> ## Documentation Index
> Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL.
> Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other.
> Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking.
> Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify.

# Manage Data Streams

> Use ZCLI commands to create, view, update, pause, and delete the data streams that export application logs, events, and metrics to a connected integration.

Use the ZEDEDA CLI (ZCLI) to manage data streams from the command line. This article covers `zcli datastream` commands, with syntax and examples for each operation. A data stream is a pipeline that exports one type of platform data (application logs, events, or metrics) from Edge Infrastructure Services to a connected integration, such as Splunk or an OpenTelemetry collector. ZCLI calls the integration a **plugin**.

This page is the command reference. To set up the integration that a data stream sends data to, see [Splunk Integration](https://zededa.mintlify.site/new-ui/infrastructure-services/integrations-and-automation/splunk-integration.md) or [OpenTelemetry Integration](https://zededa.mintlify.site/new-ui/infrastructure-services/integrations-and-automation/opentelemetry-integration.md). For the console view of data streams, see [Enterprise Settings](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/enterprise-settings.md).

## Before You Start

* ZCLI is installed and authenticated against your enterprise. See [Get Started](https://zededa.mintlify.site/zcli-reference/get-started.md).
* You have the SysAdmin role in your enterprise. See [Manage Roles](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-roles.md).
* The integration (plugin) that the data stream sends data to already exists, and you know its ID. See [Find the plugin ID](#find-the-plugin-id).

## Create a Data Stream

### Find the plugin ID

`--plugin` takes the plugin **ID**, not its name. ZCLI sends the value exactly as you type it and does not check it. To find the ID, list your plugins, and then show the plugin that you want with `--detail`. The ID is in the `Plugin ID` line.

1. List your plugins:

   ```text theme={"dark"}
   zcli plugin show
   ```

2. Show the plugin that you want with `--detail`:

   ```text theme={"dark"}
   zcli plugin show MY_PLUGIN --detail
   ```

### Create a data stream

Create a data stream that sends one source type to one plugin.

```text theme={"dark"}
zcli datastream create <name> --plugin=<plugin-id> --source=<stype> [--enabled=<bool>]  [--title=<title>] [--description=<description>]
```

| Flag | Description |
| - | - |
| `--plugin` | Required. ID of the plugin (integration) that receives the data. |
| `--source` | Required. Type of data to export: `app-logs`, `events`, or `metrics`. The value is case-sensitive. |
| `--enabled` | `true` starts the stream immediately. `false` creates it paused. See [Values for the enabled flag](#values-for-the-enabled-flag). If you omit it, ZCLI does not send an enabled state, and Edge Infrastructure Services applies its default. Pass `--enabled=true` to be sure that the stream starts. |
| `--title` | Display title of the data stream. If you omit it, ZCLI uses the data stream name. |
| `--description` | Description of the data stream. |

To export more than one source type, create one data stream for each type.

Example: send events to a plugin and start the stream immediately:

```text theme={"dark"}
zcli datastream create MY_EVENTS_STREAM --plugin=MY_PLUGIN_ID --source=events --enabled=true --description="Events to Splunk"
```

On success, ZCLI prints nothing. To confirm the result, run `zcli datastream show MY_EVENTS_STREAM --detail`.

> [!NOTE]
>
> The example in `zcli datastream --help` (`zcli datastream create events_stream --source=events --enabled=true`) leaves out the required `--plugin` flag. If you run it as written, ZCLI prints the usage text and creates nothing.

> [!WARNING]
>
> ZCLI does not validate `--source` before it uses it. A value other than `app-logs`, `events`, or `metrics`, such as `logs` or `Events`, stops the command with an `Unexpected error executing command 'datastream'` message that names `KeyError` and the invalid value. No data stream is created.

### Values for the enabled flag

`--enabled` accepts the following values. They are not case-sensitive.

| To enable the stream | To pause the stream |
| - | - |
| `true`, `t`, `yes`, `y`, `on`, `1` | `false`, `f`, `no`, `n`, `off`, `0` |

Any other value, such as `enable` or `disabled`, stops ZCLI with a Python `ValueError` traceback. No change is made.

