Glossary
A glossary of common terms used in this documentation.
Account
Account
Refers to a user account in Stroom’s internal Identity Provider. An Account holds the credentials a person authenticates with, and exists only where Stroom is its own Identity Provider, unlike a User which exists in every deployment.Click to see more details...
API
API
Application Programming Interface. An interface that one system can present so other systems can use it to communicate. Stroom has a number of APIs, e.g. its many REST APIs and its Click to see more details.../datafeed interface for data receipt.
API Key
API Key
API Keys are a form of authentication token that are created within Stroom for use by Stroom-Proxy instances or other clients that want to use Stroom’s API. It is an encrypted string that contains details of the user and the expiration date of the token. Possession of a valid API Key for a user account means that you can do anything that the user can do in the user interface via the API.Click to see more details...
Application permission
Application permission
This is a permission that is not specific to a single document. It applies to all documents or is not related to documents in any way.Click to see more details...
Byte order mark
Byte order mark
A special Unicode character at the start of a text stream that indicates the byte order (or endianness) of the stream.Click to see more details...
Character encoding
Character encoding
Character Encoding is the means of encoding character data (i.e. text) into binary form. Therefore to decode character data from a stream of bytes, the character encoding must be known (or guessed).Click to see more details...
Condition
Condition
A Condition in an query expression term, e.g. Click to see more details...=, >, in, etc.
Content
Content
Content in Stroom typically means the user created documents/entities created in Stroom and as seen in the explorer tree. Content can be created/modified by Stroom users and imported/exported for sharing between different Stroom instances.Click to see more details...
Context data
Context data
This is an additional stream of contextual data that is sent along side the main event stream. It provides a means for the sending system to send additional data that relates only to the event stream it is sent alongside.Click to see more details...
Coordinated Universal Time (UTC)
Coordinated Universal Time (UTC)
Coordinated Universal Time (UTC), also known as Zulu time, is the international standard by which the world regulates clocks and time. It is essentially a successor to Greenwich Mean Time (GMT). UTC has the time zone offset of Click to see more details...+00:00 and does not change for daylight saving. All international time zones are relative to UTC.
Cron
Cron
Cron is a command line utility found on most linux/unix systems that is used for scheduling background tasks. Cron expressions (or variants of them) are widely used in other schedulers.Click to see more details...
CSV
CSV
Comma Separated Values is a file format with typically one record per line and fields delimited by a Click to see more details...,. Fields may be optionally enclosed with double quotes, though there is no fixed standard for CSV data, particularly when it comes to escaping of double quotes and/or commas.
Dashboard
Dashboard
A Dashboard is a configurable entity for querying one or more Data Sources and displaying the results as a table, a visualisation or some other form.Click to see more details...
Data source
Data source
The source of data for a Query, e.g. a Lucene based Index, a SQL Statistics Data source, etc.Click to see more details...
Data splitter
Data splitter
Data Splitter is a pipeline element for converting text data (e.g. CSV, fixed width, delimited, multi-line) into XML for onward processing.Click to see more details...
Dictionary
Dictionary
A entity for storing static content, e.g. lists of terms for use in a query with the Click to see more details...in dictionary condition. They can also be used to hold arbitrary text for use in XSLT with the dictionary function.
Doc Ref
Doc Ref
A Doc Ref (or Document Reference) is an identifier used to identify most documents/entities in Stroom, e.g. an XSLT will have a Doc Ref.Click to see more details...
Document
Document
Typically refers to an item that can be created in the Explorer Tree, e.g. a Feed, a Pipeline, a Dashboard, etc. May also be known as an Entity.Click to see more details...
Document permission
Document permission
Document permissions control the access that users and/or groups have to a Document.Click to see more details...
Elasticsearch
Elasticsearch
Elasticsearch is an Open Source and commercial search index product. Stroom can be connected to one or more Elasticsearch clusters so that event indexing and search is handled by Elasticsearch rather than internally.Click to see more details...
ELFF
ELFF
The Extended Log File Format. A W3C standard format for log files produced by web servers.Click to see more details...
Entity
Entity
Typically refers to an item that can be created in the Explorer Tree, e.g. a Feed, a Pipeline, a Dashboard, etc. May also be known as a Document.Click to see more details...
Event
Event
An event is a single auditable event, e.g. a user logging in to a system. A Stream typically contains multiple events.Click to see more details...
Events
Events
This is a Stream Type in Stroom. An Events stream consists of processed/cooked data that has been demarcated into individual Events.Click to see more details...
Explorer tree
Explorer tree
The left hand navigation tree. The Explorer Tree is used for finding, opening, creating, renaming, copying, moving and deleting Documents.Click to see more details...
Expression tree
Expression tree
A tree of expression terms that each evaluate to a boolean (True/False) value. Terms can be grouped together within an expression operator (AND, OR, NOT).Click to see more details...
Feed
Feed
A Feed is a means of organising and categorising data in Stroom. A Feed contains multiple Streams of data that have been ingested into Stroom or output by a Pipeline. Typically a Feed will contain Streams of data that are all from one system and have a common data format.Click to see more details...
