Configure Upstream Logging Agents | Cribl Docs

For the complete documentation index, see llms.txt.

Cribl Stream Cribl Edge Cribl Search Cribl Lake Cribl Insights

Known Issues Release Notes What's New Cribl Copilot

Sandbox GitHub Repos Docker Hub Cribl as Code

(Ctrl+K / Cmd+K)

No Results Try to type a different keyword or phrase

What are you looking for? Type a keyword or phrase above

All Results Press Enter

API Reference Cribl Status Cribl.Cloud

4.15

Release Notes 4.20 4.19 4.18 4.17 4.16 4.15 4.14 4.13 4.12 4.11 4.10 4.9 4.8 4.7 4.6 4.5 4.4 4.3 4.2 4.1 4.0

4.15

4.20 4.19 4.18 4.17 4.16 4.15 4.14 4.13 4.12 4.11 4.10 4.9 4.8 4.7 4.6 4.5 4.4 4.3 4.2 4.1 4.0

About Cribl Stream

Cribl Stream Basic Concepts Log in to Cribl QuickConnect

Setting Up Cribl Stream

Reference Architectures Cribl.Cloud vs. Self-Hosted

About Connected Environments

How to Connect On-Prem Leaders to Cribl.Cloud Simplify Billing with Universal Subscription Data Payloads for Connected Environments Send Data from On-Prem to Cribl.Cloud

Cribl Stream Tour Get Started with Cribl Stream Distributed Quick Start

Deployment Planning

Sizing and Scaling OS Tuning for Large Deployments Architectural Considerations Ports

Register Cribl.Cloud Organization Manage Cribl.Cloud Organization Cribl.Cloud Enterprise Manage Cribl.Cloud Worker Groups

About Connected Environments

How to Connect On-Prem Leaders to Cribl.Cloud Simplify Billing with Universal Subscription Data Payloads for Connected Environments

On-Prem Deployment

OS and System Requirements Single-Instance/Basic Deployment Run Cribl Stream Configure Cribl Stream for Non-Root User

Distributed Deployment

Set Up Leader and Worker Nodes Manage Worker Groups Manage Workers Map Workers to Worker Groups Manage Config Bundles Deploy Stream Configurations Persistent Socket Connections

Splunk App Deployment Bootstrap Workers from Leader Leader High Availability/Failover Converting a Single Instance to Distributed Deployment

Orchestrated Deployment

Kubernetes/Helm Deployment Kubernetes Worker Deployment Considerations for Cribl Stream on Kubernetes

Connect Through Cribl Outpost

Set Up Cribl Outpost Manage Cribl Outpost

Docker Deployment

Configuring Workspaces

Configuring Projects Configuring Subscriptions Adding Users to Projects

FinOps Center Licensing Version Control GitOps Configure Worker Group Settings

Email Notifications

Notification Targets

Webhook Notification Targets PagerDuty Notification Targets Slack Notification Targets AWS SNS Notification Targets Email Notification Targets

Customizing the Interface

Custom Banners Custom Login Page

Scripts Upgrade Uninstalling

Access Management

Secure your Cribl.Cloud Deployment Secure your On-Prem/Hybrid Deployment

Secure Leader and Communication

Secure the Leader Auth Token TLS Defaults and System-wide Settings Secure Cribl.Cloud with TLS and mTLS Configure mTLS Authentication On-Prem Import Certificates and Keys Configure TLS for API and UI Access Secure Sources and Destinations with Certificates Configure System Proxy Configure SOCKS Proxy

Manage Secrets and Keys

Create and Manage Encryption Keys Create and Manage Secrets Configure KMS Providers

FIPS Mode for Cribl Stream Running Cribl Stream on a Hardened OS SELinux (Enforcing Mode) Configuration

Internal Metrics Internal Logs

Working with Data

Event Data Structure and Flow

Event Model Event Processing Order Event Breakers

Event Breaker Types

CSV Event Breaker File Header Event Breaker JSON Array Event Breaker JSON New Line Delimited Event Breaker Regex Event Breaker Timestamp Event Breaker

Process Data with AI Assistance

Create Pipelines With Cribl Copilot Editor Convert Data into a Custom Schema

Import Packs Share Packs Collaborate on Developing Packs Packs Publication Standards

Using Datagens Manage Metrics and High Cardinality Data Onboarding

Enrich Data Using Lookups

About Lookups Configure Lookups Lookup Geographic Data from IP Addresses Lookups as Filters for Masks Lookups and Regex Magic

Ingest-Time Sampling Sample Logs Access Logs: Apache, ELB, CDN, S3, Etc.Firewall Logs: VPC Flow Logs, Cisco ASA, Etc.

Transforming Data

Build Custom Logic to Route and Process Your Data Code Function Examples Ingest-Time Fields Masking and Obfuscation Encryption of Data in Motion Reducing Windows XML Events Regex Filtering

Aggregations Aggregate Metrics Auto Timestamp CEF Serializer Chain Clone Code Comment DNS Lookup Drop Drop Dimensions Dynamic Sampling Eval Event Breaker Function Flatten Fold Keys GeoIP Grok Guard JSON Unroll Lookup Mask Numerify OTLP Logs OTLP Metrics OTLP Traces Parser Publish Metrics Redis Regex Extract Regex Filter Rename Rollup Metrics Sampling Serialize SNMP Trap Serialize Suppress Tee Unroll XML Unroll Prometheus Publisher (deprecated)Reverse DNS (deprecated)Trim Timestamp (deprecated)