Clean up stale and spammy Honeycomb datasets

This guide shows you how to find and delete two kinds of Honeycomb dataset: datasets that have had no writes for a period you choose, and datasets created by probe traffic whose names contain patterns such as jndi, oastify, { or ... Each method has a preview mode, so you can review the candidates before anything is deleted. Every run is recorded in Swamp.

Prerequisites

swamp auth login completed in an initialised repository
A Honeycomb Configuration Key that is allowed to delete datasets, stored in a vault named honeycomb under config-key (see Storing Secrets)

Set up the behavior

Pull the extension. It includes the datasets behavior type:

swamp extension pull @hivemq/honeycomb

INF extension·pull: Pulling "@hivemq/honeycomb"@"2026.10.01.1790870399"
INF extension·pull: Identity verified: "@hivemq/honeycomb"@"2026.10.01.1790870399"
INF extension·pull: Pulled "@hivemq/honeycomb"@"2026.10.01.1790870399"
INF extension·pull: Extracted 16 files:

If you do not have the vault yet, create it and store the key in it:

swamp vault create local_encryption honeycomb

INF vault·create: Created vault: "honeycomb" ("Local Encryption")

swamp vault put honeycomb config-key hcxik_replace_with_your_configuration_key

This command encrypts the Configuration Key and stores it in the honeycomb vault under config-key.

Create a datasets behavior for the team. This type does not use a dataset slug:

swamp behavior create @hivemq/honeycomb/datasets dataset-cleanup \
    --global-arg "configKey=${{ vault.get('honeycomb', 'config-key') }}" \
    --global-arg region=us

You will see output like:

Created: checkout-slo (@hivemq/honeycomb)
Path: /tmp/.../models/@hivemq/honeycomb/checkout-slo.yaml
Version: 2026.10.01.1

Global Arguments:
  configKey (string) *required
  region (string) [us, eu]
  datasetSlug (string) *required

Methods:
  sync - Fetch current SLO state from Honeycomb by SLO ID
    Inputs:
      sloId (string) *required
  updateSlo - Update SLO metadata (target, description, period, SLI). All fields are optional — only provided fields are changed. Pass `sliAlias` to repoint the SLO at a different derived column (the column must already exist; create it first via createDerivedColumn).
    Inputs:
      sloId (string) *required
      name (string)
      description (string)
      targetPercent (number)
      timePeriodDays (integer)
      sliAlias (string)
  createSlo - Create a new SLO in Honeycomb. Returns the assigned SLO ID.
    Inputs:
      name (string) *required
      sliAlias (string) *required
      targetPercent (number) *required
      timePeriodDays (integer) *required
      description (string)
      datasetSlugs (array)
  createDerivedColumn - Create a new derived column (SLI calculated field) in the target dataset.
...

Preview stale datasets

Choose a cutoff. Honeycomb's default retention is 60 days, so a dataset with no writes for longer than that holds no events. This example uses 90 days:

swamp behavior run dataset-cleanup deleteStaleDatasets \
    --input mode=preview \
    --input 'olderThanDays:json=90'

This command lists the datasets with no writes in the last 90 days and records them in a datasetCleanupRun resource. It does not delete anything. To limit the search to one service or environment, add --input slugPrefix=<prefix>.

Review the candidates

swamp data query --limit 5

This command lists the most recent data records, including the datasetCleanupRun resource with the filter used and the candidate slugs. If a dataset you need to keep appears in the list, narrow the selection with a larger olderThanDays or a slugPrefix and run the preview again.

Delete stale datasets

When the candidate list is correct, run the same command in apply mode:

swamp behavior run dataset-cleanup deleteStaleDatasets \
    --input mode=apply \
    --input 'olderThanDays:json=90'

This command deletes the matching datasets and writes a datasetCleanupRun resource recording which slugs were deleted and which failed. Deleting a dataset in Honeycomb cannot be undone, so use the same olderThanDays and slugPrefix values as the preview you reviewed.

Preview probe-named datasets

swamp behavior run dataset-cleanup deleteSpammyDatasets --input mode=preview

This command lists datasets whose names match pentester probe patterns and records them in a datasetCleanupRun resource without deleting anything. Review the candidates with swamp data query as before.

Delete probe-named datasets

swamp behavior run dataset-cleanup deleteSpammyDatasets --input mode=apply

This command deletes the probe-named datasets and writes a datasetCleanupRun resource recording the deleted and failed slugs.

To require a person to review the preview before the apply step runs, put both steps in a workflow with an approval step between them (see Gate a Workflow with Manual Approval). To repeat the cleanup on a regular basis, see Run Workflows on a Schedule.