Skip to main content
Next sync Reversible Drop, sample, or transform telemetry before it leaves your infrastructure, without changing application code or provider configuration.
This is the most common enforcement method. Most policy categories recommend it.

​
How it works

Tero Edge runs in your infrastructure as a proxy. It syncs with the Tero control plane on a fixed interval to fetch policies and applies them to matching telemetry as it passes through.

​
Setup

Deploy the proxy alongside your existing telemetry pipeline:

Datadog

Deploy alongside the Datadog Agent on Kubernetes.

OpenTelemetry Collector

Deploy alongside the OTel Collector.

​
Example

Tero identifies that checkout-api is emitting 2.3 million health check logs per day. Kubernetes probes hit /health every 10 seconds on every pod. Query history shows no recent searches for those logs, and they don’t appear in any dashboard or alert. You approve the policy and select “Enforce at edge.” The policy:
On the next policy sync, Edge begins dropping logs that match: requests to checkout-api on health check paths with status code 200. Failed health checks (non-200) still flow through since those have debugging value. In your data quality dashboard, the checkout-api health check volume drops after Edge reports filtered telemetry. If something goes wrong, disable the policy and Edge removes it on the next sync. Logs flow normally again.

​
When to use

Enforce at edge works best when:
  • You want impact on the next Edge sync without code changes
  • The waste is infrastructure noise (health checks, bot traffic, tool metadata)
  • You need to reduce costs while planning a permanent fix
  • You want a temporary block you can revert on a later sync