Capture live samples

Live capture taps a route on a running collector and shows you the real records flowing through it right now. Save a bounded sample and you can reuse it to test pipelines against real telemetry instead of hand-typed input. The loop it unlocks: capture once, iterate on your processing repeatedly against the same real data.

Capture needs an otelcol collector with a co-located agent

Two things have to be true for capture to be available on a route:

• The collector runs otelcol (OpAMP). Capture is not supported on Grafana Alloy (remotecfg) collectors — the tap is injected into the otelcol pipeline, which Alloy doesn’t run.
• A co-located agent is connected. The agent is the capture sink: it receives the tapped records, redacts them, and returns the bounded batch. On an otelcol collector without one, the Capture action becomes an “enrol an agent” prompt. See Install the agent.

How capture works

When you start a capture, LinkMesh temporarily tees a copy of the route’s records to the co-located agent. The agent redacts each record and returns a bounded batch — it stops at whichever limit you hit first: a maximum number of events or a maximum duration. The tap reverts automatically when the capture ends. Your live pipeline is never modified — capture is read-only observation of real traffic.

You can tap at two points on the route:

• Pre-process — records as the route accepts them, before its pipeline’s processors run. This is the raw input your processors will see.
• Post-process — records after the route’s pipeline has run. This is what actually leaves for the destinations.

Capturing both at once lets you compare a record before and after processing.

Capture events on a route

1. Open the collector’s Routing tab and find the route you want to observe. Click its Capture action.

2. Choose the tap point — Pre-process, Post-process, or both. Optionally add a filter to narrow what you capture, and set the bounds (max events and max seconds).

3. Click Start capture. Matching events stream into the live table as they arrive; expand any row to see the full record. Stop early whenever you have what you need — otherwise the capture ends on its own when it hits a bound.

4. Click Save as sample on a capture to keep it. Give it a name — saved captures go to the Sample Library.

Screenshot pendingroutes/capture-panel

The Capture panel on a route: tap point, filter and bounds up top; captured events stream into the live table below.

Capture on a group route

A route can be scoped to a single collector or to a whole collector group. When you capture on a group-scoped route, LinkMesh taps one member, not all of them — a capture is a look at real records flowing through the route, and one member’s stream is a representative sample of that.

• By default the tap lands on the first member (in group order), so starting a capture on a group route Just Works with no extra choice.
• You can target a specific member instead — for example to observe the host you think is misbehaving. The member has to belong to the group.
• Only members that currently have a connected agent are eligible to tap (capture needs the agent sink). A member without one can’t be the capture target.

Everything else — tap points, filter, bounds, redaction, saving to the library — works exactly as it does for a single-collector route.

Manage samples in the Sample Library

The Sample Library (Data & Routing → Sample Library) lists every capture — both saved and still-ephemeral. From here you can:

• View a sample’s records,
• Save an ephemeral capture (name it to keep it),
• Rename a saved sample, or
• Delete one you no longer need.

Ephemeral captures expire automatically after a short retention window (about 30 minutes by default), so they never pile up. A saved sample is kept until you delete it.

Screenshot pendingsamples/library

The Sample Library — captured samples with their route, tap point, signal, size and age. Save, rename, view or delete from here.

Dry-run a pipeline against a sample

This is the payoff. In the pipeline editor’s Sample Data panel, click Choose captured sample and pick one from the library. LinkMesh loads a representative record into the dry-run input — for a multi-event sample, step through the records with the 1 / N control — so you can dry-run your processor chain against real captured telemetry and see the before/after at each step.

Tip

Capturing a Pre-process sample gives you the exact input your pipeline receives, which is the most faithful thing to dry-run against while you build and refine the chain.

Permissions

Capture splits into two permissions so you can let people run captures without exposing raw customer payloads:

• capture:run — start and stop captures, list sessions, and save, rename or delete samples.
• capture:read — view the raw event payloads (the live table and a sample’s records). Without it you can still run captures and save them, but the payloads stay hidden.

See Manage users, roles, and permissions.

Further reading

• Debugging telemetry pipelines with live capture — the workflow behind this feature: tap a live route, capture a bounded sample, and dry-run pipeline changes against real records before you ship them.