* [Home](home/index.md)
    * [Apps](apps/index.md)
        * [MCP](apps/mcp/index.md)
            * [Install](apps/mcp/install.md)
            * [Test](apps/mcp/run.md)
            * [FAQ](apps/mcp/faq.md)
        * [Reporter](apps/reporter/index.md)
            * [Test](apps/reporter/run.md)
            * [Deploy](apps/reporter/deploy.md)
            * [FAQ](apps/reporter/faq.md)
        * [Receiver](apps/receiver/index.md)
            * [Test](apps/receiver/run.md)
            * [Deploy](apps/receiver/deploy.md)
            * [Compact](apps/receiver/compact/index.md)
                * [Splunk](apps/receiver/compact/splunk.md)
                * [Elasticsearch](apps/receiver/compact/elasticsearch.md)
            * [FAQ](apps/receiver/faq.md)
        * [Retriever](apps/retriever/index.md)
            * [Test](apps/retriever/run.md)
            * [Query](apps/retriever/query.md)
            * [Deploy](apps/retriever/deploy/index.md)
                * [Kubernetes](apps/retriever/deploy/k8s.md)
                * [Lambda](apps/retriever/deploy/lambda.md)
                * [Azure](apps/retriever/deploy/azure.md)
            * [FAQ](apps/retriever/faq.md)
    * [Install](install/index.md)
        * [Paths](install/paths.md)
        * [Docker](install/docker.md)
        * [Single Line](install/singleline.md)
        * [Linux](install/linux.md)
        * [Windows](install/win.md)
        * [MacOS](install/macos.md)
        * [Datadog](install/datadog.md)
        * [Old Releases](install/oldreleases.md)
    * [Configure](config/index.md)
        * [App](config/app.md)
        * [YAML](config/yaml.md)
        * [CLI](config/cli.md)
        * [JSON](config/json.md)
        * [Folder](config/folder.md)
        * [GitHub](config/github.md)
        * [Kubernetes](config/k8s.md)
        * [JavaScript](config/javascript.md)
        * [Symbol](config/symbol.md)
        * [Match](config/match.md)
        * [Module](config/module.md)
    * [Manage](manage/index.md)
        * [API Keys](manage/api-keys.md)
        * [Environments](manage/environments.md)
        * [Authentication](manage/authentication.md)
        * [Status](manage/status.md)
        * [License](manage/license.md)
        * [Logging](manage/logging.md)
    * [Security](security/index.md)
        * [Product shape](security/product-shape.md)
        * [Outbound](security/outbound.md)
        * [Verifying](security/verifying.md)
        * [Telemetry](security/telemetry.md)
        * [Operations](security/operations.md)
        * [SBOM](security/sbom.md)
* [MCP](apps/mcp/tools/index.md)
    * [Orient](apps/mcp/tools/orient/index.md)
        * [Start](apps/mcp/tools/orient/start.md)
        * [Cost options](apps/mcp/tools/orient/cost-options.md)
        * [Explain mode](apps/mcp/tools/orient/explain-mode.md)
        * [Pattern detail](apps/mcp/tools/orient/pattern-detail.md)
        * [Preview filter](apps/mcp/tools/orient/preview-filter.md)
        * [Product Q&A](apps/mcp/tools/orient/product-qa.md)
    * [POC](apps/mcp/tools/poc/index.md)
        * [POC submit](apps/mcp/tools/poc/poc-from-siem-submit.md)
        * [POC status](apps/mcp/tools/poc/poc-from-siem-status.md)
        * [Local POC](apps/mcp/tools/poc/poc-from-local.md)
    * [Account](apps/mcp/tools/account/index.md)
        * [Sign in](apps/mcp/tools/account/signin.md)
        * [Sign out](apps/mcp/tools/account/signout.md)
        * [Login status](apps/mcp/tools/account/login-status.md)
        * [Health check](apps/mcp/tools/account/health-check.md)
        * [Configure env](apps/mcp/tools/account/configure-env.md)
        * [Create env](apps/mcp/tools/account/create-env.md)
        * [Update env](apps/mcp/tools/account/update-env.md)
        * [Delete env](apps/mcp/tools/account/delete-env.md)
        * [Settings](apps/mcp/tools/account/update-settings.md)
        * [Rotate key](apps/mcp/tools/account/rotate-api-key.md)
    * [Install](apps/mcp/tools/install/index.md)
