Glossary

What you will do: look up a term you met in the console, in dock or in these pages.

Platform and products

• XPLG — the platform: one self-contained Java process (or a cluster of them) holding the web UI, ingestion, indexing, the AI engine, forwarding, storage and access control, with no external database.
• PortX — the telemetry control layer: listeners, parsing, enrichment, filtering, routing and forwarding; also the administration space of the console (sources, retention, users, Log Viewer, Log Monitor).
• PortX Protect — masking, tokenization or encryption of sensitive fields at ingestion, before indexing or forwarding.
• XpoLog — the indexed telemetry home: search, dashboards, Apps, monitors and alerting, Log Viewer.
• LogX — the AI layer on indexed data: anomaly detection, correlation, pattern analysis, predictive insight; models and assistants scoped per edition.
• Flux — data movement and synchronization: a grid of Flux agents moving any data type between sites, clouds and buckets, with checksums and metrics.
• Audity — identity-centred audit evidence; the fifth product of the current generation.
• V7 / X8 — the two generations: the installer-based server (7.98xx builds) and the Compose stack (8.2.0-Main).

Collecting

• Listener — a push endpoint XPLG opens (syslog UDP / TCP, HTTP/S with a token, Kafka, NetFlow, SAP); configured as a listener account under PortX > Data > Listeners.
• Address Book — the saved credentials and endpoints XPLG uses for pull sources (SSH, Windows, S3, JDBC, cloud and SaaS plugins).
• Pull source — data XPLG reads on a schedule (files, UNC, SSH, Windows Events, S3, JDBC, Remote XPLG, plugins). Push source — data that arrives on a listener as it happens.
• Fluent Bit — the recommended open-source shipper for hosts and clusters, sending to an HTTP/S or syslog listener.
• Agent Mode — a thin XPLG instance that collects and forwards but stores nothing (a listener node, for example); usually on a more limited license.
• Folders and Logs — the tree where every collected log lands.
• AppTag — a label that groups logs into an application for search, dashboards and monitoring.
• Collection Policy — per-log schedule, hot storage path, retention, archive (local or S3) and checksum settings.
• Pattern / ftype — the parsing definition of a log (fields and their types); learned by the AI parser or defined by hand.
• Handlers and mappings — edge parsing and enrichment rules applied by PortX before routing.

Processing and delivering

• Forwarder — a PortX output to HTTP/S, Kafka, file, syslog, another XPLG instance or a socket, with statuses PENDING / STREAMING / SCHEDULED / DISABLED / SUSPENDED and a Replay to re-send a time frame.
• Flow — the filter and transform steps of a forwarder (JSON, CSV, CEF, LEEF, delimited, raw, masking, replace).
• Monitor — a saved search run on a schedule with a risk level, fanning out to email, SNMP, JMS, script, REST, Slack, Teams, PagerDuty, syslog or Kafka.
• Analytics — automatic problem detection: predefined and auto-detected semantic errors and statistical anomalies, re-run every five minutes.
• TRIX — the correlation operator that builds transactions over related event flows in Search.
• System Health — the self-monitoring console with per-section thresholds and alerts (also called the System Status console).
• Support Portal — the administrators' built-in diagnostics console (system logs, activity, data stores), not the public support site.

Running

• External configuration directory (extConf) — the folder on fast storage that holds everything XPLG knows; shared by every node of a V7 cluster; backed up daily for 30 days.
• lax file — XpoLog.sh.lax / XpoLog.lax, the JVM runtime parameters of a V7 instance.
• Publish Patch — the V7 upgrade mechanism (XPLG > System > About), applying a zip to every node in one operation.
• .env / roles / seed — the X8 deployment file, the four container roles (master, ui, listener, processor) and the seed map of servers.
• Server key — the identifier generated under PortX > Settings > License, unique per server or cluster, to which a license is bound.

dock

• Workspace / organization — your account on dock.xplg.com that owns deployments, licenses, usage and offers.
• Deployment — one XPLG server or cluster registered in the workspace; identified by the token it receives on first heartbeat.
• Heartbeat — the call a deployment makes to dock to register and report its version and usage.
• Evaluation license — the license created with the workspace and bound to the first deployment.
• Subscription license — the license issued when an offer is accepted and paid.
• XMC — the metering credits dock grants and consumes for assistant and model usage; a dock concept, not a product feature.
• Offer — a priced proposal built by XPLG or a partner and accepted in the workspace.

Next: Deploy overview

Source: XPLG wiki, pages 1594131316, 1598685202, 1595637847, 1594132976, 1627684872, 1594133710, 1718583297, 1594132938, 1594132940, 2054684673, 1594133274, 3150544899 (https://xpolog.atlassian.net/wiki/spaces/XPOL/pages/1594131316).