Quick start

Start with an offline replay to inspect the path from observations through rules and redaction to a local event file. This does not validate a network interface or TLS probe.

CLI not installed yet?

Get the full package from downloads, follow install and upgrade, then use the installation wizard. Already configured and ready for a real application? Continue with the setup workflow.

Prepare

Use the installed Linux CLI; see install and upgrade. Root is not required for this demo. Use a fresh directory and keep its WAL and output separate from a live service.

netflowscout version
mkdir -p nfs-demo/examples
cd nfs-demo

Download these three files into the new examples/ directory:

• netflowscout.json: uses installed plugins, disables Dataway, and writes under ../var/.
• rules.nfs: HTTP error, database error rate, and analysis anomaly rules.
• observations.ndjson: three synthetic HTTP observations.

Or download them from your new nfs-demo directory. These commands fetch data and configuration only; they do not execute a remote script:

curl -fSL https://netflowscout.pages.dev/examples/netflowscout.json -o examples/netflowscout.json
curl -fSL https://netflowscout.pages.dev/examples/rules.nfs -o examples/rules.nfs
curl -fSL https://netflowscout.pages.dev/examples/observations.ndjson -o examples/observations.ndjson

Relative configuration paths resolve from the configuration file's directory, not the terminal's working directory.

Validate and replay

netflowscout check --config examples/netflowscout.json
netflowscout replay --config examples/netflowscout.json \
  --input examples/observations.ndjson
cat var/events.ndjson

The first run in a fresh directory should produce two http.server_error events. The second input is suppressed by the service's 10-second cooldown. Response content is [REDACTED]. Events include a stable event_id, rule identity, and time.

Check var/events.ndjson: expect two JSON lines named http.server_error with distinct event_id values. If there is no output, check that all three sample files are in the same examples/ directory, then run check and read its diagnostic. For a missing-plugin error, verify the full candidate package is installed and the plugin path is correct.

Replaying again appends new events with new IDs. Replay does not deduplicate input; a stable ID identifies retries of the same committed event.

Try rules without delivery

netflowscout rules test --config examples/netflowscout.json \
  --input examples/observations.ndjson --format ndjson --preview 10

This reports compilation digests, decision counts, and redacted previews without creating a persistent queue or contacting a sink. Use --compare-rules ./candidate.nfs to compare a candidate rule file.

Connect live traffic

Choose network capture or endpoint TLS plaintext, then verify the setup with actual business traffic and delivery evidence. A running process or an empty queue alone does not establish end-to-end success.