        * [Scan env](apps/mcp/tools/install/discover-env.md)
        * [Recommend](apps/mcp/tools/install/advise-install.md)
        * [Retriever plan](apps/mcp/tools/install/advise-retriever.md)
        * [Engine PR](apps/mcp/tools/install/configure-engine.md)
        * [Set gitops repo](apps/mcp/tools/install/set-gitops-repo.md)
        * [Setup recurring](apps/mcp/tools/install/setup-recurring.md)
    * [Costs](apps/mcp/tools/costs/index.md)
        * [Top patterns](apps/mcp/tools/costs/top-patterns.md)
        * [Services](apps/mcp/tools/costs/services.md)
        * [Savings](apps/mcp/tools/costs/savings.md)
        * [Labels](apps/mcp/tools/costs/discover-labels.md)
        * [Baseline](apps/mcp/tools/costs/baseline.md)
        * [Estimate savings](apps/mcp/tools/costs/estimate-savings.md)
        * [Commitment report](apps/mcp/tools/costs/commitment-report.md)
        * [Pattern diff](apps/mcp/tools/costs/pattern-diff.md)
        * [What's changing](apps/mcp/tools/costs/whats-changing.md)
        * [What's new](apps/mcp/tools/costs/whats-new.md)
    * [Identify](apps/mcp/tools/resolution/index.md)
        * [Lookup](apps/mcp/tools/resolution/event-lookup.md)
        * [Triage](apps/mcp/tools/resolution/resolve-batch.md)
        * [Trend](apps/mcp/tools/resolution/pattern-trend.md)
        * [Catalog](apps/mcp/tools/resolution/extract-templates.md)
    * [Investigate](apps/mcp/tools/investigation/index.md)
        * [Investigate](apps/mcp/tools/investigation/investigate.md)
        * [Query metrics](apps/mcp/tools/investigation/customer-metrics-query.md)
        * [Join keys](apps/mcp/tools/investigation/discover-join.md)
        * [Examples](apps/mcp/tools/investigation/pattern-examples.md)
        * [Metric overlay](apps/mcp/tools/investigation/metric-overlay.md)
        * [Metrics that moved](apps/mcp/tools/investigation/metrics-that-moved.md)
        * [Rank by shape](apps/mcp/tools/investigation/rank-by-shape-similarity.md)
    * [Detect](apps/mcp/tools/detect/index.md)
        * [Find skew](apps/mcp/tools/detect/find-skew.md)
        * [Measure compaction](apps/mcp/tools/detect/measure-compaction.md)
    * [Drop](apps/mcp/tools/drop/index.md)
        * [Safety check](apps/mcp/tools/drop/dependency-check.md)
        * [Mitigate](apps/mcp/tools/drop/pattern-mitigate.md)
    * [Retrieve](apps/mcp/tools/retrieve/index.md)
        * [Query](apps/mcp/tools/retrieve/retriever-query.md)
        * [Query status](apps/mcp/tools/retrieve/retriever-query-status.md)
        * [Series](apps/mcp/tools/retrieve/retriever-series.md)
        * [Backfill](apps/mcp/tools/retrieve/backfill-metric.md)
        * [Overflow contents](apps/mcp/tools/retrieve/overflow-contents.md)
        * [Probe](apps/mcp/tools/retrieve/retriever-probe.md)
    * [Compile](apps/mcp/tools/compile/index.md)
        * [Compile](apps/mcp/tools/compile/compile.md)
        * [Compile status](apps/mcp/tools/compile/compile-status.md)
        * [Link units](apps/mcp/tools/compile/compile-link.md)
* [Engine](engine/index.md)
    * [Design](engine/design.md)
    * [Runtime](run/index.md)
        * [Bootstrap](run/bootstrap/index.md)
        * [Symbol](run/symbol/index.md)
        * [Template](run/template/index.md)
        * [Input](run/input/index.md)
            * [Stdin](run/input/stdin/)
            * [File](run/input/file/)
            * [Log Analyzer](run/input/analyzer/index.md)
                * [Splunk](run/input/analyzer/splunk/index.md)
                * [ElasticSearch](run/input/analyzer/elasticsearch/index.md)
                * [Datadog Logs](run/input/analyzer/datadogLogs/index.md)
                * [CloudWatch Logs](run/input/analyzer/cloudwatchLogs/index.md)
                * [S3 Logs](run/input/analyzer/s3Logs/index.md)
            * [Log Forwarder](run/input/forwarder/index.md)
                * [Filebeat](run/input/forwarder/filebeat/index.md)
                * [Fluent Bit](run/input/forwarder/fluentbit/index.md)
