries for a datasource type.

### Method
Not specified (assumed to be a tool invocation)

### Endpoint
Not specified

### Parameters
Not specified
```

--------------------------------

### SNMPv2c Cold Start Trap Example

Source: https://docs.edgedelta.com/snmp-trap-input-node

Shows the command to send a raw SNMPv2c cold start trap and the resulting processed data item in the pipeline.

```bash
snmptrap -v 2c -c public <edge-delta-host> "" \
  1.3.6.1.6.3.1.1.5.1 \
  1.3.6.1.6.3.1.1.5.1 s "coldStart trap from router"
```

```json
{
  "_type": "log",
  "timestamp": 1756958216967,
  "body": "SNMP 2c trap from 10.244.0.20",
  "resource": {
    "ed.source.name": "snmp_trap_receiver",
    "ed.source.type": "snmp_trap_input",
    "host.ip": "172.19.0.2",
    "host.name": "edge-delta-agent",
    "service.name": ""
  },
  "attributes": {
    "network.peer.ip": "10.244.0.20",
    "snmp.pdu.type": "SNMPv2Trap",
    "snmp.request.id": 2112302011,
    "snmp.varbinds": {
      ".1.3.6.1.2.1.1.3.0": {
        "centiseconds": 3522368,
        "duration": "9h47m3.68s",
        "seconds": 35223.68
      },
      ".1.3.6.1.6.3.1.1.4.1.0": ".1.3.6.1.6.3.1.1.5.1",
      ".1.3.6.1.6.3.1.1.5.1": "coldStart trap from router"
    },
    "snmp.variables.count": 3,
    "snmp.version": "2c"
  },
  "observed_timestamp": 1756958216990
}
```

--------------------------------

### Run Linux/macOS Installer Script

Source: https://docs.edgedelta.com/zero-code-instrument-dotnet-otel

Execute the downloaded script to install the .NET auto-instrumentation components. The installation directory is typically $HOME/.otel-dotnet-auto/.

```bash
sh ./otel-dotnet-auto-install.sh
```

--------------------------------

### Start Go Application

Source: https://docs.edgedelta.com/zero-code-instrument-golang-otel

Begin by running your Go application normally. This command starts the application.

```bash
./myapp

```

--------------------------------

### Event Hub Connection String Example

Source: https://docs.edgedelta.com/event-hub-source-node

Provides an example of a complete connection string for an Azure Event Hub input node. The connection string must start with 'Endpoint=sb://'.

```yaml
nodes:
  - name: my_azure_eventhub
    type: eventhub_input
    connection_string: "Endpoint=sb://your-namespace.servicebus.windows.net/;SharedAccessKeyName=your-policy;SharedAccessKey=your-key;EntityPath=your-eventhub"

```

--------------------------------

### Complete ASP.NET Core Instrumentation Example

Source: https://docs.edgedelta.com/instrument-dotnet-otel

A comprehensive example demonstrating how to instrument an ASP.NET Core Web API with OpenTelemetry for tracing, metrics, and logging. This setup includes configuring OTLP exporters for traces, metrics, and logs.

```csharp
using OpenTelemetry;
using OpenTelemetry.Exporter;
using OpenTelemetry.Resources;
using OpenTelemetry.Trace;
using OpenTelemetry.Metrics;
using OpenTelemetry.Logs;
using System.Diagnostics;
using System.Diagnostics.Metrics;

var builder = WebApplication.CreateBuilder(args);

// Add instrumentation singleton
builder.Services.AddSingleton<Instrumentation>();

// Configure OpenTelemetry
var serviceName = "dice-api";
var serviceVersion = "1.0.0";

builder.Services.AddOpenTelemetry()
    .ConfigureResource(resource => resource
        .AddService(serviceName, serviceVersion)
        .AddAttributes(new Dictionary<string, object>
        {
            ["deployment.environment"] = builder.Environment.EnvironmentName
        }))
    .WithTracing(tracing => tracing
        .AddSource(serviceName)
        .AddAspNetCoreInstrumentation(options =>
        {
            options.RecordException = true;
        })
        .AddHttpClientInstrumentation()
        .AddOtlpExporter(options =>
        {
            options.Endpoint = new Uri("http://localhost:4318/v1/traces");
            options.Protocol = OtlpExportProtocol.HttpProtobuf;
        }))
    .WithMetrics(metrics => metrics
        .AddMeter(serviceName)
        .AddAspNetCoreInstrumentation()
        .AddHttpClientInstrumentation()
        .AddRuntimeInstrumentation()
        .AddProcessInstrumentation()
        .AddOtlpExporter(options =>
        {
            options.Endpoint = new Uri("http://localhost:4318/v1/metrics");
            options.Protocol = OtlpExportProtocol.HttpProtobuf;
        }));

builder.Logging.AddOpenTelemetry(logging => logging
    .AddOtlpExporter(options =>
    {
        options.Endpoint = new Uri("http://localhost:4318/v1/logs");
        options.Protocol = OtlpExportProtocol.HttpProtobuf;
    }));

var app = builder.Build();

