Skip to main content

Configure Your First Target

What is a Target?​

A Target defines where your processed data goes after DataStream transforms it. Common target types include:

  • File - Saves data to JSON, Avro, Parquet, or MultiJSON file formats
  • Microsoft Sentinel - Sends security data to Microsoft's cloud SIEM platform
  • Azure Blob Storage - Archives data for long-term retention and compliance
  • Azure Data Explorer - Enables real-time analytics and dashboard creation

For this guide, we create a File Target because it is simple to verify and understand.

Create Your File Target​

  1. Navigate to Targets

    • From the sidebar: Fleet Management > Targets
    • Click the File card

  2. Start Target Creation

    • Click Add new File target
    • The target creation form opens with three tabs

  3. Configure General Settings (First Tab)

    • Name: "My First File Target"
    • Description (Optional): "Learning file output for getting started"
    • Target Status: Ensure toggle is set to Enabled
    • Post-processing pipeline (Optional): Leave blank for now
    • Click Next Step

  4. Configure File Properties (Second Tab)

    • Location: Enter a directory path where you want files saved:
      • Linux/macOS: /opt/datastream/output or /home/username/datastream
      • Windows: C:\DataStream\Output or D:\Logs\DataStream
    note

    This path refers to a directory on your Director host, not your local machine. Verify the directory exists on the server where your Director is installed.

    • File name: logs-{{.Year}}_{{.Month}}_{{.Day}}.json
    • Type: JSON (default)
    • Field Format (Optional): Leave as default
    • Leave other fields at their defaults
    • Click Next Step
caution

Ensure the directory you specify in Location exists and DataStream has write permissions. Create the directory beforehand if it doesn't exist.

  1. Skip Execution Settings (Third Tab)
    • Leave all defaults (scheduling and debugging settings)
    • Click Add target

Understanding File Naming​

The file name template logs-{{.Year}}_{{.Month}}_{{.Day}}.json uses dynamic fields:

  • {{.Year}} - Current year (e.g., 2026)
  • {{.Month}} - Current month (e.g., 01, 02, 12)
  • {{.Day}} - Current day (e.g., 01, 15, 31)

This pattern automatically rotates files daily, making them easier to manage and archive.

Verify Your Target​

Your target should now appear in the File targets table with:

  • Status: Enabled
  • Location: Your specified directory path
  • Type: JSON

File Format Options​

The File target supports four output formats:

  • JSON (default) - One record per file, widely supported
  • MultiJSON - Multiple records per file, efficient for high-volume data
  • Avro - Binary format with embedded schema, supports compression
  • Parquet - Columnar format, optimized for analytics and compression
note

Compression options (zstd, snappy, gzip) are available only for Avro and Parquet formats.

For detailed configuration of all target types, see Target Configuration Guide.

What's Next?​

Your target is ready to receive processed data. Now we need to install processing logic that will transform your raw data into a useful format.

Next: Install Content from Content Hub to add pre-built data processing pipelines.