                * [Fluentd](run/input/forwarder/fluentd/index.md)
                * [Vector](run/input/forwarder/vector/index.md)
                * [OTel Collector](run/input/forwarder/otel-collector/index.md)
                * [Logstash](run/input/forwarder/logstash/index.md)
                * [Splunk UF](run/input/forwarder/splunkUF/index.md)
                * [Datadog Agent](run/input/forwarder/datadogAgent/index.md)
            * [Object Storage](run/input/objectStorage/index.md)
                * [Index](run/input/objectStorage/index/index.md)
                * [Query](run/input/objectStorage/query/index.md)
            * [Custom Input](run/input/stream/index.md)
            * [Extract](run/input/extract/)
            * [Initialize](run/transform/script/input/index.md)
        * [Transform](run/transform/index.md)
            * [Structure](run/transform/structure/index.md)
                * [Timestamps](run/transform/timestamp/)
                * [Fields](run/transform/fields/)
                * [Symbols](run/transform/symbol/index.md)
            * [Group](run/transform/group/)
            * [Script](run/transform/script/index.md)
                * [Function](run/transform/script/function/index.md)
                * [Template](run/transform/script/template/index.md)
                * [Unit](run/transform/script/unit/index.md)
                * [Shutdown](run/transform/script/unitShutdown/index.md)
            * [Parallelize](run/transform/parallelize/)
        * [Enrich](run/initialize/index.md)
            * [Message](run/initialize/message/)
            * [Level](run/initialize/level/)
            * [HTTP Code](run/initialize/httpCode/)
            * [Lookup](run/initialize/lookup/)
            * [GeoIP](run/initialize/geoIP/)
            * [k8s](run/initialize/k8s/)
            * [Group](run/initialize/group/)
            * [Custom](run/transform/script/object/index.md)
        * [Aggregate](run/aggregate/index.md)
            * [Initialize](run/transform/script/summary/index.md)
        * [Receive](run/output/receive/index.md)
            * [Rate](run/receive/rate/index.md)
        * [Output](run/output/index.md)
            * [Event](run/output/event/index.md)
                * [Stdout](run/output/event/stdout/)
                * [File](run/output/event/file/)
                * [Process](run/output/event/process/)
                * [Fluent Bit](run/output/event/fluentbit/)
                * [Unix Socket](run/output/event/unix/)
                * [Forward](run/output/event/forward/)
                * [Socket](run/output/event/socket/)
                * [Http](run/output/event/http/)
                * [GitHub](run/output/event/github/)
                * [Dev](run/output/event/dev/)
                * [Custom](run/output/event/outputStream/)
            * [Metric](run/output/metric/index.md)
                * [Prometheus](run/output/metric/prometheus/index.md)
                    * [Scrape](run/output/metric/prometheus/scrape/index.md)
                    * [Remote Write](run/output/metric/prometheus/remote-write/index.md)
                    * [Push Gateway](run/output/metric/prometheus/push-gateway/index.md)
                * [AWS CloudWatch](run/output/metric/cloudwatch/index.md)
                * [Datadog](run/output/metric/datadog/index.md)
                * [Elastic](run/output/metric/elastic/index.md)
                * [Log](run/output/metric/log/index.md)
            * [Custom](run/output/stream/index.md)
            * [Initialize](run/transform/script/output/index.md)
        * [Monitor](run/monitor/index.md)
            * [Reload](run/reload/index.md)
            * [Console](run/console/index.md)
    * [Compiler](apps/compiler/index.md)
        * [Test](compile/test.md)
        * [Deploy](compile/deploy.md)
        * [Stages](compile/index.md)
            * [Bootstrap](compile/bootstrap/)
            * [Pull](compile/pull/index.md)
                * [Github](compile/pull/github/)