// Simple dice rolling endpoint
app.MapGet("/rolldice/{player?}", (string? player, Instrumentation instrumentation, ILogger<Program> logger) =>
{
    using var activity = instrumentation.ActivitySource.StartActivity("RollDice");

    var roll = Random.Shared.Next(1, 7);

    activity?.SetTag("player.name", player ?? "anonymous");
    activity?.SetTag("dice.value", roll);

    instrumentation.RequestCounter.Add(1,
        new KeyValuePair<string, object?>("endpoint", "/rolldice"),
        new KeyValuePair<string, object?>("player", player ?? "anonymous"));

    logger.LogInformation("Player {Player} rolled a {Roll}", player ?? "anonymous", roll);

    return Results.Ok(new { player = player ?? "anonymous", roll });
});

app.Run();

// Instrumentation class
public class Instrumentation : IDisposable
{
    internal const string ActivitySourceName = "dice-api";
    internal const string MeterName = "dice-api";

    public Instrumentation()
    {
        ActivitySource = new ActivitySource(ActivitySourceName);
        Meter = new Meter(MeterName);

        RequestCounter = Meter.CreateCounter<long>(
            "dice.rolls",
            unit: "{roll}",
            description: "Number of dice rolls");
    }

    public ActivitySource ActivitySource { get; }
    public Meter Meter { get; }
    public Counter<long> RequestCounter { get; }

    public void Dispose()
    {
        ActivitySource.Dispose();
        Meter.Dispose();
    }
}
```

--------------------------------

### Test Netskope Time-Range Query

Source: https://docs.edgedelta.com/http-pull-netskope

This example demonstrates how to query application events within a specific time range (last 5 minutes) using start and end time parameters.

```shell
START_TIME=$(($(date +%s) - 300))
END_TIME=$(date +%s)

curl -X GET "https://YOUR_TENANT.goskope.com/api/v2/events/data/application?starttime=${START_TIME}&endtime=${END_TIME}&limit=10" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Accept: application/json" | jq '.'
```

--------------------------------

### Install Windows Core Components

Source: https://docs.edgedelta.com/zero-code-instrument-dotnet-otel

Run this command after importing the module to install the core instrumentation components. The default installation path is $env:ProgramFiles\OpenTelemetry .NET AutoInstrumentation\.

```powershell
Install-OpenTelemetryCore
```

--------------------------------

### Enable and Start NTP Service

Source: https://docs.edgedelta.com/troubleshoot-apache-kudu

Enable the Network Time Protocol (NTP) service to start on boot and start it immediately to ensure time synchronization.

```bash
sudo systemctl enable ntp
sudo systemctl start ntp

```

--------------------------------

### Enterprise Deployment Example for High Throughput

Source: https://docs.edgedelta.com/syslog-input-node

A high-performance configuration for large-scale enterprise deployments using async UDP. This setup maximizes throughput and includes options for adding OpenTelemetry semantic conventions.

```yaml
nodes:
  - name: datacenter_syslog
    type: syslog_input
    protocol: rfc5424
    transport_protocol: udp
    port: 514
    udp_async:
      readers: 8
      processors_count: 8
      max_queue_length: 5000
    add_attributes: true
    location: UTC
```

--------------------------------

### Install edctl CLI

Source: https://docs.edgedelta.com/create-secrets-cli

Installs the latest version of the edctl CLI tool. The script detects your platform and installs the binary to `/usr/local/bin/edctl`.

```bash
curl -sSfL https://release.edgedelta.com/tools/edctl/install.sh | bash
```

--------------------------------

### Install Application Dependencies

Source: https://docs.edgedelta.com/zero-code-instrument-python-otel

Install specific library dependencies for your Python application before running the OpenTelemetry bootstrap command. This example shows installing Flask and requests.

```bash
pip install flask requests
```

--------------------------------

### Complete Configuration Example (Single Command)

Source: https://docs.edgedelta.com/zero-code-instrument-nodejs-otel

Run your Node.js application with comprehensive OpenTelemetry configuration set via environment variables in a single command.

```bash
env OTEL_SERVICE_NAME="my-nodejs-service" \
    OTEL_EXPORTER_OTLP_ENDPOINT="http://localhost:4318" \
    OTEL_EXPORTER_OTLP_PROTOCOL="http/protobuf" \
    OTEL_TRACES_EXPORTER="otlp" \
    OTEL_METRICS_EXPORTER="otlp" \
    OTEL_LOG_LEVEL="info" \
    OTEL_RESOURCE_ATTRIBUTES="service.version=1.0.0,deployment.environment=production" \
    OTEL_NODE_RESOURCE_DETECTORS="env,host,os,process" \
    node --require @opentelemetry/auto-instrumentations-node/register app.js
```

--------------------------------

### Sample Nginx GET Request Log

Source: https://docs.edgedelta.com/nginx-pack

An example of a standard Nginx access log entry for a GET request.

```log
127.0.0.1 - - [17/Sep/2024:01:45:33 +0000] "GET /index.html HTTP/1.1" 200 1024 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36"

```

--------------------------------

### Build from Source

Source: https://docs.edgedelta.com/zero-code-instrument-golang-otel

Clone the repository, navigate into the directory, and run the make build command to compile the instrumentation binary. The executable will be located at ./otel-go-instrumentation.

