Routes: Management

The Routes web interface provides comprehensive management for data flow orchestration through two distinct approaches: Quick Routes for simple configurations and Advanced Routes for complex routing logic.

Accessing Routes Interface

Navigate to the Routes management interface:

• Go to Home > Routes

-or-

• Click the hamburger menu on the top left
• Select Routes

Routes Overview

The Routes interface is where you orchestrate data flow from devices through pipelines to targets. Routes act as traffic controllers, determining what data goes through which processing pipelines and reaches which destinations.

DataStream provides two route types:

Quick Routes:

• Visual drag-and-drop interface
• Simple device-to-target connections
• Optional pipeline processing
• Best for straightforward data flows

Advanced Routes:

• Multi-step wizard configuration
• Complex filtering and conditional logic
• Director selection for targeted execution
• Scheduling capabilities for batch processing
• Best for enterprise routing scenarios

Quick Routes

Quick Routes provides a visual interface for creating simple data flows with drag-and-drop functionality.

Quick Routes Interface

The Quick Routes page displays a flow diagram showing connections between devices and targets.

Interface Components:

Left Panel - Devices:

• Device type boxes showing configured devices
• Each box displays device icon, name, and type
• Click + button to add device to flow
• Devices appear on the left side of the canvas

Right Panel - Targets:

• Target type boxes showing configured targets
• Each box displays target icon, name, and type
• Click + button to add target to flow
• Targets appear on the right side of the canvas

Center Canvas - Flow Diagram:

• Visual representation of data flows
• Connection lines between devices and targets
• Pipeline nodes on connection lines (optional)
• Direct connections or pipeline-mediated connections

Creating Quick Routes

Add Device to Flow:

1. Locate device type in left panel
2. Click + button on device box
3. Drawer opens with device selection
4. Select device from list
5. Device appears on canvas

Add Target to Flow:

1. Locate target type in right panel
2. Click + button on target box
3. Drawer opens with target selection
4. Select target from list
5. Target appears on canvas

Connect Device to Target:

Connection happens automatically when both device and target are added to the canvas. The system creates a direct route connection.

Add Pipeline to Connection:

1. Click on connection line between device and target
2. Select Pipeline modal appears
3. Choose pipeline from dropdown list
4. Click Select to add pipeline to connection
5. Pipeline node appears on connection line
6. Data flows through: Device → Pipeline → Target

Managing Quick Routes

View Route Details:

• Hover over connection line to see route name
• Click connection line to see route configuration
• Pipeline nodes show pipeline name

Remove Pipeline from Route:

1. Click on pipeline node on connection line
2. Connection reverts to direct device-to-target flow

Delete Route:

1. Click connection line
2. Modal appears with delete confirmation
3. Confirm to remove route
4. Connection line disappears from canvas

Remove Device:

1. Click device node on canvas
2. Delete modal appears
3. Confirm to remove device
4. All routes using this device are deleted

Remove Target:

1. Click target node on canvas
2. Delete modal appears
3. Confirm to remove target
4. All routes using this target are deleted

Advanced Routes

Advanced Routes provides a wizard-based interface for creating complex routing configurations with filtering, director selection, and scheduling.

Advanced Routes List

The Advanced Routes page displays a table of all configured advanced routes.

Table Columns:

• Name - Route identifier
• Status - Operational state (Active or Passive)
• Director - Assigned Directors (multiple possible)
• Pipeline - Processing pipeline name
• Default Target - Fallback destination
• Actions Menu (⋮) - Per-route operations

Table Controls:

Search and Filter:

• Search routes - Filter by route name
• Status Dropdown - Filter by Active/Passive/All
• Refresh Button - Reload table data

Primary Actions:

• Create advanced route - Launch route creation wizard

Route Actions Menu

Each route row provides an Actions menu (⋮) with operations:

View and Edit:

• Edit route - Navigate to route edit interface
• View details - Navigate to route detail view

Status Management:

• Activate Route - Set route to Active status
• Deactivate Route - Set route to Passive status

Deletion:

• Delete Route - Remove route from platform

Create Advanced Route Wizard

The advanced route creation process uses a multi-step wizard with comprehensive configuration.

