Ingesting Events
Events must be ingested into Workstation before analysts can view them. The event configuration defined in the Authoring application defines which events are visible in Workstation.
Ingesting Data Into Workstation
Analysts can only work with data once that data has been ingested. Unless a history is present for the event, users see only a column and option to ingest event data.
To ingest data into Workstation:
- At the top right of Cogynt Workstation's home page, click the Settings cog.
- From the left side drawer, click Data Ingestion.
- Find the event you wish to ingest. (Utilize the Search Bar and Filter By menu to narrow down the list of events.)
- Click the More menu (⋮) for the event.
- Ingest the event:
- Click Run to begin ingesting data.
- Click Stop to pause the ingestion of new data.
- Optional: Ingest historical changes for events:
- Click Enable Event History to start ingesting historical changes to the event.
- Click Disable Event History to stop ingesting event history.
- Ingest the event:
Once data is ingested, it appears on the Events Explorer widget and can be viewed.
Stopping ingestion for an event does not delete any events from Workstation. It only stops the system from receiving new events or applying updates to existing events, including any deletion signals.
Enable Event History for an event in order to utilize the Risk History and Event History views/widgets for that event.
Ingestion Status
Events on the Data Ingestion table can have any of the following Ingestion Statuses:
| Status | Color | Description |
|---|---|---|
| Stopped | Gray | This event type is not actively ingesting into Workstation from Kafka. Previously ingested events are no longer receiving updates, and no new events are being ingested. |
| Running | Green | This event type is actively being ingested into Workstation from Kafka |
| Topic Does Not Exist | Red | The Kafka topic that this event type is consumed from can no longer be found. (The Kafka topic was possibly deleted.) |
Unsupported Authoring Data Types
The following data types are either unsupported, or only partially supported:
| Data Type | Support in Workstation | Notes |
|---|---|---|
| Date Time with Timezone | Partial | These formats are ingested, displayed, and filterable as strings: Epoch Seconds, Epoch Milliseconds, Database Native |
| Date Time without Timezone | Partial | These formats are ingested, displayed, and filterable as strings: Cogynt Datetime, Cogynt Date, Database Native |
| Date Time Custom | Partial | Custom formats are ingested, displayed, and filterable as strings. |
The data types in the preceding table also include their array equivalents.