What is Expanso and how does it work?

Expanso is a managed platform for deploying intelligent data pipelines at the edge. It processes data where it's generated - reducing bandwidth, latency, and costs. You deploy lightweight agents on your infrastructure, build pipelines using our visual builder or YAML, and control everything from a central SaaS platform.

Can I run AI/ML models directly in my data pipelines?

Yes! Expanso supports running ONNX, TensorFlow Lite, and other models as native pipeline steps. Execute low-latency inference on streaming data, enrich events with model outputs (like risk scores), and make decisions at the edge without cloud round-trips.

How many pre-built components are available?

Expanso provides 200+ pre-built components including inputs (Kafka, HTTP, files), processors (transformations, filtering, PII masking, aggregations), and outputs (S3, Snowflake, Datadog, Splunk). Browse the complete catalog in our Component Reference.

Do I need to write code to build pipelines?

No - use our drag-and-drop visual pipeline builder to create sophisticated pipelines without code. For advanced use cases, you can also write pipelines in YAML or use the Bloblang transformation language for complex data mappings.

How does Expanso help with data governance and compliance?

Expanso includes built-in governance features: automatic PII detection and masking, policy enforcement at the edge, RBAC, SSO integration, and comprehensive audit trails. Mask sensitive data before it ever leaves your network.

types.NodeSpec

agent_versionstring

AgentVersion is the version of the agent software running on the node

archstring

Arch is the CPU architecture (amd64, arm64)

capabilities object

Capabilities defines what this node can do

inputsstring[]

Inputs are the data input types the node can handle (e.g., "syslog", "beats")

outputsstring[]

Outputs are the data output types the node can send to (e.g., "elasticsearch", "s3")

processorsstring[]

Processors are the data processors available (e.g., "grok", "json")

runtimesstring[]

Runtimes are the execution runtimes available (e.g., "docker", "wasm")

hardware_fingerprintstring

HardwareFingerprint is a unique identifier for the hardware configuration

hostnamestring

Hostname is the network hostname of the node

labels object

Labels are key-value pairs for node selection and filtering

property name*string

namestring

Name is the human-readable name of the node

osstring

OS is the operating system (linux, windows, darwin)

types.NodeSpec
{
  "agent_version": "string",
  "arch": "string",
  "capabilities": {
    "inputs": [
      "string"
    ],
    "outputs": [
      "string"
    ],
    "processors": [
      "string"
    ],
    "runtimes": [
      "string"
    ]
  },
  "hardware_fingerprint": "string",
  "hostname": "string",
  "labels": {},
  "name": "string",
  "os": "string"
}