                * [Docker](compile/pull/docker/)
                * [Helm](compile/pull/helm/)
                * [Artifactory](compile/pull/artifactory/)
            * [Scan](compile/scan/index.md)
                * [Antlr](compile/scanner/antlr/)
                * [Java](compile/scanner/javaParser/)
                * [Python](compile/scanner/pythonAST/)
                * [Bytecode](compile/scanner/bytecode/)
                * [Scala](compile/scanner/scalameta/)
                * [Executable](compile/scanner/executable/)
                * [Text](compile/scanner/text/)
                * [Regex](compile/scanner/pattern/)
                * [Archive](compile/scanner/archive/)
                * [Symbol](compile/scanner/symbol/)
                * [Log Methods](compile/scanner/logMethods/)
            * [Link](compile/link/)
            * [Push](compile/push/)
            * [Console](compile/console/)
            * [Monitor](compile/monitor/)
    * [Launchers](engine/launcher/index.md)
        * [Dev/Test](engine/launcher/dev.md)
        * [Function](engine/launcher/function.md)
        * [Job](engine/launcher/job.md)
        * [Trigger](engine/launcher/trigger.md)
        * [Sidecar](engine/launcher/sidecar.md)
        * [Lambda](engine/launcher/lambda.md)
        * [Extension](engine/launcher/extension.md)
        * [Streams](engine/launcher/streams.md)
    * [Flavors](engine/flavors.md)
    * [Pipelines](engine/pipeline.md)
    * [Modules](engine/module.md)
    * [GitOps](engine/gitops.md)
* [API](api/index.md)
    * [Library](api/js.md)
    * [REST](api/rest/index.md)
        * [Metrics](api/metrics.md)
        * [Manage](api/manage.md)
        * [License](api/license.md)
    * [Extend](api/extend/index.md)
        * [Launch](api/launch.md)
        * [Compile](api/compile.md)
        * [Input](api/input.md)
        * [Output](api/output.md)
    * [Expand](api/expand.md)
    * [GitHub](api/github.md)
* [FAQ](faq/index.md)
    * [General](faq/general.md)
    * [Pricing](faq/pricing/index.md)
        * [Overview](faq/pricing/overview.md)
        * [Volume & Scaling](faq/pricing/volume-scaling.md)
        * [Tiers & Billing](faq/pricing/tiers-billing.md)
        * [Node Counting](faq/pricing/node-counting.md)
    * [Security](faq/security/index.md)
        * [Data Protection](faq/security/data-protection.md)
        * [Compliance](faq/security/compliance.md)
        * [Auth & Access](faq/security/auth-access.md)
        * [Deployment](faq/security/deployment.md)
    * [Stacks](faq/stacks/index.md)
        * [Splunk](faq/stacks/splunk/index.md)
            * [Compatibility](faq/stacks/splunk/compatibility.md)
            * [KV Store](faq/stacks/splunk/kv-store.md)
            * [Optimization](faq/stacks/splunk/optimization.md)
            * [Comparisons](faq/stacks/splunk/comparisons.md)
        * [Datadog](faq/stacks/datadog/index.md)
            * [Compatibility](faq/stacks/datadog/compatibility.md)
            * [Integration](faq/stacks/datadog/integration.md)
            * [Optimization](faq/stacks/datadog/optimization.md)
            * [Comparisons](faq/stacks/datadog/comparisons.md)
            * [Troubleshooting](faq/stacks/datadog/troubleshooting.md)
        * [Elasticsearch](faq/stacks/elasticsearch/index.md)
            * [Compatibility](faq/stacks/elasticsearch/compatibility.md)
            * [Configuration](faq/stacks/elasticsearch/configuration.md)
            * [Operations](faq/stacks/elasticsearch/operations.md)
            * [Optimization](faq/stacks/elasticsearch/optimization.md)
            * [Comparisons](faq/stacks/elasticsearch/comparisons.md)
        * [CloudWatch](faq/stacks/aws-cloudwatch.md)
        * [Azure Monitor](faq/stacks/azure-monitor.md)
    * [Apps](faq/apps/index.md)
        * [MCP](faq/apps/mcp.md)
        * [Reporter](faq/apps/reporter.md)
        * [Receiver](faq/apps/receiver.md)
        * [Retriever](faq/apps/retriever.md)
    * [Compiler](compile/faq.md)