# Metadata filtering and publishing

## Metadata Filtering Options

Some customers may choose to limit metadata types that are forwarded due to use case requirements or data lake / SIEM scalability issues. Additionally, IPs, Subnets, and Sensor UIDs can also be used as exclusion filters to limit sources of metadata that are forwarded. To enable these filters edit and save in the following areas:

* *Configuration → SETUP → Stream → Metadata Types*
* *Configuration → SETUP → Stream → Vectra Stream Metadata Filtering*

![](/files/m0EWygTwT2pu6NNGOAYq)

![](/files/mo2J9Uy5DOTaZK1BEuVg)

## Destination Publisher Configuration

Stream supports Syslog (over TCP), Elastic, Raw JSON, and Kafka publishers. To configure your publisher choice, edit the *Configuration → SETUP → Stream → Destination* area. The various publisher types have differing options. The example below shows the syslog over TCP configuration:

![](/files/lwqtkjKvIIB9uMUSJaFJ)

Syslog and Kafka support the SSL protocol for secure connectivity from the Vectra Stream VM to your data lake. If SSL is selected, you will have to provide the client certificate, client key and server CA certificate.

![](/files/yrEulgl3FbxXmoP2kFjM)

## Enabling Forwarding, Stream Status, and Metadata Statistics

To enable Metadata forwarding once the configuration of your chosen publisher is completed, turn on forwarding in the *Configuration → SETUP → Stream → Vectra Stream Metadata Forwarding* area and save.

![](/files/46eLRLVEjktqTJ6siPbY)

Health status of Stream can be seen at the bottom of the *Configuration → SETUP → Stream* page:

![](/files/fQfvrTwm46Nrd30tBdAT)

A summary of Stream health is also available in the System Health Dashboard at *Discover → PLATFORM → System Health.*

![](/files/rHVoekNgROlUEnu61Qmm)

Stream metadata statistics are available at *Network Stats → Stream Metadata.*

![](/files/XU3yGBFoyS5scvML99KU)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.vectra.ai/deployment/stream/metadata-filtering-and-publishing.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.