Manage Config Bundles | Cribl Docs

For the complete documentation index, see llms.txt.

Cribl Stream Cribl Edge Cribl Search Cribl Lake Cribl Insights

Known Issues Release Notes What's New Cribl Copilot

Sandbox GitHub Repos Docker Hub Cribl as Code

(Ctrl+K / Cmd+K)

No Results Try to type a different keyword or phrase

What are you looking for? Type a keyword or phrase above

All Results Press Enter

API Reference Cribl Status Cribl.Cloud

4.19

Release Notes 4.20 4.19 4.18 4.17 4.16 4.15 4.14 4.13 4.12 4.11 4.10 4.9 4.8 4.7 4.6 4.5 4.4 4.3 4.2 4.1 4.0

4.19

4.20 4.19 4.18 4.17 4.16 4.15 4.14 4.13 4.12 4.11 4.10 4.9 4.8 4.7 4.6 4.5 4.4 4.3 4.2 4.1 4.0

Cribl Stream Basic Concepts Log in to Cribl QuickConnect

Cribl Stream Tour Get Started with Cribl Stream Distributed Quick Start

Onboard Faster With Packs

Get Pre-Built Pack Content Use Packs to Get Started With REST Collection

Process Data with AI Assistance

Create Pipelines With Cribl Copilot Editor Convert Data into a Custom Schema

Set Up Cribl Stream

Reference Architectures Cribl.Cloud vs. Self-Hosted

About Connected Environments

How to Connect On-Prem Leaders to Cribl.Cloud Simplify Billing with Universal Subscription Data Payloads for Connected Environments Send Data from On-Prem to Cribl.Cloud

Deployment Planning

Sizing and Scaling OS Tuning for Large Deployments Architectural Considerations Ports

Register Cribl.Cloud Organization Manage Cribl.Cloud Organization Cribl.Cloud Enterprise Manage Cribl.Cloud Worker Groups Private Link for Cribl.Cloud

About Connected Environments

How to Connect On-Prem Leaders to Cribl.Cloud Simplify Billing with Universal Subscription Data Payloads for Connected Environments

On-Prem Deployment

OS and System Requirements Single-Instance/Basic Deployment Run Cribl Stream Configure Cribl Stream for Non-Root User

Distributed Deployment

Set Up Leader and Worker Nodes Manage Worker Groups Manage Workers Map Workers to Worker Groups Manage Config Bundles Configurations and Restart Deploy Stream Configurations Persistent Socket Connections

Splunk App Deployment Bootstrap Workers from Leader

Leader High Availability/Failover

High Availability Requirements Configure Standby Leader Nodes Manage High Availability Deployment

Converting a Single Instance to Distributed Deployment

Orchestrated Deployment

Kubernetes/Helm Deployment Kubernetes Worker Deployment Considerations for Cribl Stream on Kubernetes

Connect Through Cribl Outpost

Set Up Cribl Outpost Manage Cribl Outpost Configure Outpost Group Settings

Set Up Version Control Docker Deployment

FinOps Center Licensing

Configuration Management

Commit and Deploy Changes

Remote Repositories

Handle Customer-Defined .gitignore Exclusions

Configure Worker Group Settings GitOps

Configure Workspaces

Configure Projects Configure Subscriptions Add Users to Projects

Email Notifications

Notification Targets

Webhook Notification Targets PagerDuty Notification Targets Slack Notification Targets AWS SNS Notification Targets Email Notification Targets

Customize the Interface

Custom Banners Custom Login Page

Upgrade Outpost

Uninstall Cribl Stream

Access Management

Secure Your Deployment

Cribl Guard Secure Your Cribl.Cloud Deployment Secure Your On-Prem/Hybrid Deployment Secure Node Access How to Secure the Auth Token for the Leader Node

Add TLS Certificates and Keys Secure Leader-Worker Communication with TLS Secure Leader-Node Communication with mTLS (On-Prem)Secure Sources and Destinations with TLS and mTLS Configure TLS for API and UI Access TLS Defaults and System-wide Settings

Custom HTTP Headers Configure System Proxy Configure SOCKS Proxy

Centralize and Reuse Global Secrets

Add, Use, and Deploy Global Secrets Rotate Global Secrets Back Up, Audit, and Troubleshoot Global Secrets Connect HashiCorp Vault Secret Stores

