Skip to main content

Targets: Management

The Targets web interface provides comprehensive management for output destinations where processed telemetry data is forwarded.

Access​

Navigate to Home > Fleet Management > Targets, or use the hamburger menu and select Fleet Management > Targets.

Overview​

The Targets page is where you manage all output destinations for DataStream. Targets are data senders that forward processed telemetry to external systems and convert from standardized pipeline output to destination-specific formats.

The Targets page presents a persistent left sidebar listing all target types in expandable category accordions, in this order: Microsoft Azure, Amazon Web Services (AWS), Google Cloud (GCP), IBM Cloud, Analytics, SIEM, Cloud storage, Message queues, and Other. Each target type entry shows its name and a count of configured instances.

Above the accordion:

  • A Show configured targets only toggle hides target types with no configured instances
  • A search field with the placeholder Search target types filters the sidebar by name; an empty result shows "No configured targets found"

Selecting a target type in the sidebar opens that type's list table in the main panel.

List View​

The list view shows all instances of the selected target type.

Table​

The table displays Name, Description, Post-processing pipeline, Log stream, Connection status, and Status (Enabled/Disabled) for each target, with an Actions menu (⋮) on each row.

Table Controls​

Filter targets using the search field — its placeholder names the selected type (for example, "Search Elasticsearch targets") — and the Status dropdown (All, Enabled, Disabled). Click Add new target to launch the creation wizard.

Actions​

Each target row provides an Actions menu (⋮) with the following operations:

View and Edit:

  • Manage target - Navigate to target detail view

Status Management:

  • Enable target / Disable target - Toggle target status (shown according to current status)

Configuration:

  • Clone target - Duplicate target configuration for quick setup

Deletion:

  • Delete target - Remove target from platform

Creation Wizard​

The target creation process uses a multi-step wizard with target-specific configuration.

Target wizards have different numbers of steps depending on the target type. Each step is labeled with its specific name rather than a generic step number. All wizards begin with General Settings and end with Execution Settings; the intermediate steps vary by target.

General Settings​

Applies to: All targets

  • Target name - Unique target identifier
  • Target Status - Enable or disable target
  • Post-processing pipeline (Optional) - Pipeline for output normalization

Azure Settings​

Applies to: AzureBlobStorage, AzureDataExplorer, AzureEventHubs, AzureMonitorLogs, AzureServiceBus, MicrosoftSentinel, MicrosoftSentinelDataLake

Azure-specific configuration including authentication and resource identification:

  • Authentication - Managed Identities, Service Principal, or Connection String. AzureServiceBus has no Managed Identities toggle; its Authentication method dropdown offers Connection string, Service principal, Managed identity (user-assigned), and Managed identity (system-assigned) or workload identity
  • Tenant ID / Client ID / Client Secret - Service Principal credentials
  • Workspace/Subscription - Azure resource identification
  • Resource Group - Azure resource grouping
  • Container / Database / Namespace - Target-specific resource names

Azure Service Configuration​

Applies to: AzureBlobStorage, AzureDataExplorer, AzureEventHubs, AzureMonitorLogs, AzureServiceBus, MicrosoftSentinel, MicrosoftSentinelDataLake

Target-specific Azure configuration following the Azure settings step. The step name and fields vary by target:

  • Stream settings (AzureMonitorLogs, MicrosoftSentinel, MicrosoftSentinelDataLake) — Stream name, table name, DCR rule ID, DCE endpoint
  • Storage settings (AzureBlobStorage, AzureDataExplorer) — Container, database, storage configuration
  • Message settings (AzureServiceBus) — Queue/topic name, message configuration
  • Advanced settings (AzureEventHubs) — Max retry, retry interval, timeout, batch configuration

Authentication​

Applies to: AmazonOpenSearch, Elasticsearch, ElasticSecurity, GoogleChronicle, GoogleSecOps, Splunk, SplunkSecurity

Authentication credentials and endpoint configuration:

  • Endpoints - Destination URLs or addresses
  • Authentication Type - Token, secret, or basic authentication
  • Username / Password - Basic authentication credentials (Elasticsearch, ElasticSecurity, AmazonOpenSearch)
  • Token / Secret - Token-based authentication (Splunk, SplunkSecurity)
  • TLS Configuration - Certificate and encryption settings

Target Properties​

Applies to: AmazonOpenSearch, Elasticsearch, ElasticSecurity, GoogleChronicle, GoogleSecOps, Splunk, SplunkSecurity