## View Data Streams

### View a single data stream

Show one data stream by name or UUID. Add `--detail` to see all of its fields.

```text theme={"dark"}
zcli datastream show [[[<name> | --uuid=<uuid>] --detail] | [--source=<stype> ] | [--name-pattern=<name-pattern>]]
```

Example:

```text theme={"dark"}
zcli datastream show MY_EVENTS_STREAM --detail
```

The `--detail` output includes the data stream's ID, title, description, source type (`APP_LOGS`, `EVENTS`, or `METRICS`), enabled state, plugin ID, and creation and update history.

> [!NOTE]
>
> Without `--detail`, the `DataStream Title` line of the output is always empty because of an error in the ZCLI output template. Use `--detail` to see the title.

### List data streams

Run `zcli datastream show` without a name to list all data streams. The list shows each stream's name, title, source type, and enabled state. It does not show the plugin. Use the following flags to filter the list. You can use only one filter at a time.

| Flag | Description |
| - | - |
| `--name-pattern` | Show only data streams whose name contains this substring. |
| `--source` | Show only data streams of this source type. ZCLI sends the value exactly as you type it and does not check it. |

To list all data streams:

```text theme={"dark"}
zcli datastream show
```

To list data streams whose name contains `EVENTS`:

```text theme={"dark"}
zcli datastream show --name-pattern=EVENTS
```

To list data streams of the metrics source type:

```text theme={"dark"}
zcli datastream show --source=metrics
```

## Update a Data Stream

Change a data stream's plugin, enabled state, title, or description. You cannot change the source type. To export a different source type, create a new data stream.

```text theme={"dark"}
zcli datastream update <name> [--plugin=<plugin-id>] [--enabled=<bool>]  [--title=<title>] [--description=<description>]
```

ZCLI reads the current data stream, changes only the fields that you pass, and sends the result back. Fields that you do not pass keep their current values. If you pass no options, ZCLI prints `Nothing to update` and makes no change.

### Pause or resume a data stream

To stop forwarding data without deleting the stream, set `--enabled=false`. To resume, set `--enabled=true`.

To pause a data stream:

```text theme={"dark"}
zcli datastream update MY_EVENTS_STREAM --enabled=false
```

To resume a data stream:

```text theme={"dark"}
zcli datastream update MY_EVENTS_STREAM --enabled=true
```

### Send a data stream to a different plugin

```text theme={"dark"}
zcli datastream update MY_EVENTS_STREAM --plugin=MY_OTHER_PLUGIN_ID
```

## Delete a Data Stream

Delete a data stream by name. ZCLI asks `Delete datastream <name>? [Y/N]` unless you pass `-f`. If you answer no, ZCLI prints `Datastream <name> not deleted.`

```text theme={"dark"}
zcli datastream delete <name> [-f]
```

Example:

```text theme={"dark"}
zcli datastream delete MY_EVENTS_STREAM -f
```

To stop exporting data temporarily, pause the stream instead. See [Pause or resume a data stream](#pause-or-resume-a-data-stream).

## Next Steps

> [card] [Splunk Integration](https://zededa.mintlify.site/new-ui/infrastructure-services/integrations-and-automation/splunk-integration.md)
>
> Connect Edge Infrastructure Services to a Splunk HTTP Event Collector.

> [card] [OpenTelemetry Integration](https://zededa.mintlify.site/new-ui/infrastructure-services/integrations-and-automation/opentelemetry-integration.md)
>
> Connect Edge Infrastructure Services to an OpenTelemetry collector.

> [card] [View Events](https://zededa.mintlify.site/zcli-reference/events.md)
>
> Show events from your edge nodes and the log of user actions.

> [card] [Overview](https://zededa.mintlify.site/zcli-reference/overview.md)
>
> All ZCLI command procedures, organized by resource type.