Skip to content
CosmoTrace
Menu

Platform · CosmoStream

Route by what the data is worth, not by how much of it there is.

Every event arrives with its class and hierarchy already attached by CosmoEdge. CosmoStream applies one signed policy per class, assigns the coordinate, and sends the event where that class belongs. Noise stops paying the same fare as evidence.

Routing

One policy per class

CosmoStream: one signed policy per class decides where each event goes Events of three classes arrive from many agents. A signed policy sends evidence to hot storage and the lake, search data to the lake with an index, and economy data straight to cold object storage. A copy can go to existing tools. Each event receives a coordinate at the gate. Animated; static when reduced motion is requested. FROM EVERY CosmoEdge evidence · auth, sudo, exec, 5xx search · request logs, metrics economy · debug, raw traces CosmoStream policy · signed stream_id + epoch + seq seq 8,214,907 seq 8,214,908 seq 8,214,909 hot + CosmoLakeevidence · milliseconds to query CosmoLake + indexsearch · your bucket cold object storageeconomy · hot tier skipped existing toolsa copy, if you want one measured: 400 GB/day ingest per vCPU · evidence is never sampled
Three classes arrive; one signed policy sends each where it belongs and stamps a coordinate. Existing tools can receive a copy. Static if your system asks for reduced motion.

Classes

Three, and defaults that ship

Evidence
Authentication, privilege, process execution, service errors, failed spans. Hot and in the lake. Never sampled. Minutes from node to query.
Search
Request logs, metrics, ordinary application output you will grep later. In the lake with an index. Sampled only under a budget you set, and reported when it is.
Economy
Verbose debug, high-volume traces, chatter. Written cold to your object storage directly; the hot tier is skipped. Kept, queryable, cheap.

Policies are signed. The default set ships with the stream; your platform team edits and re-signs per environment. A node cannot be told to route around a policy by anything on the node, and an unsigned policy is refused and reported.

policy "auth-and-privilege" v3     signed: platform-team
  match:   source in [sshd, sudo, exec, auth]
  class:   evidence
  route:   hot + lake
  mask:    user.ip, session.token
  sample:  never

Default routes

Route by usefulness. Stop paying for raw.

These are the policies that ship. Each row is a signed policy your platform team can edit and re-sign per environment. None of them is a hard-coded rule.

| Class | Examples | Default route | | --- | --- | --- | | Audit and security | ssh, sudo, exec, auth | Hot + archive + stream plane | | Service errors | 5xx logs, failed spans | Hot + object store | | Normal debug | Verbose application logs | Sample + cold lake | | Metrics | Node and service KPIs | Rollups + dashboards | | Raw traces | High-volume spans | Tail sample + cold lake |

Limits

Measured ceilings

400GB/day
Ingest per vCPU

Classify, coordinate and route.

ms
Node to hot query

For evidence class, within one region.

1coordinate
Per event, for life

stream_id + epoch + seq.

First-party measurement on a fixed event shape. Replayed on your data during a design-partner run before any number is quoted for your estate.

Where does the data land?

On storage you own, in open formats. The lake page explains hot, cold and how you leave.

Read the lake pageRequest a demo