How Edge works

The Edge runtime model

Edge receives telemetry, evaluates policies, applies the resulting action, and forwards the remaining telemetry to the configured upstream.

Each policy evaluates against the original telemetry, not the output of earlier policies. Matching policies contribute actions, and Edge resolves the final keep and transform result.

Policies

A policy is an atomic rule: it matches telemetry and declares what should happen when the match succeeds.

id: drop-debug-logs
name: Drop debug logs
log:
  match:
    - log_field: severity_text
      regex: "^(DEBUG|TRACE)$"
  keep: none

Atomic policies make runtime behavior easier to reason about. A policy should express one intent, such as dropping successful health checks or redacting a payment field. Adding one policy should not require understanding a hidden chain of earlier processors.

Matching

Matchers select telemetry. A policy can match log fields, log attributes, resource attributes, metric fields, datapoint attributes, and other supported telemetry fields depending on the policy type.

Policies can use exact matches, regular expressions, field existence checks, and negation. For exact syntax, use the policy reference:

• Log filter
• Log transform
• Metric filter

Keep and transform

When a policy matches, it can affect two stages.

The keep stage decides whether matching telemetry continues through Edge. A policy can keep telemetry, drop it, sample it, or rate-limit it.

The transform stage changes telemetry that survives the keep stage. Supported log transforms include removing fields, redacting values, renaming fields, and adding fields.

When multiple policies match the same telemetry, Edge resolves the most restrictive keep action and applies matching transforms in a stable order.

Policy sources

Edge loads policies from configured policy providers. Use a file provider for development and static deployments. Use a remote provider when Tero or another control plane manages policy state.

When multiple providers emit policies, policy IDs identify the policy. Provider priority controls which source wins when two sources emit the same ID.

Failure model

Edge fails open. If it cannot evaluate a policy, it forwards the telemetry instead of blocking it.

Fail-open behavior protects observability availability. It also means policy errors need monitoring. Use Operations for runtime logging, health checks, and operational guidance.

Where to go next

Use Quickstart to run Edge locally. Use Architecture for the implementation model. Use Config for configuration fields.