```bash
# Clone the repository
git clone https://github.com/open-telemetry/opentelemetry-go-instrumentation.git
cd opentelemetry-go-instrumentation

# Build the instrumentation
make build

# The binary will be at ./otel-go-instrumentation

```

--------------------------------

### Download and Install Pre-built Binary

Source: https://docs.edgedelta.com/zero-code-instrument-golang-otel

Download the latest release for Linux AMD64, make it executable, and optionally move it to your system path. For ARM64, use the corresponding binary.

```bash
# Download the latest release
wget https://github.com/open-telemetry/opentelemetry-go-instrumentation/releases/latest/download/otel-go-instrumentation-linux-amd64

# Make it executable
chmod +x otel-go-instrumentation-linux-amd64

# Optionally move to system path
sudo mv otel-go-instrumentation-linux-amd64 /usr/local/bin/otel-go-instrumentation

```

--------------------------------

### VictoriaMetrics Kubernetes Service Example Output

Source: https://docs.edgedelta.com/prepare-output-to-victoriametrics

Example output from `kubectl get svc` showing a VictoriaMetrics LoadBalancer service. The EXTERNAL-IP is used to construct the endpoint.

```text
NAME                               TYPE           CLUSTER-IP     EXTERNAL-IP      PORT(S)
vm-victoria-metrics-single-server  LoadBalancer   10.96.0.100    35.233.74.200    8428:32563/TCP
```

--------------------------------

### Example Static Query Parameters

Source: https://docs.edgedelta.com/http-pull-connector

Demonstrates key-value pairs for static query parameters.

```text
format: json
limit: 100
page: 1
include_metadata: true
```

--------------------------------

### Install OpenTelemetry Python Packages

Source: https://docs.edgedelta.com/zero-code-instrument-python-otel

Install the OpenTelemetry distribution and OTLP exporter for Python applications. The distro package simplifies setup, and the OTLP exporter sends data to a backend.

```bash
pip install opentelemetry-distro opentelemetry-exporter-otlp
```

--------------------------------

### Configure Start Script in package.json

Source: https://docs.edgedelta.com/instrument-nodejs-otel

Define 'start' and 'dev' scripts in package.json to easily run the application with OpenTelemetry instrumentation loaded.

```json
{
  "scripts": {
    "start": "node --import ./instrumentation.mjs app.js",
    "dev": "npx tsx --import ./instrumentation.ts app.ts"
  }
}

```

--------------------------------

### Use SDK in Application Initialization

Source: https://docs.edgedelta.com/instrument-golang-otel

Demonstrates how to set up the OpenTelemetry SDK in the main application function. It ensures proper initialization and handles the shutdown process to flush all telemetry data.

```go
func main() {
    ctx := context.Background()

    // Set up OpenTelemetry
    otelShutdown, err := setupOTelSDK(ctx)
    if err != nil {
        log.Fatal(err)
    }

    // Handle shutdown properly to ensure all telemetry is flushed
    defer func() {
        if err := otelShutdown(context.Background()); err != nil {
            log.Fatal(err)
        }
    }()

    // Your application code here
    // The SDK is now configured and ready to use
}
```

--------------------------------

### Install Edge Delta with Proxy (Windows PowerShell)

Source: https://docs.edgedelta.com/proxy-configuration

Add proxy properties directly to the MSI installation command using PowerShell. This method configures the agent during the initial setup.

```powershell
# Download and install with proxy settings
Invoke-WebRequest https://release.edgedelta.com/release/edgedelta-64-bit.msi -o edgedelta-64-bit.msi
msiexec /qn /i edgedelta-64-bit.msi \
  APIKEY="<your-pipeline-id>" \
  HTTP_PROXY="http://proxy.example.com:8080" \
  HTTPS_PROXY="http://proxy.example.com:8080" \
  NO_PROXY="localhost,127.0.0.1"
```

--------------------------------

### Buffer Configuration Example

Source: https://docs.edgedelta.com/buffer-configuration

This is an example of the YAML configuration for buffer settings generated by the wizard. Ensure the buffer path is on persistent storage.

```yaml
output_buffer:
  path: /var/lib/edgedelta/outputbuffer
  max_size: 2GB
  drain_strategy: throttled
  strict_ordering: false
```

--------------------------------

### Start Minikube with Docker Driver

Source: https://docs.edgedelta.com/ingest-kubernetes-metrics

Use this command to start a Minikube instance with the Docker driver, which is recommended for local testing of eBPF features.

```bash
minikube start --driver docker
```

--------------------------------

### Sample Error Log Entry (GET Request)

Source: https://docs.edgedelta.com/eddynamicflowcontrol-pack

This is an example of an error-level log entry for a GET request. It includes timestamp, level, message, user details, request information, and response time.