Target-specific configuration following the endpoint step, which is Endpoints on AmazonOpenSearch, Splunk and SplunkSecurity and Connection settings on Elasticsearch and ElasticSecurity. The step name and fields vary by target:

  • Splunk settings (Splunk) and Splunk ES settings (SplunkSecurity) — Index, Source Type, Batch Size, Timeout, TCP Routing, Compression, TLS skip verify, Field Format
  • Elasticsearch settings (Elasticsearch) — Index name, document type, ingest pipeline, bulk configuration
  • Elastic Security settings (ElasticSecurity) — Index name, document type, ingest pipeline, bulk configuration
  • OpenSearch settings (AmazonOpenSearch) — Index name, document type, ingest pipeline, bulk configuration
  • Google Chronicle settings (GoogleChronicle) — Chronicle-specific settings, followed by a Log and batch settings step
  • Google SecOps settings (GoogleSecOps) — SecOps-specific settings, followed by a Log and batch settings step

Connection, Event and TLS Settings​

Applies to: SplunkS2s

The Splunk S2S target is a separate implementation from the HEC sender, so it has no endpoint step and no HEC token. Its three type-specific steps are:

  • Connection settings — Address and port of the first indexer, a Send to additional indexers toggle (off by default) that reveals the weighted Indexers list (address, port, weight), load balancing intervals, protocol version, acknowledgement, compression, server name and management port
  • Event settings — Index, host, source and source type attribution, Splunk envelope metadata extraction, nested field serialization, field format, batch size, timeout, maximum event size, throttling, and retry settings
  • TLS settings — Server verification, SNI, CA certificate, client certificate and key, passphrase and the TLS version range

AWS Connection Properties​

Applies to: AmazonCloudWatchLogs, AmazonKinesis, AmazonMSK, AmazonSNS, AmazonSQS

AWS connection and credential configuration:

  • Region - AWS region
  • Access Key ID - AWS access credentials
  • Secret Access Key - AWS secret credentials
  • Endpoint - Service endpoint URL

AWS Service Configuration​

Applies to: AmazonCloudWatchLogs, AmazonKinesis, AmazonMSK, AmazonSNS, AmazonSQS

Target-specific AWS configuration following the AWS settings step (Connection settings on AmazonMSK). The step name and fields vary by target:

  • Stream settings (AmazonKinesis) — Stream name, partition key
  • Producer settings + TLS settings (AmazonMSK) — Topic, partition settings, TLS certificate configuration
  • Topic settings (AmazonSNS) — Topic ARN, message attributes
  • Queue settings (AmazonSQS) — Queue URL, message settings
  • Log settings (AmazonCloudWatchLogs) — Log group, log stream

AWS Data Warehouse​

Applies to: AmazonRedshift

Amazon Redshift data warehouse configuration takes two steps:

  • Connection settings — Region, Access Key ID, Secret Access Key, then the cluster endpoint, database, schema, credentials and port
  • Staging and tables — S3 bucket and prefix for staging data loads, target table name and table list, and batch size and flush settings

S3 and Cloud Storage Properties​

Applies to: AlibabaS3, AmazonS3, AmazonSecurityLake, BackblazeS3, CloudflareR2, DigitalOceanS3, IbmCos, Minio, ScalewayS3

S3-compatible cloud storage configuration. All targets in this group have two steps — file properties and storage/connection properties:

  • Endpoint - Storage service endpoint URL
  • Access Key ID / Secret Access Key - Storage access credentials
  • Bucket - Target storage bucket name
  • Region - Storage region (where applicable)
  • File name template - Output file naming pattern with template support
  • Format - Output format (JSON, Parquet, Avro, etc.)
  • Compression - Optional data compression (zstd, gzip, etc.)

AmazonSecurityLake uses a different layout (AWS settings + Security Lake settings): the bucket, the custom source and its OCSF event class, the file name template and compression, with Parquet as the format.

Message Queue Properties​

Applies to: ConfluentCloud, Kafka, Redpanda

Message queue connection and producer configuration:

  • Connection settings — Broker addresses, topic, authentication
  • TLS settings — Certificate, key, and CA configuration

BigQuery Properties​

Applies to: BigQuery

Google BigQuery configuration with three steps:

  • Google Cloud settings — Project ID, credentials, dataset
  • Streaming settings — Streaming insert configuration
  • Tables — Target table name, schema settings

File Settings​

Applies to: File

File output configuration:

  • File Path - Output directory and file naming pattern
  • File Format - Output format (JSON, Parquet, Avro, etc.)
  • Compression - Optional data compression

Console Settings​

Applies to: Console

Console output format configuration for debugging and testing:

  • Output Format - Display format for console output
  • Pretty Print - Formatted JSON output option

Execution Settings​

Applies to: All targets

The Execution settings step configures target execution scheduling and debugging options.

