V-Pilot: Overview

V-Pilot is the AI assistant built into the DataStream console. It answers questions about DataStream and about your tenant, writes and tests pipelines, opens console pages for you, and proposes changes that you approve before anything is written.

V-Pilot is an assistant for DataStream only: the console and its features, pipelines and their processors, devices, directors, targets and routes, search and detection rules, security data and its formats, and your tenant. It declines anything else, such as general knowledge or code unrelated to DataStream, in one short sentence, and says what it can help with instead.

Opening V-Pilot

Click the V-Pilot button in the console's header, beside the Cloud Shell button. The button is shown to users whose role has the ASSISTANT_USE permission. See Access and Limits.

The panel streams its answer as it is written and shows the steps V-Pilot takes, such as each tool it runs. Stop generating stops the reply. A reply goes on in the background if you close the panel or the browser tab, and the V-Pilot button shows a dot when it is done.

The panel's header has these controls:

• Chat history — lists your 100 most recent conversations. Open one to carry on with it, rename it, or delete it. Delete all deletes every conversation you have.
• New chat — starts a new conversation.
• Dock beside the page and Float over the page — place the panel beside the page or over it. The choice is remembered on each device.

Page Context

When you send a message from certain pages, V-Pilot also receives what the page shows: the page's route, the resource it shows, and what you selected on it. A tag above the input, This page: <name>, says which page goes with the message. Click Don't send this page on the tag to send the message without it.

The pages that send their context are:

• the pipeline editor, which also sends the pipeline as it is open in the editor, unsaved changes included, and the sample you selected in it
• a device's detail page
• an advanced route's detail page
• Search
• Cost and Usage
• Director Health

The page context is masked like the message, and is not stored with the conversation. See Data and Privacy. A sample is raw log data, so it is sent only for users whose role has ASSISTANT_SAMPLE_DATA.

Language and Time Zone

V-Pilot replies in the language you write your message in. When a message has no language of its own, such as YAML, a log line or a command alone, it replies in the language of the console. The panel itself is available in English, German, Spanish, French, Dutch and Turkish.

V-Pilot gives every time as a date and time in your time zone.

What V-Pilot Can Do

Read

V-Pilot reads two things:

• The documentation. It searches this documentation before answering a question about the product, and it lists the pages it used at the end of its answer.
• Your tenant. It reads the tenant as you can read it in the console, with your role: devices, directors, targets, routes, pipelines, rules, health, device logs, the audit log, and deployments. See Access and Limits for the permissions each read needs.

Pipelines

V-Pilot looks up the processors it plans to use and their options instead of relying on memory, and it tests and validates pipelines and schemas with the same engine the MCP Server runs. It runs a test with a representative sample before it says that a pipeline works. When a test fails, it fixes the pipeline and tests again. When a pipeline uses processors the tester does not run, it says that the pipeline could not be tested rather than changing those processors.

When you ask from the pipeline editor, V-Pilot hands the changed pipeline back to the editor on a Change to <name> card. View changes shows the lines it added and removed, and Apply changes puts the change in the editor. Nothing is saved until you save the pipeline yourself.

Open Pages

When you ask to go to, open or see a page of the console, V-Pilot opens it: a list of resources, or the page of one resource. It opens a page only when you ask for one.

Propose Changes

V-Pilot never writes to your tenant itself. To create, change, enable, disable, delete or deploy something, or to run an action, it proposes the change on a card in the panel, and the change is made only if you approve it. See Proposals and Approval.

Proposals and Approval

Nothing in your tenant changes until you approve a card. The kinds of card are:

Card	What approving it does
Create	Creates the resource with the settings on the card
Change	Changes the settings the card lists, from their current value to the new one
Enable	Enables the resource
Disable	Disables the resource, which stops processing data
Delete	Deletes the resource permanently
Deploy	Deploys a template, with the resources listed on the card
Run	Runs an action right away

When you ask for the same change to several resources, such as disabling every syslog device, V-Pilot proposes it on one card for them all instead of one card for each. A card holds up to 50 resources: for more, V-Pilot proposes the rest on further cards.

A card reads Waiting for your approval until you decide it. Click Approve or Reject.

Approve

Approving checks the change again before anything is written:

1. Your role and your plan. If your role no longer has a permission the change needs, or your tenant's plan no longer includes a feature it needs, nothing is changed and the card stays pending with the reason: Your role can no longer make this change or Your plan does not include this change.
2. The tenant as it is now. The change is built again against the tenant. If the resource changed since V-Pilot proposed the change, approval stops and the card shows This changed after V-Pilot proposed it: who changed the resource, with up to three audit entries, and each setting whose value changed, with its old and new value. Approve again to go on with the change as it is now, or reject it.
3. The change. Otherwise the change is applied as you, and the card reads Applied, or Could not be applied with the reason. V-Pilot then checks the result and tells you what it found.

Approving or rejecting a card does not count as a message. You can still decide cards when you have no messages left for the day.

While V-Pilot is replying in the conversation, wait for the reply to finish before you approve a card in it.

Reject and Expire

Reject writes nothing to the tenant. A card you do not decide expires 24 hours after V-Pilot proposed it, and can no longer be approved.

Reading Order

• Access and Limits — the plans and permissions V-Pilot needs, and its message limits.
• What V-Pilot Refuses — the requests it declines, and what it does instead.
• Data and Privacy — what is masked before it reaches the model, what is stored, and for how long.