Skip to main content
Immediate Reversible Configure exclusion filters and routing rules directly in your observability provider. No deployment required. Tero uses the provider’s API to apply changes.
Use this when you don’t have Edge deployed or want to configure provider-specific features like index routing.

​
How it works

Tero connects to your provider’s API and configures filters, pipelines, or routing rules. The provider applies these rules as data arrives. You don’t deploy anything—Tero manages the configuration remotely.
Enforce in provider with Datadog
Tero configures exclusion filters and pipelines via the Datadog API.

​
Setup

Connect your provider with write access:

Datadog

Connect with Standard role or custom role with write permissions.

Splunk

Connect with admin access to configure indexes and transforms.

​
Example

Tero identifies that checkout-api is emitting 2.3 million health check logs per day. The logs have never been queried and don’t appear in any dashboard or alert. You approve the rule and select “Enforce in provider.” Tero configures an exclusion filter in Datadog: 
Filter name: tero-drop-health-checks-checkout-api
Query: service:checkout-api http.target:/health* http.status_code:200
The filter takes effect within minutes. Matching logs stop being indexed. You still see them in Live Tail (they reach Datadog), but they don’t count against your indexed volume. Your data quality dashboard updates as Datadog reports the change. If something goes wrong, disable the rule and Tero removes the exclusion filter. Logs index normally again.

​
When to use

Enforce in provider works best when:
  • You don’t have Edge deployed and want quick wins
  • You need provider-specific features like index routing
  • Egress costs aren’t a concern
  • You want to start immediately without deploying infrastructure
If you need maximum control, egress savings, or sub-millisecond latency, use Enforce at edge instead.