Create and Manage Legacy Secrets in Cribl Stream Configure KMS Providers Create and Manage Encryption Keys

FIPS Mode for Cribl Stream Running Cribl Stream on a Hardened OS SELinux (Enforcing Mode) Configuration

Monitor Health and Metrics

Internal Metrics Internal Logs

Ingest and Inspect Data

Onboard Data Use Datagens to Simulate Live Data Create and Share Data Samples

Data Sample Use Cases

Ingest-Time Sampling Sample Logs Access Logs: Apache, ELB, CDN, S3 Firewall Logs: VPC Flow Logs, Cisco ASA

Event Data Structure and Flow

Event Model Event Processing Order Event Breakers

Event Breaker Types

Azure Virtual Network (VNet) Flow Event Breaker CSV Event Breaker File Header Event Breaker JSON Array Event Breaker JSON New Line Delimited Event Breaker Regex Event Breaker Timestamp Event Breaker

Validate Pipeline Logic Using Data Preview

Manage Metrics and High Cardinality

Enrich Data Using Lookups

About Lookups Configure Lookups Lookup Geographic Data from IP Addresses Lookups as Filters for Masks Lookups and Regex Magic

Build Custom Logic to Route and Process Your Data Ingest-Time Fields Masking and Obfuscation Encryption of Data in Motion Reducing Windows XML Events Regex Filtering

Aggregations Aggregate Metrics Auto Timestamp CEF Serializer Chain Clone Code Comment DNS Lookup Drop Drop Dimensions Dynamic Sampling Eval Event Breaker Function Flatten Fold Keys GeoIP Grok Guard JSON Unroll Lookup Mask Numerify OTLP Logs OTLP Metrics OTLP Traces Parser Publish Metrics Redis Regex Extract Regex Filter Rename Rollup Metrics Sampling Serialize SNMP Trap Serialize Suppress Unroll XML Unroll Prometheus Publisher (deprecated)Reverse DNS (deprecated)Tee (deprecated)Trim Timestamp (deprecated)

Collector Sources

Azure Blob Storage Cribl Lake Database File System/NFS Google Cloud Storage Health Check REST / API Endpoint S3 Script Splunk Search Manage Collector State in Database and REST API Collectors Schedule and Run Collector Jobs High-Availability Collectors Job Limits

Using Collectors

Configure a Database Connection Using S3 Storage and Replay Using REST/API Collectors Generate HMAC Functions for REST Collector Requests Lacework API Collection Microsoft Graph API Collection ServiceNow API Collection Creating a Custom Collector

Amazon Bedrock Amazon Data Firehose Amazon Kinesis Data Streams Amazon S3 Amazon Security Lake Amazon SQS

Azure Blob Storage Azure Event Hubs Azure Event Hubs AMQP

Google Cloud Pub/Sub

Kafka Confluent Cloud Amazon MSK

Microsoft 365 Activity Microsoft 365 Message Trace Microsoft Graph Microsoft 365 Services

Prometheus Scraper Prometheus Remote Write Grafana Loki

Splunk HEC Splunk Search Splunk TCP

Cribl Internal Cribl HTTP Cribl TCP

Datagen Exec File Monitor Journal Files System Metrics System State

AppScope Claude Compliance Cloudflare CrowdStrike FDR Datadog Agent Elasticsearch API HTTP/S (Bulk API)Raw HTTP/S Metrics Model Driven Telemetry NetFlow & IPFIX Okta OpenAI OpenAI Compliance Logs OpenTelemetry (OTel)ServiceNow Table API SNMP Trap Sysdig Cloud NSS Syslog TCP JSON TCP (Raw)UDP (Raw)Upwind

Windows Event Forwarder

Client Certificate for WEF Kerberos for WEF

Wiz API Wiz Webhook

Zscaler Cloud NSS

Managing Destinations

Amazon AMSP Amazon CloudWatch Logs Amazon Kinesis Data Streams Amazon S3 Compatible Stores Amazon SQS

Azure Blob Storage Azure Data Explorer Azure Event Hubs Azure Monitor Logs Microsoft Sentinel

Cribl Lake Amazon S3 Amazon Security Lake

Elasticsearch Elastic Cloud

Google BigQuery Google SecOps Google Cloud Chronicle API Google Cloud Logging Google Cloud Observability Google Cloud Pub/Sub Google Cloud Storage

