Skip to main content

Configuration

The Configuration page (titled Configurations on screen) is a live diagram of the data pipeline. It shows every source, router, and sink in the account, the processor pipes inside each router, the connections between them, and their current activity and health.

Menu path: Platform → Configuration · URL path: /platform/configuration

Configurations page showing the pipeline diagram with source, router, and sink columns connected by flow lines

Page Layout​

Under the page title and the subtitle The configuration and status of the platform., the diagram is arranged in three columns, read left to right in the direction data flows:

  • Sources (left) — where data enters the pipeline.
  • Routers (middle) — where processor pipes transform and route events.
  • Sinks (right) — where processed data is delivered.

Each column ends with a dashed Add button for creating a new node of that type. A round double-chevron button floats in the lower-right corner of the page; it opens the status panel.

Node Status​

A card's outline and the icons above it report its current state, so the health of the whole pipeline is readable at a glance:

  • Green outline — actively moving data. The card can also carry a small green throughput graph above its upper-right corner, plotting its recent volume.
  • Gray outline — idle. No throughput graph.
  • Red outline — in error. A red exclamation mark (!) appears above the card, and the connection lines leaving it are drawn in red.

A separate plug-with-slash icon may appear beside the type icon above a card, marking a node whose connection is disabled. It is independent of the error mark: a card can carry the plug-with-slash icon while still running green, and an errored card does not necessarily carry it.

Sources​

Each source card shows the source name and a label for the transport that feeds it, with a type icon above the card: the vendor's own mark for a plugin source, so each integration's sources are distinguishable at a glance; a stacked-layers icon for a management queue; and a server icon for cloud syslog. The example has sources of three types:

  • Plugin Data Source — data pulled by an installed application (here AzureAuditEventHub-default, the source of an Azure Directory Audit (Event Hub) application).
  • Mgmt Queue — internal management queues (here the BehaviorSummary feed and FluencyCollector-default, the default collector's queue).
  • Cloud Syslog — a cloud syslog endpoint (SyslogEndpoint).

Click Add Source + at the bottom of the column to add a new source.

Routers​

Each router card lists the pipes it runs. A pipe row shows the pipe name and its processor count, for example (1 procs). The example has three routers: AzureAuditEventHub-default, with a transform pipe and a default pipe for the event hub source; NotificationExport, with BehaviorSummary_Filter and BehaviorSummary_Email pipes; and SyslogRouter, with Timestamp_Adjustment and Syslog_Passthrough pipes fed by the collector queue and the cloud syslog endpoint. Long pipe names are truncated with an ellipsis.

Click Add Router + at the bottom of the column to add a new router.

Sinks​

Each sink card shows the sink name and its type label, with a type icon above the card. Two sink types appear in the example:

  • Data Lake — delivery into a data lake index, marked with a database icon (here five Entra ID indexes, from AADManagedIdentitySignInLogs to AzureSigninLogs).
  • Mgmt Queue — delivery into an internal queue, marked with a stacked-layers icon. These are the EventWatch sinks: one general EventWatch sink plus per-feed sinks named EventWatch: followed by the feed, such as EventWatch: CorrelationService.

Click Add Sink + at the bottom of the column to add a new sink.

Connections​

Small circular ports sit on the edges of each card. Colored lines run from a source's output port to a router's input port, and from each router pipe's output port to a sink, tracing the exact path events take through the platform. Line colors distinguish the individual flows where several cross, and a line leaving an errored source is drawn in red.

Some connections are drawn as dashed lines. In the example, dashed lines run from the AzureAuditEventHub transform pipe to three of the sign-in log indexes its processor writes to, while the router's default pipe delivers to its EventWatch sink over a solid line.

Status Panel​

The round double-chevron button in the lower-right corner opens a Home panel over the right-hand side of the page, holding a Status section with three time-series charts of the platform's overall throughput. Each chart shows its title, the unit Bytes (B), and the total for the window on the right.

Home status panel over the Configurations page, showing Ingress, Egress, and Drop charts

  • Ingress — bytes entering the platform.
  • Egress — bytes leaving it.
  • Drop — bytes discarded.

Click the X in the panel's blue header bar to close it and return to the diagram.