```json
{"timestamp": "2025-07-01T20:57:20.010Z","level": "ERROR","msg": "Aut ea optio omnis enim.","user": {"id": 3,"name": "Rita Walsh","email": "watsoncarroll@bechtelar.name"},"request": {"method": "GET","path": "/mediumvioletred/porcupine/blackberry","ip": "13.182.66.182"},"response_time_ms": 683}
```

--------------------------------

### Example CREATE TABLE and SELECT from Slow Log

Source: https://docs.edgedelta.com/mysqlslowquery-pack

This snippet illustrates a slow query log entry that includes table creation and subsequent data retrieval. It highlights metadata for both operations.

```sql
# Time: 2024-09-17T17:58:31.649201Z
# User@Host: Hartmann6021[example] @ 180.68.18.209 [26aa:ed3d:4d9d:9f42:45c9:aa7e:dea2:620c] Id: 917215
# Query_time: 54.781643 Lock_time: 0.013071 Rows_sent: 6396691 Rows_examined: 9678866
CREATE TABLE animals (
id MEDIUMINT NOT NULL AUTO_INCREMENT,
name CHAR(30) NOT NULL,
PRIMARY KEY (id)
);
INSERT INTO animals (name) VALUES
('dog'),('cat'),('penguin'),
('lax'),('whale'),('ostrich');
SELECT * FROM animals;

```

--------------------------------

### Sample Debug Log Entry (GET Request)

Source: https://docs.edgedelta.com/eddynamicflowcontrol-pack

This is an example of a debug-level log entry for a GET request. It includes timestamp, level, message, user details, request information, and response time.

```json
{"timestamp": "2025-07-01T20:57:19.010Z","level": "DEBUG","msg": "Nemo aut et ut molestiae.","user": {"id": 67,"name": "Lafayette Rutherford","email": "tannerbreitenberg@hilpert.com"},"request": {"method": "GET","path": "/snow/shark/satsuma","ip": "115.20.202.189"},"response_time_ms": 278}
```

--------------------------------

### Sample Error Log Entry (GET Request)

Source: https://docs.edgedelta.com/eddynamicflowcontrol-pack

This is an example of an error-level log entry for a GET request. It includes timestamp, level, message, user details, request information, and response time.

```json
{"timestamp": "2025-07-01T20:57:19.010Z","level": "ERROR","msg": "Voluptas quasi laboriosam libero voluptatibus.","user": {"id": 51,"name": "Michele Becker","email": "glendazboncak@hoeger.com"},"request": {"method": "GET","path": "/darkorchid/panda/pitaya","ip": "197.27.134.28"},"response_time_ms": 51}
```

--------------------------------

### Complete Configuration Example (Export Statements)

Source: https://docs.edgedelta.com/zero-code-instrument-nodejs-otel

Configure OpenTelemetry by setting environment variables using export statements, then run your Node.js application.

```bash
# Set configuration
export OTEL_SERVICE_NAME="my-nodejs-service"
export OTEL_EXPORTER_OTLP_ENDPOINT="http://localhost:4318"
export OTEL_EXPORTER_OTLP_PROTOCOL="http/protobuf"
export OTEL_TRACES_EXPORTER="otlp"
export OTEL_METRICS_EXPORTER="otlp"
export OTEL_LOG_LEVEL="info"
export OTEL_RESOURCE_ATTRIBUTES="service.version=1.0.0,deployment.environment=production"
export NODE_OPTIONS="--require @opentelemetry/auto-instrumentations-node/register"

# Run application
node app.js
```

--------------------------------

### Sample Debug Log Entry (GET Request)

Source: https://docs.edgedelta.com/eddynamicflowcontrol-pack

This is an example of a debug-level log entry for a GET request. It includes timestamp, level, message, user details, request information, and response time.

```json
{"timestamp": "2025-07-01T20:57:19.010Z","level": "DEBUG","msg": "Dolorem modi nihil commodi et.","user": {"id": 36,"name": "Joey Rippin","email": "emilyschuster@botsford.info"},"request": {"method": "GET","path": "/darkviolet/porcupine/lychee","ip": "158.235.41.204"},"response_time_ms": 887}
```

--------------------------------

### Example Exec Input Configuration

Source: https://docs.edgedelta.com/exec-input-node

This snippet shows a basic configuration for an exec_input node, including a script to generate output and a run interval.

```yaml
nodes:
- name: my_exec_input
  type: exec_input
  script: for i in {1..50}; do echo "Welcome $i times"; done
  command: /bin/sh -c
  run_interval: 10s

```

--------------------------------

### Start edgedelta Process (Upstart)

Source: https://docs.edgedelta.com/troubleshoot-linux

Use this command on Upstart-based systems (RHEL, Amazon Linux) to start the edgedelta process.

```bash
initctl start edgedelta
```

--------------------------------

### Install Automatic Instrumentation for Node.js

Source: https://docs.edgedelta.com/instrument-nodejs-otel

Install the automatic instrumentation package for Node.js to easily instrument common frameworks and libraries without manual code changes. This simplifies the setup process for capturing telemetry data.

```bash
npm install --save @opentelemetry/auto-instrumentations-node
```

--------------------------------

### Initialize Metric Instruments

Source: https://docs.edgedelta.com/instrument-golang-otel

Set up metric instruments like counters and histograms to track application metrics. Ensure error handling during instrument creation.

