These docs are for Cribl Stream 4.5 and are no longer actively maintained.

See the latest version (4.20).

When sending Cribl Stream metrics to a metric system of analysis - such as InfluxDB, Splunk, or Elasticsearch - some metrics are particularly valuable. You can use these metrics to set up alerts when a Worker/Edge Node is having a problem, a Node is down, a Destination is down, a Source stops providing incoming data, etc.

Cribl Stream reports its internal metrics within the Cribl Stream UI, in the same way that it reports internal logs. Navigate to Monitoring > Logs (Cribl Stream), or to a Fleet’s Health > Sources tab (Cribl Edge).

To expose metrics for capture or routing, enable the Cribl Internal Source in the Fleet, then enable CriblMetrics.

You can also export metrics (and logs) to JSON files.

By default, Cribl Stream generates internal metrics every 2 seconds. To consume metrics at longer intervals, you can use or adapt the cribl-metrics_rollup Pipeline that ships with Cribl Stream. Attach it to your Cribl Internal Source as a pre-processing Pipeline. The Pipeline’s Rollup Metrics Function has a default Time Window of 30 seconds, which you can adjust to a different granularity as needed.

You can also use our public endpoints to automate monitoring using your own external tools.

Counter-type metrics in Cribl Stream do not monotonically increase or decrease. They are reset at the end of each reporting period. Cribl Stream does not report counters when their value is 0. For example, if there aren’t any Destinations reporting dropped events then the