Kafka Confluent Cloud Amazon MSK

Graphite StatsD StatsD Extended

New Relic Ingest

New Relic Events New Relic Logs & Metrics

Prometheus Grafana Cloud Loki

Splunk HEC Splunk Single Instance Splunk Load Balanced

Cribl HTTP Cribl TCP Cribl Search Default DevNull Output Router

Alibaba OSS AlphaSOC CrowdStrike Falcon LogScale ClickHouse Cloudflare R2 Cloudian Cortex XSIAM CrowdStrike Falcon Next-Gen SIEM Databricks Datadog Dell PowerScale OneFS Dynatrace HTTP Dynatrace OTLP Exabeam Microsoft Fabric Real-Time Intelligence Filesystem/NFS Honeycomb IBM Cloud Object Storage InfluxDB MinIO NetFlow Nutanix Objects OpenTelemetry (OTel)Scality SentinelOne AI SIEM SentinelOne DataSet ServiceNow Cloud Observability SignalFx SNMP Trap Snowflake Streaming Storj Sumo Logic Syslog TCP JSON Wavefront Webhook Wiz Defend

Manage Backpressure

About Persistent Queues Optimize Source Persistent Queues Optimize Destination Persistent Queues Persistent Queue Shared Storage About Destination Backpressure Triggers Backpressure Impacts to Sources

About Load Balancing Configure Host Metadata Send Data from Cribl Edge to Cribl Stream Transfer Data Between Workspaces or Environments Cribl-to-Cribl Compatibility Matrix

Integrating with Other Services

AWS Cloud Connections AWS Cross-Account Data Collection Integrate Cribl Stream with AWS Security Hub Amazon S3 Better Practices Amazon Security Lake Integration Collecting Logs from Amazon ECS Containers

Prepare the Azure Workspace for Cribl Integrations Azure Event Hubs Integrations Microsoft Sentinel SIEM Integration

Splunk Cloud Platform and BYOL Integrations Switch Cribl Stream Destinations from S2S to Splunk HEC Splunk to Elasticsearch Splunk to Exabeam Splunk Stream to Cribl Stream Decryption of Data in Splunk Stream-to-Splunk Encryption

Syslog Best Practices Syslog TLS to Cribl.Cloud (Palo Alto Example)

Configure Upstream Logging Agents BigPanda/Webhook Integration Gigamon to Cribl Stream Onboarding Data Sources to Cortex XSIAM with Cribl Stream System Metrics to Grafana Kafka Authentication with Kerberos Moogsoft/Webhook Integration Nightfall Integration Managing QRadar Licenses Slack/Webhook Integration Zscaler NSS Virtual Machine Tanium to Cribl Stream

Pack-Based Config Management

Plan a Pack-Based Strategy Create a Pack Version Control Packs in External Git Repos

Packs Publication Standards

Knowledge Objects

Variables Library Regexes JSON Schemas Parquet Schemas AppScope Configs

Cribl Expressions

C.Crypto - Data Encryption and Decryption C.Decode and C.Encode - Encoding and Decoding C.Lookup - Inline Lookup Methods C.Mask - Data Masking Methods C.Net - Network Methods C.Text - Text Methods C.Time - Time Methods Miscellaneous Expression Methods String Date Math Number

auth boot-start cloud-workspace decrypt diag encrypt git help keys limits mode-master mode-single mode-edge mode-worker mode-managed-edge mode-outpost nc node pack parquet pipe pq reload restart start status stop vars version

Environment Variables

breakers.yml certificates.yml cribl.yml groups.yml inputs.yml instance.yml iometrics.yml jobs.yml job-limits.yml leader.yml limits.yml logger.yml mappings.yml messages.yml notifications.yml outpost.yml outputs.yml parsers.yml regexes.yml samples.yml schemas.yml scripts.yml service.yml vars.yml

Troubleshoot Cribl Stream

Diagnose Issues Common Errors and Warnings Git Push Errors Git Remote Repos & Trusted CAs Sample Logs for Login Scenarios

Third-Party Credits

Known Issues Release Notes

On This Page

Home / Stream/ Set Up Cribl Stream/ On-Prem Deployment/ Distributed Deployment/Manage Config Bundles