```Go
import (
    "go.opentelemetry.io/otel"
    "go.opentelemetry.io/otel/metric"
)

var (
    meter = otel.Meter("my-service")
    requestCounter metric.Int64Counter
    requestDuration metric.Float64Histogram
)

func init() {
    var err error

    // Create a counter for request count
    requestCounter, err = meter.Int64Counter(
        "requests.count",
        metric.WithDescription("Number of requests processed"),
        metric.WithUnit("{request}"),
    )
    if err != nil {
        panic(err)
    }

    // Create a histogram for request duration
    requestDuration, err = meter.Float64Histogram(
        "requests.duration",
        metric.WithDescription("Duration of requests"),
        metric.WithUnit("s"),
    )
    if err != nil {
        panic(err)
    }
}
```

--------------------------------

### Example Static Endpoints

Source: https://docs.edgedelta.com/http-pull-connector

Illustrates valid URL formats for the static Endpoint configuration.

```text
https://api.example.com/v1/metrics
http://service.local:8080/health
https://status.service.com/api/v2/status.json
```

--------------------------------

### Get OAuth Token and Start General Subscription

Source: https://docs.edgedelta.com/teams-audit-logs-office-365

This snippet retrieves an OAuth token and then starts the Audit.General subscription to collect Teams audit logs. Ensure you replace placeholders like {TENANT_ID}, {CLIENT_ID}, and {CLIENT_SECRET} with your actual Azure AD application credentials.

```bash
# Get OAuth token
TOKEN=$(curl -X POST "https://login.microsoftonline.com/{TENANT_ID}/oauth2/v2.0/token" \
  -d "client_id={CLIENT_ID}&client_secret={CLIENT_SECRET}&scope=https://manage.office.com/.default&grant_type=client_credentials" \
  | jq -r '.access_token')

# Start General subscription (includes Teams)
curl -X POST "https://manage.office.com/api/v1.0/{TENANT_ID}/activity/feed/subscriptions/start?contentType=Audit.General&PublisherIdentifier={TENANT_ID}" \
  -H "Authorization: Bearer ${TOKEN}"
```

--------------------------------

### Filter Metrics by Name

Source: https://docs.edgedelta.com/reduce-metric-cardinality

Use the filter processor to drop metrics that are not worth the cardinality cost. This example keeps metrics that do not start with 'debug.' or 'internal.'.

```yaml
- name: filter_noisy_metrics
  type: filter
  data_types:
    - metric
  condition: 'not (name matches "debug\..*" or name matches "internal\..*")'
```

--------------------------------

### Input Data Example

Source: https://docs.edgedelta.com/lookup-contain-match

Example of input log data containing a service name with version and environment information.

```json
{
  "body": "{\"timestamp\":\"2026-01-27T10:30:45.123Z\",\"service_name\":\"payment-gateway-v2-prod\",\"request_id\":\"req-12345\",\"message\":\"Request processed successfully\"}",
  "attributes": {
    "service_name": "payment-gateway-v2-prod"
  }
}

```

--------------------------------

### View Upstart Process Configuration

Source: https://docs.edgedelta.com/troubleshoot-linux

Use 'less' to view the Edge Delta process configuration file on Upstart-based systems like RHEL and Amazon Linux.

```bash
less /etc/init/edgedelta.conf
```

--------------------------------

### Generate and Run Edge Delta Agent Installation Command

Source: https://docs.edgedelta.com/quick-start-vm-bare-metal

This command downloads, installs, and starts the Edge Delta agent on a Linux VM or bare metal host. Use sudo for broader source detection. Environment variables can be set via /etc/sysconfig/edgedelta for systemd services.

```bash
curl -s "https://packages.edgedelta.com/install.sh" | sudo bash -s -- --pipeline-id=<pipeline-id> --node-id=<node-id>
```

--------------------------------

### Successful Configuration Loading Message

Source: https://docs.edgedelta.com/proxy-configuration

An example log message indicating that the Edge Delta agent has successfully loaded its configuration and is operational. This is a positive sign after proxy setup.

```text
INFO    agent/agent_v1.go:850    Configuration loaded and running

```

--------------------------------

### Example Executable Commands

Source: https://docs.edgedelta.com/exec-connector

Examples of commands that can be executed by the connector. Use '/bin/bash -c' for shell commands, or specify the direct path to scripts like Python or psql.

```bash
/bin/bash -c
```

```bash
/usr/bin/python3 /opt/scripts/health_check.py
```

```bash
/usr/bin/psql -h localhost -U postgres -c "SELECT count(*) FROM users"
```

--------------------------------

### Iterator Endpoint Parameter Expression

Source: https://docs.edgedelta.com/http-pull-netskope

Example of a parameter expression for an iterator-based endpoint, calculating a start time 30 seconds prior to the current Unix epoch time.

```Netskope API
parameter_expressions:
  - name: operation
    value_expression: String(Int(UnixSeconds(Now()) - 30))
```

--------------------------------

### Protocol Configuration Example

Source: https://docs.edgedelta.com/otlp-output-node

Example of setting the 'protocol' parameter to 'http' for an OTLP output node. TLS must be enabled for HTTPS endpoints.