Scheduling:

The Scheduling toggle switches scheduled delivery on.

  • When it is off, the target delivers data continuously as it arrives
  • When it is on, the director accumulates the data and delivers it each time the schedule fires

Scheduling Method:

Under Scheduling method, choose one of two radio tiles:

  • Cron-based — delivers at specific times or dates named by a cron expression. Use it for fixed clock times, such as a nightly run
  • Interval-based — delivers at regular, fixed intervals, such as every 10 minutes. Use it for a steady rate

Cron Schedule:

When Cron-based is selected, the Cron schedule section appears. The director delivers at the times the expression names, in its own local time zone.

  1. Pattern — choose a calendar preset. Sub-daily frequencies are left to Interval-based, so the presets only name wall-clock moments:

    • Custom — enter your own cron expression
    • Every day at midnight (0 0 * * *)
    • Every weekday at midnight (0 0 * * 1-5)
    • Every Sunday at midnight (0 0 * * 0)
    • Monthly on day 1 at midnight (0 0 1 * *)

    Midnight renders through your own clock convention, so a 12-hour or 24-hour time can appear in its place.

  2. Custom — when selected:

    • An info alert, Special characters, explains *, ,, - and /
    • Cron expression takes five fields separated by spaces: minute, hour, day of month, month and day of week, where 0 is Sunday. Six or seven fields, as Quartz writes them, start with the second, may end with the year and count Sunday as 1
    • Test expression shows the expression and a human-readable reading of it. For example, 0 */3 * * * reads as "Run every 3 hours"

Interval Schedule:

When Interval-based is selected, the Interval schedule section appears. The director delivers once per interval, counted from when the target starts.

  1. Interval — choose from predefined intervals:

    • Custom — enter your own interval
    • 30 seconds (30s)
    • 1 minute (1m)
    • 5 minutes (5m)
    • 10 minutes (10m)
    • 15 minutes (15m)
    • 30 minutes (30m)
    • 1 hour (1h)
    • 2 hours (2h)
    • 6 hours (6h)
    • 12 hours (12h)
    • 24 hours (24h)

  2. Custom interval — when Custom is selected:

    • An info alert, Interval format, explains the format
    • A number followed by a unit: s (seconds), m (minutes), h (hours) or d (days)
    • Without a unit the number is in seconds, so 300 is 5 minutes
    • Examples: 90s, 45m, 2h, 2d

For the expression format in depth, see Cron-Based Scheduling and Interval-Based Scheduling.

Debugging:

Use debugging to inspect what a target receives, and, with Don't send logs, to test it without delivering data.

  • Debugging — toggle to log each event for the target. On its own it does not stop delivery: the target still receives the data
  • Don't send logs — shown when debugging is on. With it on as well, the director still processes the data but sends nothing to the target, which is useful for validating a configuration without affecting production systems

Review and Create​

The final wizard step, Review and create, shows a summary of all entered configuration values. Click Create target to create the target.

Wizard Navigation​

Progress Indicator:

  • Visual step progress at top of wizard
  • Click steps to navigate (after validation)
  • Current step highlighted
  • Completed steps marked with checkmark

Navigation Buttons:

  • Cancel - Exit wizard without creating target
  • Back - Return to previous step
  • Next step - Advance to next step with validation
  • Create target - Finalize target creation (final step)

Detail View​

Clicking a target from the list opens the detailed management interface with tabbed panels. All targets display General Settings, Execution Settings, Health, Data flow, Live Data, and Activity logs tabs (Health and Data flow need the Stats permission). The intermediate configuration tabs vary by target category.