Route Details

Configure basic route information and connections.

Route Information:

Name:

• Unique route identifier
• Minimum 3 characters
• Maximum 50 characters

Description:

• Optional route explanation
• Character counter (max 100 characters)
• Describes route purpose

Filter:

• Optional filter expression
• Determines which events match this route
• Uses expression syntax for conditional matching
• Tooltip provides link to documentation
• Example: event.type == "security" && event.severity > 3

Default Target:

• Fallback destination for events that don't match specific targets
• Dropdown showing all configured targets
• Special "null" target option for dropping unmatched events
• Tooltip explains default target behavior

Pipeline:

• Required processing pipeline selection
• Dropdown showing all available pipelines
• Route processes all events through this pipeline

Route Status:

• Toggle between Active and Passive
• Active: Route processes events
• Passive: Route is configured but not processing

Route Configuration

Configure device-to-target connections with optional filtering and pipeline routing.

Route Configuration Interface:

This step defines the specific data flow paths within the route.

Device Selection:

• Select which devices feed into this route
• Multiple devices can be selected
• Filter expressions can target specific devices

Target Mapping:

• Define which targets receive processed data
• Multiple targets can be configured
• Conditional target selection based on event content

Processing Flow:

• Device events enter route
• Route filter expression evaluated (from Step 1)
• Pipeline processes matching events (from Step 1)
• Events routed to appropriate targets
• Unmatched events go to default target

Execution Settings

Configure route scheduling and execution behavior.

Scheduling:

Enable scheduling to run the route at specific times rather than continuous processing.

Scheduling Toggle:

• Enable Scheduling - Activate scheduled execution
• When disabled, route processes data continuously as it arrives
• When enabled, route accumulates data and processes on schedule

Scheduling Method Selection:

Choose between two scheduling approaches using radio tiles:

info

For Cron-Based scheduling, see this chapter, for Interval-based scheduling, see this chapter.

Review and Create

Configuration Summary:

• Review all route settings
• Verify Director selections
• Confirm scheduling configuration
• Check device and target connections

Create Route:

• Create Route button finalizes configuration
• Success notification on successful creation
• Redirect to Advanced Routes list

Wizard Navigation

Progress Indicator:

• Visual step progress at top of wizard
• Click steps to navigate (after validation)
• Current step highlighted
• Completed steps marked with checkmark

Navigation Buttons:

• Cancel - Exit wizard without creating route
• Back - Return to previous step
• Next - Advance to next step with validation
• Create Route - Finalize route creation (final step)

Advanced Route Detail View

Clicking a route from the list opens the detailed management interface.

Route Detail Tabs

Route Details Tab:

Displays and allows editing of route configuration from Step 1:

• Name - Editable route name
• Description - Editable route description
• Filter Expression - Event filtering logic
• Director Selection - Selected Directors (MultiSelect)
• Default Target - Fallback destination
• Pipeline - Processing pipeline
• Status - Active/Passive toggle
• Edit Mode - Click edit to modify settings

Route Configuration Tab:

Displays device-to-target connection configuration from Step 2:

• Device selections
• Target mappings
• Processing flow diagram
• Edit mode allows modification

Execution Settings Tab:

Displays and allows editing of scheduling configuration from Step 3:

Scheduling Section:

• Current scheduling status (Enabled/Disabled)
• Scheduling method (Cron or Interval)
• Current schedule pattern or interval
• Edit mode allows modification of all scheduling settings

Route Operations

Enable/Disable Routes

Activate Route:

Set route to Active status to begin processing:

1. Navigate to route detail view or use Actions menu from list
2. Click Actions menu
3. Select Activate Route
4. Success notification displays confirmation
5. Route status updates to "Active"
6. Route begins processing events based on configuration

Deactivate Route:

Set route to Passive status to pause processing:

1. Navigate to route detail view or use Actions menu from list
2. Click Actions menu
3. Select Deactivate Route
4. Success notification displays confirmation
5. Route status updates to "Passive"
6. Route stops processing but preserves configuration

Delete Route

Delete Route Process:

Remove a route from the platform:

1. Navigate to route detail view or use Actions menu from list
2. Click Actions menu
3. Select Delete Route
4. Deletion modal appears with confirmation
5. Confirm route name matches
6. Click Delete to proceed
7. Success notification confirms deletion
8. Redirect to routes list

Note: Route deletion does not delete the devices, pipelines, or targets used by the route. Only the routing configuration is removed.