```yaml
nodes:
  - name: <node name>
    type: otlp_output
    endpoint: <OTLP server URI>
    port: <port number>
    protocol: http

```

--------------------------------

### Example Static Headers

Source: https://docs.edgedelta.com/http-pull-connector

Shows common key-value pairs for static HTTP headers.

```text
Authorization: Bearer YOUR_API_TOKEN
X-API-Key: your-api-key-here
Accept: application/json
Content-Type: application/json
```

--------------------------------

### Output Transform Node Configuration Example

Source: https://docs.edgedelta.com/output-transform-node

This example demonstrates applying multiple transformations in sequence: upserting fields, adding a new field, and deleting existing fields.

```yaml
nodes:
  - name: output_transform_example
    type: 
    transformations:
      - field_path: message
        operation: upsert
        value: json(item["body"]).msg
      - field_path: tag
        operation: upsert
        value: item["resource"]["ed.tag"]
      - field_path: new_field
        operation: upsert
        value: item["resource"]["nonexistent_field"]
      - field_path: resource
        operation: delete
      - field_path: body
        operation: delete

```

--------------------------------

### Extract Substring using Substring Converter

Source: https://docs.edgedelta.com/converter-substring

Use the Substring converter to extract a specific number of characters from a string, starting at a given position. This example extracts the opcode value from a JSON string.

```json
{
	"_type": "log",
	"timestamp": 1735871592016,
	"body": "{\"opcode\": 2, \"timestamp\": 1735871157, \"qname\": \"00:1a:2b:28:45:35:3f\", \"qtype\": \"A\", \"qclass\": \"IN\", \"source\": \"mirror\", \"qip\": \"185.237.49.209\", \"qport\": 53, \"rip\": \"158.24.224.230\", \"rport\": 53, \"protocol\": \"udp\", \"delay\": \"591\", \"rcode\": \"3\", \"type\": \"2\", \"qqr\": true, \"qaa\": true, \"qtc\": false, \"qrd\": true, \"qra\": false, \"qad\": true, \"qcd\": false, \"qdo\": true, \"rqr\": true, \"raa\": false, \"rtc\": true, \"rrd\": false, \"rra\": true, \"rad\": false, \"rcd\": false, \"rdo\": true, \"rrr1\": false, \"rrr2\": false, \"rrr3\": true, \"view\": \"admin\", \"anonymized\": true, \"nanosec\": 1735871157253000000, \"pid\": 60389, \"cid\": \"77\", \"tid\": 1}",
	"resource": {...},
	"attributes": {
		"decoded_body": "{\"opcode\": 2, \"timestamp\": 1735871157, \"qname\": \"00:1a:2b:28:45:35:3f\", \"qtype\": \"A\", \"qclass\": \"IN\", \"source\": \"mirror\", \"qip\": \"185.237.49.209\", \"qport\": 53, \"rip\": \"158.24.224.230\", \"rport\": 53, \"protocol\": \"udp\", \"delay\": \"591\", \"rcode\": \"3\", \"type\": \"2\", \"qqr\": true, \"qaa\": true, \"qtc\": false, \"qrd\": true, \"qra\": false, \"qad\": true, \"qcd\": false, \"qdo\": true, \"rqr\": true, \"raa\": false, \"rtc\": true, \"rrd\": false, \"rra\": true, \"rad\": false, \"rcd\": false, \"rdo\": true, \"rrr1\": false, \"rrr2\": false, \"rrr3\": true, \"view\": \"admin\", \"anonymized\": true, \"nanosec\": 1735871157253000000, \"pid\": 60389, \"cid\": \"77\", \"tid\": 1}"
	}
}
```

```ottl
set(attributes["opcode"], Substring(attributes["decoded_body"], 11, 1))
```

```json
{
	"_type": "log",
	"timestamp": 1735871555160,
	"body": "{\"opcode\": 2, \"timestamp\": 1735871157, \"qname\": \"00:1a:2b:28:45:35:3f\", \"qtype\": \"A\", \"qclass\": \"IN\", \"source\": \"mirror\", \"qip\": \"185.237.49.209\", \"qport\": 53, \"rip\": \"158.24.224.230\", \"rport\": 53, \"protocol\": \"udp\", \"delay\": \"591\", \"rcode\": \"3\", \"type\": \"2\", \"qqr\": true, \"qaa\": true, \"qtc\": false, \"qrd\": true, \"qra\": false, \"qad\": true, \"qcd\": false, \"qdo\": true, \"rqr\": true, \"raa\": false, \"rtc\": true, \"rrd\": false, \"rra\": true, \"rad\": false, \"rcd\": false, \"rdo\": true, \"rrr1\": false, \"rrr2\": false, \"rrr3\": true, \"view\": \"admin\", \"anonymized\": true, \"nanosec\": 1735871157253000000, \"pid\": 60389, \"cid\": \"77\", \"tid\": 1}",
	"resource": {...},
	"attributes": {
		"decoded_body": "{\"opcode\": 2, \"timestamp\": 1735871157, \"qname\": \"00:1a:2b:28:45:35:3f\", \"qtype\": \"A\", \"qclass\": \"IN\", \"source\": \"mirror\", \"qip\": \"185.237.49.209\", \"qport\": 53, \"rip\": \"158.24.224.230\", \"rport\": 53, \"protocol\": \"udp\", \"delay\": \"591\", \"rcode\": \"3\", \"type\": \"2\", \"qqr\": true, \"qaa\": true, \"qtc\": false, \"qrd\": true, \"qra\": false, \"qad\": true, \"qcd\": false, \"qdo\": true, \"rqr\": true, \"raa\": false, \"rtc\": true, \"rrd\": false, \"rra\": true, \"rad\": false, \"rcd\": false, \"rdo\": true, \"rrr1\": false, \"rrr2\": false, \"rrr3\": true, \"view\": \"admin\", \"anonymized\": true, \"nanosec\": 1735871157253000000, \"pid\": 60389, \"cid\": \"77\", \"tid\": 1}",
		"opcode": "2"
	}
}
```

--------------------------------

### Example System Statistics Configuration

Source: https://docs.edgedelta.com/system-statistics-node

This snippet shows a basic configuration for the system statistics input and metrics output nodes, including their link.

