Capture live samples

Live capture taps a route on a running collector and shows you the real records flowing through it right now. Save a bounded sample and you can reuse it to test pipelines against real telemetry instead of hand-typed input. The loop it unlocks: capture once, iterate on your processing repeatedly against the same real data.

Capture needs a co-located agent

The agent is the capture sink — it receives the tapped records, redacts them, and returns the bounded batch. Capture is only offered on collectors that have a co-located agent connected; on a collector without one, the Capture action becomes an “enrol an agent” prompt. See Install the agent.

How capture works

When you start a capture, LinkMesh temporarily tees a copy of the route’s records to the co-located agent. The agent redacts each record and returns a bounded batch — it stops at whichever limit you hit first: a maximum number of events or a maximum duration. The tap reverts automatically when the capture ends. Your live pipeline is never modified — capture is read-only observation of real traffic.

You can tap at two points on the route:

• Pre-process — records as the route accepts them, before its pipeline’s processors run. This is the raw input your processors will see.
• Post-process — records after the route’s pipeline has run. This is what actually leaves for the destinations.

Capturing both at once lets you compare a record before and after processing.

Capture events on a route

1. Open the collector’s Routing tab and find the route you want to observe. Click its Capture action.

2. Choose the tap point — Pre-process, Post-process, or both. Optionally add a filter to narrow what you capture, and set the bounds (max events and max seconds).

3. Click Start capture. Matching events stream into the live table as they arrive; expand any row to see the full record. Stop early whenever you have what you need — otherwise the capture ends on its own when it hits a bound.

4. Click Save as sample on a capture to keep it. Give it a name — saved captures go to the Sample Library.

Screenshot pendingroutes/capture-panel

The Capture panel on a route: tap point, filter and bounds up top; captured events stream into the live table below.

Manage samples in the Sample Library

The Sample Library (Data & Routing → Sample Library) lists every capture — both saved and still-ephemeral. From here you can:

• View a sample’s records,
• Save an ephemeral capture (name it to keep it),
• Rename a saved sample, or
• Delete one you no longer need.

Ephemeral captures expire automatically after a short retention window (about 30 minutes by default), so they never pile up. A saved sample is kept until you delete it.

Screenshot pendingsamples/library

The Sample Library — captured samples with their route, tap point, signal, size and age. Save, rename, view or delete from here.

Dry-run a pipeline against a sample

This is the payoff. In the pipeline editor’s Sample Data panel, click Choose captured sample and pick one from the library. LinkMesh loads a representative record into the dry-run input — for a multi-event sample, step through the records with the 1 / N control — so you can dry-run your processor chain against real captured telemetry and see the before/after at each step.

Tip

Capturing a Pre-process sample gives you the exact input your pipeline receives, which is the most faithful thing to dry-run against while you build and refine the chain.

Permissions

Capture splits into two permissions so you can let people run captures without exposing raw customer payloads:

• capture:run — start and stop captures, list sessions, and save, rename or delete samples.
• capture:read — view the raw event payloads (the live table and a sample’s records). Without it you can still run captures and save them, but the payloads stay hidden.

See Manage users, roles, and permissions.