Field
Field
A named data Field within some form of record or entity, and where each Field can have an associated value. In Stroom, Fields can be the Fields in an Index (or other queryable Data Source or the fields of Metadata associated with a Stream, e.g. Stream ID, Feed, creation time, etc.Click to see more details...
Filter
Filter
A Filter may refer to a Processor Filter or a Filter Element in a Pipeline.Click to see more details...
Fully Qualified Domain Name (FQDN)
Fully Qualified Domain Name (FQDN)
The Fully Qualified Domain Name (FQDN) is the complete, unambiguous address of a device or service on the internet, specifying all domain levels including the hostname, domain name, and top-level domain. For example Click to see more details...server57.some.domain.com.
Git
Git
Git is a free and open source distributed version control system. It is used for controlling, organizing, and tracking different versions in history of computer files, typically text files but also any other type of file. It allows all changes made to a file to be viewed and tracked over time and for branching/merging of the repository for separate strands of work.Click to see more details...
Group (users)
Group (users)
A named group of users to which application and document permissions can be assigned. Users can belong to multiple groups. A Group can belong to multiple groups. Groups allow permissions to be assigned to the group such that members of that group inherit those permissions.Click to see more details...
Identity Provider (IDP)
Identity Provider (IDP)
An Identity Provider is a system or service that can authenticate a user and assert their identity. Identity providers can support single sign on (SSO), which allows the user to sign in once to the Identity Provider so they are then authenticated to all systems using that IDP.Click to see more details...
Index
Index
A Data Source that is backed by a Lucene based search index.Click to see more details...
IP address
IP address
The Internet Protocol (IP) address, e.g. Click to see more details...192.168.0.1. Typically an IP address is assumed to be an IPv4 address.
ISO 8601
ISO 8601
This is an international standard for representing dates, times and durations. By default Stroom displays date/times in ISO 8601.Click to see more details...
JAR
JAR
Java Archive is a file format for distributing Java class files, associated metadata and resource files. It is a compressed archive based on the {{< glossary “ZIP” >}} format, so can be inspected with any tool capable of reading a ZIP file. Stroom and Stroom-Proxy are distributed as JAR files.Click to see more details...
JSON
JSON
JavaScript Object Notation is a file/data format for storing/transmitting structured data. It has similarities to XML, is less verbose, but is more simplistic. Stroom accepts data in JSON format and can output to JSON.Click to see more details...
Markdown
Markdown
Markdown is a simple markup language for creating rich formatted text using a text editor. Due to the simplicity of the Markdown it is still very readable in its raw form that contains the markup. Markdown is used in Stroom on the Documentation tab of each Document type and in the Documentation Document type.Click to see more details...
Metadata
Metadata
Metadata refers to the data that describes the Stream data. It is sometimes referred to as just Meta.Click to see more details...
Namespace
Namespace
In Stroom Namespace typically refers to an XML Namespace. Namespaces are used in XML to distinguish different elements, e.g. where an XSLT is transforming XML in the Click to see more details...records:2 Namespace into XML in the event-logging:3 Namespace.
Parser
Parser
A Parser is a Pipeline element for parsing Raw Events into a structured form. For example the Data Splitter Parser that parses text data into Records and Fields.Click to see more details...
Pipeline
Pipeline
A Pipeline is an entity that is constructed to take a single input of stream data and process/transform it with one or more outputs. A Pipeline can have many elements within it to read, process or transform the data flowing through it.Click to see more details...
Pipeline element
Pipeline element
An element within a Pipeline that performs some action on the data flowing through it.Click to see more details...
Processor
Processor
A Processor belongs to a Pipeline. It controls the processing of data through its parent Pipeline using one or more Processor Filters.Click to see more details...
Processor filter
Processor filter
A Processor Filter is used to used to find Streams to process through the Pipeline associated with the Processor Filter. A Processor Filter consists of an expression tree to select which Streams to process and a tracker to track the what Streams have been processed.Click to see more details...
Property
Property
A configuration Property for configuring Stroom. Properties can be set in the user interface or via the Click to see more details...config.yml configuration file.
Query
Query
The search Query in a Dashboard that selects the data to display. The Query is constructed using an Expression Tree of terms.Click to see more details...
Raw Events
Raw Events
This is a Stream Type used for Streams received by Stroom. Streams received by Stroom will be in a variety of text formats (CSV, delimited, fixed width, XML, JSON, etc.). Until they have been processed by a pipeline they are essentially just unstructured character data with no concept of what is a record/event. A Parser in a pipeline is required to provide the demarcation between records/events.Click to see more details...
Re-processing
Re-processing
The act of repeating the processing of a set of input data (Stream) that have already been processed at least once. Re-Processing can be done for an individual Stream or multiple Streams using a Processor Filter.Click to see more details...
Records
Records
This is a Stream Type for Streams containing data conforming to the Click to see more details...records:2 XML Schema. It also refers more generally to any XML conforming to the records:2 XML Schema which is used in a number of places in Stroom, including as the output format for the DSParser and input for the IndexingFilter.