```yaml
nodes:
  - name: ed_system_stats
    type: ed_system_stats_input
  - name: ed_metrics
    type: ed_metrics_output

  links:
  - from: ed_system_stats
    to: ed_metrics

```

--------------------------------

### Fluentd Host and Port Configuration

Source: https://docs.edgedelta.com/fluentd-output-node

Example demonstrating the required 'host' and 'port' parameters for TCP traffic.

```yaml
nodes:
  - name: <node name>
    type: fluentd_output
    host: log-repo-host
    port: 23131

```

--------------------------------

### Get Diagnostic Settings for an Azure Resource

Source: https://docs.edgedelta.com/event-hub-source-node-azure-streaming-setup

Retrieves the diagnostic settings configured for a specific Azure resource, useful for verifying Event Hub streaming setup. Replace placeholders with your actual resource details.

```PowerShell
# Get diagnostic settings for a resource
$resourceId = "/subscriptions/{subscription-id}/resourceGroups/{resource-group}/providers/Microsoft.Web/sites/{app-service-name}"

Get-AzDiagnosticSetting -ResourceId $resourceId

# Expected output: List of diagnostic settings with EventHub configuration

```

--------------------------------

### Complete Multiline Syslog Input Example

Source: https://docs.edgedelta.com/syslog-input-configuration-reference

A comprehensive configuration for a multiline syslog input, including TCP transport, RFC 5424 protocol, a specific line start pattern for timestamps, and an increased maximum log size.

```yaml
nodes:
  - name: app_logs_multiline
    type: syslog_input
    protocol: rfc5424
    transport_protocol: tcp
    port: 6514
    multiline:
      line_start_pattern: '^<\d+>1 \d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}'
      omit_pattern: false
    max_log_size: 10MiB
```

--------------------------------

### Time-Range Endpoint Parameter Expressions

Source: https://docs.edgedelta.com/http-pull-netskope

Example parameter expressions for a time-range endpoint, defining a start time 62 seconds prior to the current Unix epoch time and an end time at the current Unix epoch time.

```Netskope API
parameter_expressions:
  - name: starttime
    value_expression: String(Int(UnixSeconds(Now() - Duration("62s"))))
  - name: endtime
    value_expression: String(Int(UnixSeconds(Now())))
```

--------------------------------

### Example Log Input

Source: https://docs.edgedelta.com/log-to-pattern-node

A sample log entry in Apache common log format.

```text
7.153.29.75 - - [22/Jul/2025:05:03:33 +0000] "GET /log/home HTTP/1.1" 200 3999

```

--------------------------------

### Filter JSON Keys with Regex

Source: https://docs.edgedelta.com/editor-keep_matching_keys

This example shows how to use keep_matching_keys to filter a JSON log entry. It retains only the keys within the 'attributes.parsed_body' object that start with 'event'. This is useful for cleaning up log data and focusing on relevant event information.

