Cribl LogStream – Docs

Cribl LogStream Documentation

Questions? We'd love to help you! Meet us in #Cribl Community Slack (sign up here)
Download entire manual as PDF – v.3.1.1

v.3.1.1 Release

20 days ago by Michael Katz

2021-09-08 – Cribl LogStream 3.1.1 – Maintenance Release

New Features

This release provides the following improvements:

CRIBL-5880 Notifications can now be configured for Destination Backpressure Activated.

CRIBL-5741 Notifications and Targets UI pages now provide in-app help.

CRIBL-5985 With Git Settings > Collapse Actions enabled, Commit modals now include a View Diff option.

CRIBL-5753, CRIBL-5258 The Mask and Flatten Functions can now process double-underscore (__) internal fields, when enumerated individually.

CRIBL-5643 The Settings > Roles page is now displayed (but disabled) when unavailable, with a tooltip listing requirements to enable the feature.


This release includes the following fixes:

Startup and Performance Fixes

CRIBL-5927 Corrected blank page upon restarting in single-instance mode.

CRIBL-6039, CRIBL-6044, CRIBL-6045 Mitigated increased CPU load, and decreased throughput, caused by a 3.1.0 code path that affected several Functions and most expressions.

CRIBL-5920 Leaders behind load balancers now distribute configs to Workers as intended.

CRIBL-5241 In Distributed mode, selecting Settings > Controls > Reload no longer throws a 500 error or spurious No workers registered yet message.

Security and Authentication Fixes

CRIBL-5940 Splunk Load Balanced Destination now properly migrates Auth token values upon upgrade to LogStream 3.1.1.

CRIBL-5960 The Certificate name > Create link now opens a secondary modal, preserving in-progress configuration.

CRIBL-6060 Non-admin users can now change their own passwords as intended.

Source, Collector, and Destination Fixes

CRIBL-5462 Corrected Visibility Timeout errors on S3 Sources.

CRIBL-5726 Corrected Script Collectors' memory leak.

CRIBL-5977 Collectors can now be cloned as intended.

CRIBL-6029 The Grafana, Loki, and Prometheus Remote Write Sources now honor metadata as intended.

CRIBL-5952 AppScope Source no longer suppresses the first metric event ingested.

CRIBL-5930 Corrected Elasticsearch API Source's default endpoint value from /elastic to root (/).

CRIBL-5926 C.Secret() expressions now resolve correctly within Collector URL fields.

Packs Fixes

CRIBL-5771 Corrected internal methods' processing of Global Variables within Packs.

CRIBL-5303 Corrected high memory consumption, and hung Workers, upon installing Packs that reference large files.

Other UX/UI Fixes

CRIBL-5928 Logs now expose HTTP request sizes.

CRIBL-5776 Source, Collector, and Destination configuration modals now display mixed-case integration names, as intended.

CRIBL-5712 Pipelines/Packs lists are now sorted in strict alphabetic order, regardless of capitalization.

CRIBL-6019 Rulesets can now be edited directly within the Workers > Mappings tab.

CRIBL-5620 Corrected the Monitoring page > Workers drop-down's display of hostname info.

CRIBL-4946 The Monitoring page > Workers drop-down now widens to display long Worker names.

CRIBL-5292 The Manage Groups page now displays a spinner while data is loading.

CRIBL-5999 The Google Cloud Pub/Sub Source and Destination modals now correctly label the Topic ID and Subscription ID fields.

CRIBL-5944 Webhook Notification Target modals now properly display Authentication controls.

CRIBL-6052 Webhook Notification Target modals no longer display unavailable secrets selectors.

CRIBL-5972 Within the Help drawer, multiple code tabs are now all selectable, as intended.

CRIBL-5806 Non-sortable ID columns on Collectors, Jobs, Workers, and Worker Groups no longer display fake sorting widgets.

Documentation Fixes

CRIBL-5785 Added Using S3 Storage and Replay guide.

CRIBL-5981 Added Azure Event Hubs Integrations setup guide.

CRIBL-5969 Added Webhook Destination/BigPanda setup guide.

CRIBL-3377 Added Webhook Destination/Sumo Logic setup guide.

CRIBL-5980 Expanded New Relic Destination doc with guidance on log vs. metric data.

CRIBL-4677 Updated Push-based Sources' docs to acknowledge where the internal __scrIpPort field (identifying source IP + port) is supported.