Edit Mode Workflow

Route detail tabs support inline editing with unsaved changes protection:

Enter Edit Mode:

1. Navigate to editable tab
2. Click Edit button in top-right of tab
3. Form fields become editable
4. Save and Cancel buttons appear

Make Changes:

• Modify editable fields
• Update Director selections
• Change scheduling settings
• Changes are not saved automatically

Save Changes:

1. Click Save button
2. System validates changes
3. Success notification displays confirmation
4. Edit mode exits
5. Tab displays updated values

Cancel Changes:

1. Click Cancel button
2. Form reverts to original values
3. Edit mode exits
4. No changes are saved

Tab Navigation Protection:

If you attempt to navigate to another tab while in edit mode:

• Unsaved Changes Modal appears
• Modal Contents:
  • "Unsaved changes" heading
  • "You have unsaved changes. Are you sure you want to leave?" message
  • Discard Changes - Exit edit mode and switch tabs
  • Continue Editing - Return to current tab
  • Cancel - Close modal

Notifications

The Routes interface provides automatic notifications for all operations:

Success Notifications

Auto-dismissing success messages (10-second timeout):

• Route Created - New route successfully created
• Route Activated - Route successfully set to Active
• Route Deactivated - Route successfully set to Passive
• Route Deleted - Route successfully removed from platform
• Route Updated - Route configuration successfully saved

Error Notifications

Persistent error notifications requiring user action:

• Activate Failed - Route could not be activated
• Deactivate Failed - Route could not be deactivated
• Delete Failed - Route deletion unsuccessful
• Update Failed - Route configuration update failed
• Validation Error - Configuration validation failed

Notification Actions

Auto-Close:

• Success notifications auto-dismiss after 10 seconds
• Hover to pause auto-close timer
• Click X to manually dismiss

Manual Dismiss:

• Error notifications require manual dismissal
• Review error details before dismissing
• Take corrective action based on error message

Route Management Best Practices

Route Organization

Naming Conventions:

• Use descriptive, meaningful route names
• Include purpose or data type in name (e.g., "security-events-to-sentinel")
• Maintain consistent naming pattern across routes
• Avoid generic names like "route1" or "test"

Director Selection Strategy

When to Select Specific Directors:

• Geographic Distribution - Route data through Directors in specific regions
• Resource Isolation - Dedicate Directors to specific workloads
• Testing and Staging - Test routes on subset of Directors before full deployment
• Compliance Requirements - Ensure data stays within specific infrastructure

When to Use All Directors:

• High Availability - Distribute processing across all available Directors
• Load Balancing - Automatically balance workload across infrastructure
• Simplified Management - Default behavior requires no selection

Scheduling Configuration

Scheduling Usage:

• Use scheduling for batch-oriented processing
• Continuous processing appropriate for real-time requirements
• Consider data volume and processing capacity
• Test scheduled execution with small datasets first

Cron vs Interval:

• Cron - Best for specific time-of-day requirements
• Interval - Best for regular periodic processing
• Consider timezone implications for cron schedules
• Document scheduling decisions for team reference

Route Types and Patterns

Quick Routes Best For:

• Simple device-to-target connections
• Direct data forwarding with minimal logic
• Visual representation helpful
• Single pipeline processing

Advanced Routes Best For:

• Complex filtering and conditional logic
• Multiple device and target combinations
• Director-specific execution
• Scheduled batch processing
• Enterprise routing scenarios

Lifecycle Management

Creation:

• Choose appropriate route type (Quick vs Advanced)
• Configure Director selection based on requirements
• Set up scheduling if needed
• Test route immediately after creation

Maintenance:

• Review route performance regularly
• Monitor Director load distribution
• Adjust scheduling as data volumes change
• Update filter expressions as requirements evolve

Deletion:

• Verify route is no longer needed
• Document reason for route removal
• Archive route configuration for compliance
• Consider deactivating instead of deleting for temporary changes