  • Health — throughput, queue depth and delivery lag, errors and drops by stage, the devices routing to the target, and the runtime resources of the directors carrying it, over a selectable window with live polling
  • Data flow — which routes are configured to reach the target and what each delivered in the window, which devices sent to it and through which route, the top source and its share, and a sources → routes → target diagram; Quick Route traffic and deliveries a director cannot attribute to a route are shown as their own nodes
  • Live Data — captures data flowing to the target in real time (see Live Data); shows a disabled-state message when the target is inactive or no route sends data to it
  • Activity logs — target configuration change history

General Settings Tab​

Applies to: All targets

  • Target name - Editable target name
  • Description - Editable target description
  • Status - Current operational state
  • Edit Mode - Click edit to modify general settings

Azure Targets​

Applies to: AzureBlobStorage, AzureDataExplorer, AzureEventHubs, AzureMonitorLogs, AzureServiceBus, MicrosoftSentinel, MicrosoftSentinelDataLake

Azure targets display the following configuration tabs:

  • Azure settings (AzureBlobStorage, AzureDataExplorer, AzureMonitorLogs, AzureServiceBus, MicrosoftSentinel, MicrosoftSentinelDataLake) — Authentication, workspace, subscription details
  • Stream settings (AzureMonitorLogs, MicrosoftSentinel, MicrosoftSentinelDataLake) — Stream name, table, DCR settings
  • Storage settings (AzureBlobStorage, AzureDataExplorer) — Container, database configuration
  • Message settings (AzureServiceBus) — Queue/topic configuration
  • Advanced settings (AzureEventHubs) — Retry, timeout, batch settings

Analytics and SIEM Targets​

Applies to: AmazonOpenSearch, Elasticsearch, ElasticSecurity, GoogleChronicle, GoogleSecOps, Splunk, SplunkSecurity, SplunkS2s

Analytics and SIEM targets display the following configuration tabs:

  • Authentication (all except SplunkS2s) — Endpoint URLs, credentials, TLS settings
  • Splunk HEC Properties (Splunk, SplunkSecurity) — Index, source type, batch size, timeout, compression, field format
  • Chronicle Properties + Log Settings (GoogleChronicle) — Chronicle configuration and log settings
  • SecOps Properties (GoogleSecOps) — SecOps configuration
  • Connection / Event / TLS Settings (SplunkS2s) — Indexer tier and load balancing, event attribution and delivery, TLS. This target is not the HEC sender, so it has no Authentication tab

Elasticsearch, ElasticSecurity, and AmazonOpenSearch display only the Authentication tab for detail view configuration.

AWS Targets​

Applies to: AmazonCloudWatchLogs, AmazonKinesis, AmazonMSK, AmazonRedshift, AmazonS3, AmazonSecurityLake, AmazonSNS, AmazonSQS

AWS targets display the following configuration tabs:

  • AWS settings (AmazonCloudWatchLogs, AmazonKinesis, AmazonSNS, AmazonSQS) and Connection settings (AmazonMSK) — Region, credentials, endpoint
  • Stream settings (AmazonKinesis) — Stream name, partition key
  • Producer settings (AmazonMSK) — Topic, partition settings
  • TLS settings (AmazonMSK) — Certificate configuration
  • Topic settings (AmazonSNS) — Topic ARN, message attributes
  • Queue settings (AmazonSQS) — Queue URL, message settings
  • Log settings (AmazonCloudWatchLogs) — Log group, log stream
  • Connection settings (AmazonRedshift) — Region, access credentials, cluster endpoint, database, schema
  • Staging and tables (AmazonRedshift) — Staging bucket configuration, target table, column mapping
  • AWS settings + File settings (AmazonS3) — File format, compression, bucket, credentials
  • AWS settings + Security Lake settings (AmazonSecurityLake) — Bucket, account ID, custom source, OCSF event class, file name template, compression, file rotation

S3-Compatible Cloud Storage Targets​

Applies to: AlibabaS3, BackblazeS3, CloudflareR2, DigitalOceanS3, IbmCos, Minio, ScalewayS3

All S3-compatible cloud storage targets display two tabs:

  • File settings — File name pattern, format, compression
  • A settings tab named for the provider (for example MinIO settings or Cloudflare R2 settings) — Endpoint, access credentials, bucket, region

Message Queue Targets​

Applies to: ConfluentCloud, Kafka, Redpanda

All message queue targets display three tabs:

  • Connection settings — Broker addresses, topic, authentication
  • Producer settings — Producer configuration and tuning
  • TLS settings — Certificate, key, and CA configuration

GCP Targets​

Applies to: BigQuery

  • Google Cloud settings — Project ID, credentials, dataset
  • Streaming settings — Streaming insert configuration
  • Tables — Target table and schema settings

Utility Targets​

Applies to: Console, File

  • Console settings (Console) — Output format, pretty print
  • File settings (File) — File path, format, compression