```json
{
	"_type": "log",
	"attributes": {
		"parsed_body": {
			"awsRegion": "us-west-2",
			"eventCategory": "Management",
			"eventID": "mnop5678-abcd-1234-efgh-5678ijklqrst",
			"eventName": "ListStacks",
			"eventSource": "ec2.amazonaws.com",
			"eventTime": "2024-12-05T05:10:57.227003Z",
			"eventType": "AwsApiCall",
			"eventVersion": "1.08",
			"managementEvent": "true",
			"readOnly": "true",
			"recipientAccountId": 123456789012,
			"requestID": "abcd1234-efgh-5678-ijkl-9012mnopqrst",
			"resources.0": {
				"ARN": "arn:aws:iam::123456789012:role/aws-controltower-ForwardSnsNotificationRole",
				"accountId": 123456789012,
				"type": "AWS::IAM::Role"
			},
			"responseElements.assumedRoleUser.arn": "arn:aws:iam::123456789012:role/ABCDEFGHIJKLM123456789/AWSConfig-BucketConfigCheck",
			"responseElements.assumedRoleUser.assumedRoleId": "A1B2C3D4E5F6G7H8I9J0:AWSConfig-BucketConfigCheck",
			"responseElements.credentials.accessKeyId": "A1B2C3D4E5F6G7H8I9J0",
			"responseElements.credentials.expiration": "2024-12-05T05:10:57.227053Z",
			"responseElements.credentials.sessionToken": "123456789876",
			"sharedEventID": "01234567-89ab-cdef-edcb-a9876543210f",
			"sourceIPAddress": "211.46.216.146",
			"userAgent": "ec2.amazonaws.com",
			"userIdentity.invokedBy": "lambda.amazonaws.com",
			"userIdentity.type": "AssumedRole"
		}
	},
	"body": "{\"eventVersion\": \"1.08\", \"userIdentity\": {\"type\": \"AssumedRole\", \"invokedBy\": \"lambda.amazonaws.com\"}, \"eventTime\": \"2024-12-05T05:10:57.227003Z\", \"eventSource\": \"ec2.amazonaws.com\", \"eventName\": \"ListStacks\", \"awsRegion\": \"us-west-2\", \"sourceIPAddress\": \"211.46.216.146\", \"userAgent\": \"ec2.amazonaws.com\", \"requestParameters\": {}, \"responseElements\": {\"credentials\": {\"accessKeyId\": \"A1B2C3D4E5F6G7H8I9J0\", \"expiration\": \"2024-12-05T05:10:57.227053Z\", \"sessionToken\": \"123456789876\"}, \"assumedRoleUser\": {\"assumedRoleId\": \"A1B2C3D4E5F6G7H8I9J0:AWSConfig-BucketConfigCheck\", \"arn\": \"arn:aws:iam::123456789012:role/ABCDEFGHIJKLM123456789/AWSConfig-BucketConfigCheck\"}}, \"requestID\": \"abcd1234-efgh-5678-ijkl-9012mnopqrst\", \"eventID\": \"mnop5678-abcd-1234-efgh-5678ijklqrst\", \"readOnly\": \"true\", \"resources\": [{\"accountId\": 123456789012, \"type\": \"AWS::IAM::Role\", \"ARN\": \"arn:aws:iam::123456789012:role/aws-controltower-ForwardSnsNotificationRole\"}], \"eventType\": \"AwsApiCall\", \"managementEvent\": \"true\", \"recipientAccountId\": 123456789012, \"sharedEventID\": \"01234567-89ab-cdef-edcb-a9876543210f\", \"eventCategory\": \"Management\"}",
	"resource": {},
	"timestamp": 1733378455697
}
```

```statement
keep_matching_keys(attributes["parsed_body"], "^event.*")
```

```json
{
	"_type": "log",
	"attributes": {
		"parsed_body": {
			"eventCategory": "Management",
			"eventID": "mnop5678-abcd-1234-efgh-5678ijklqrst",
			"eventName": "ListStacks",
			"eventSource": "ec2.amazonaws.com",
			"eventTime": "2024-12-05T05:10:57.227003Z",
			"eventType": "AwsApiCall",
			"eventVersion": "1.08"
		}
	},
	"body": "{\"eventVersion\": \"1.08\", \"userIdentity\": {\"type\": \"AssumedRole\", \"invokedBy\": \"lambda.amazonaws.com\"}, \"eventTime\": \"2024-12-05T05:10:57.227003Z\", \"eventSource\": \"ec2.amazonaws.com\", \"eventName\": \"ListStacks\", \"awsRegion\": \"us-west-2\", \"sourceIPAddress\": \"211.46.216.146\", \"userAgent\": \"ec2.amazonaws.com\", \"requestParameters\": {}, \"responseElements\": {\"credentials\": {\"accessKeyId\": \"A1B2C3D4E5F6G7H8I9J0\", \"expiration\": \"2024-12-05T05:10:57.227053Z\", \"sessionToken\": \"123456789876\"}, \"assumedRoleUser\": {\"assumedRoleId\": \"A1B2C3D4E5F6G7H8I9J0:AWSConfig-BucketConfigCheck\", \"arn\": \"arn:aws:iam::123456789012:role/ABCDEFGHIJKLM123456789/AWSConfig-BucketConfigCheck\"}}, \"requestID\": \"abcd1234-efgh-5678-ijkl-9012mnopqrst\", \"eventID\": \"mnop5678-abcd-1234-efgh-5678ijklqrst\", \"readOnly\": \"true\", \"resources\": [{\"accountId\": 123456789012, \"type\": \"AWS::IAM::Role\", \"ARN\": \"arn:aws:iam::123456789012:role/aws-controltower-ForwardSnsNotificationRole\"}], \"eventType\": \"AwsApiCall\", \"managementEvent\": \"true\", \"recipientAccountId\": 123456789012, \"sharedEventID\": \"01234567-89ab-cdef-edcb-a9876543210f\", \"eventCategory\": \"Management\"}",
	"resource": {},
	"timestamp": 1733378478884
}
```
Tokens:
Raw