REST
REST
REST (Representational State Transfer) is essentially an architectural style that dictates how data should be handled and “transferred” across a network. REST APIs typically use JSON to send data between the client and the server, and the HTTP methods GET, PUT, PATCH, POST and DELETE.Click to see more details...
Search extraction
Search extraction
The process of extracting un-indexed Field values from the source Event to be used in search results.Click to see more details...
Searchable
Searchable
A Searchable is the term given the special searchable data sources that appear at the root of the explorer tree picker when selecting a data source. These data sources are special internal data sources that are not user managed content, unlike an Index. They provide the means to search various aspects of Stroom’s internals, such as the Meta Store or Processor Tasks.Click to see more details...
SQL
SQL
Structured Query Language (SQL). The language used in the MySQL database to query and manipulate the data.Click to see more details...
Stepper
Stepper
The Stepper is a tool in Stroom for developing and debugging a Pipeline. It allows the user to simulate passing a Stream through a pipeline with the ability to step from one record/event to the next or to jump to records/events based on filter criteria.Click to see more details...
Stream
Stream
A Stream is the unit of data that Stroom works with and will typically contain many Events.Click to see more details...
Stream Type
Stream Type
All Streams must have a Stream Type. The list of Stream Types is configured using the Property Click to see more details...stroom.data.meta.metaTypes.
StroomQl
StroomQl
Stroom Query Language is Stroom’s own query language. It has similarities with Structured Query Language (SQL) as used in databases. StroomQL is sometimes referred to as sQL to distinguish it from SQL.Click to see more details...
Table
Table
A Table is the tabular part of a Dashboard or Query that contains the data.Click to see more details...
Token
Token
Typically refers to an authentication token that may be used for user authentication. A Stroom API Key is a form of authentication token.Click to see more details...
Tracker
Tracker
A Tracker is associated with a Processor Filter and keeps track of the Stream that the Processor Filter has already processed.Click to see more details...
Transport Sayer Security (TLS)
Transport Sayer Security (TLS)
Transport Sayer Security (TLS) is the evolution of Secure Sockets Layer (SSL) and refers to the encryption of traffic between client and server.Click to see more details...
Unix Epoch
Unix Epoch
The Unix epoch is 00:00:00 UTC on 1st January 1970. Some timestamps in Stroom are represented as the number of milliseconds since the Unix epoch, e.g. Click to see more details...1738331628276, and may be referred to as epoch ms or epoch milliseconds.
User
User
Refers to a Stroom User that is linked to either an Account in Stroom’s internal Identity Provider or a user account in an external Identity Provider. A Stroom User is primarily concerned with authorisation (i.e. application/document permissions and group memberships) rather than authentication, though disabling one also refuses that person at authentication and ends any access they currently hold.Click to see more details...
UUID
UUID
A Universally Unique Identifier for uniquely identifying something. UUIDs are used as the identifier in Doc Refs. An example of a UUID is Click to see more details...4ffeb895-53c9-40d6-bf33-3ef025401ad3.
Visualisation
Visualisation
A document comprising some Javascript code for visualising data, e.g. pie charts, heat maps, line graphs etc. Visualisations are not baked into Stroom, they are content, so can be created/modified/shared by Stroom users.Click to see more details...
Volume
Volume
In Stroom a Volume is a logical storage area that Stroom can write data to. Volumes are associated with a path on a file system that can either be local to the Stroom node or on a shared file system.Click to see more details...
Volume group
Volume group
A Volume Group is a collection of one or more Index Volumes. Index volumes must belong to a volume group and Indexes are configured to write to a particular Volume Group.Click to see more details...
XML
XML
Extensible Markup Language is a markup language for storing/transmitting structured data. It is the working format for most Pipeline processing in Stroom and is the standard normalised format for event data.Click to see more details...
XML Schema
XML Schema
XML Schema is a language used to define the permitted structure of an XML document. An XML Schema can be used to validate an XML document to ensure it conforms to that schema such that onward processing of the XML document can be done with confidence that the document is correct.Click to see more details...
XPath
XPath
XPath is an expression language for selecting a node or nodes in an XML document. It is used heavily in XSLT to define the match criteria for templates and to select values.Click to see more details...
XSLT
XSLT
Extensible Stylesheet Language Transformations is a language for transforming XML documents into other XML documents. XSLTs are the primary means of transforming data in Stroom.Click to see more details...
YAML
YAML
YAML Ain’t Markup Language. A human readable data format often used for configuration files. YAML is used in stroom for various things, e.g. Stroom & Stroom Proxy’s main configuration file, Content Store definition files. YAML files will typically have the file extension Click to see more details....yaml or .yml.
ZIP
ZIP
A compressed file format for storing a one or more files with an associated directory structure. Stroom and Stroom Proxy use the ZIP format for exporting content and data as well as its Proxy ZIP format for holding multiple streams of data with associated meta data.Click to see more details...
Last modified October 20, 2026: Merge pull request #144 from gchq/add-7.14-rel-notes (2c6fb22)