Execution Settings Tab​

Applies to: All targets

Displays and allows editing of scheduling and debugging configuration:

Scheduling Section:

  • Current scheduling status (Enabled/Disabled)
  • Scheduling method (Cron or Interval)
  • Current schedule pattern or interval
  • Edit mode allows modification of all scheduling settings

Debugging Section:

  • Debug logging status (Enabled/Disabled)
  • Don't send logs status (Enabled/Disabled when debugging active)
  • Edit mode allows modification of debug settings

Detail Actions​

Each target detail view provides an Actions menu with the following operations:

Status Management:

  • Enable target / Disable target - Toggle target status (shown according to current status)

Advanced Operations:

  • Clone target - Duplicate configuration for new target
  • Export template - Open the target as a Bicep template, to deploy again or to change first (see Export Template)
  • Delete target - Remove target from platform

Operations​

Enable / Disable​

To change target status:

  1. Navigate to target detail view or use the Actions menu from list
  2. Click Actions menu
  3. Select Enable target or Disable target
  4. Confirmation notification confirms the status change

Enabled targets actively forward data. Disabled targets preserve configuration but stop all forwarding.

Clone​

Duplicate an existing target configuration for quick setup:

  1. Navigate to target detail view or use Actions menu from list
  2. Click Actions menu
  3. Select Clone target
  4. System navigates to target creation wizard
  5. Pre-fills form with cloned target configuration
  6. Modify name and other settings as needed
  7. Complete wizard to create new target

Delete​

Remove a target from the platform with dependency checking:

  1. Navigate to target detail view or use Actions menu from list
  2. Click Actions menu
  3. Select Delete target
  4. A confirmation modal appears showing the target name in its heading

Standard Deletion:

  • Click Delete to proceed (or Cancel)
  • Success notification confirms deletion
  • Redirect to target list view

Deletion with Dependencies:

If the target is referenced by routes, the API checks both Quick Routes and Advanced Routes and returns the list of affected routes. The modal shown depends on what is assigned:

  • Single Quick Route reference: A modal with heading "Target cannot be deleted" appears and offers a Go to routes button that navigates to the Quick Routes list.
  • Multiple references or any Advanced Route: A modal with heading "Target cannot be deleted" lists all assigned routes by name. Each Quick Route entry links to the Quick Routes list; each Advanced Route entry links to its detail page.

Dependency Resolution:

  1. Use the route links in the modal to navigate to each affected route
  2. Remove this target from the route, or delete the route
  3. Retry target deletion once all assignments are removed

Edit Mode Workflow​

Target detail tabs support inline editing with unsaved changes protection:

Enter Edit Mode:

  1. Navigate to editable tab
  2. Click the tab's Manage button, labelled with the tab's name (for example Manage Azure settings)
  3. Form fields become editable
  4. Save changes and Cancel buttons appear

Make Changes:

  • Modify editable fields
  • Changes are not saved automatically
  • Form validation occurs on save

Save Changes:

  1. Click Save changes button
  2. System validates changes
  3. Success notification displays confirmation
  4. Edit mode exits
  5. Tab displays updated values

Cancel Changes:

  1. Click Cancel button
  2. Form reverts to original values
  3. Edit mode exits
  4. No changes are saved

Leave a Tab in Edit Mode:

Leaving a tab closes its editor. With nothing changed, edit mode exits and the tab that was clicked opens; coming back means clicking Manage again. With unsaved changes, an Unsaved changes modal asks first, and the tab stays selected until it is answered:

  • Heading: "You have unsaved changes"
  • Message: "Your changes will be lost if you leave this tab without saving."
  • Continue editing - Closes the modal. The tab, the editor and the changes stay as they are
  • Discard changes - Drops the changes, closes the editor and opens the tab that was clicked

The X in the corner and the Escape key do the same as Continue editing.

Anything edited in the tab's form counts as a change, including a list-field row that is being filled in and has not been added. A value typed and then typed back still counts. When Save changes fails because a required field on another tab is empty, the page opens that tab itself, without asking, and keeps the editor and its changes.

Notifications​

The Targets interface provides automatic notifications for all operations:

Success​

Success messages auto-dismiss after 10 seconds. These include confirmations for target creation, enabling, disabling, deletion, and configuration updates. Hover to pause the auto-close timer, or click X to dismiss manually.

Errors​

Error notifications persist until manually dismissed. These include failures for enable, disable, delete, and update operations. Review error details and take corrective action before dismissing.