The Cribl Copilot chatbot is an AI assistant designed to streamline your interaction with Cribl products and integrations. You can use the chatbot anywhere in the Cribl suite of products to get prompt responses to common issues and configuration questions. The Cribl Copilot chatbot is also available here in Cribl Docs and as an app in the Cribl community Slack workspace.

Specifically, the chatbot can help you:

• Answer technical questions: Detailed responses to questions about Cribl, Docker, Kubernetes, and regex
• Inspect your deployment: Answers to questions about your own Worker Groups, Sources, Destinations, Routes, Pipelines, system health, and more, drawn from your live configuration
• Troubleshoot problems: Step-by-step solutions for common issues and errors, combining the documentation with the current state of your deployment
• Find documentation: Relevant content from Cribl documentation
• Use integrations: Assistance with setup and configuration of integrations with Docker and Kubernetes
• Write regular expressions (regex): Help with regex construction and debugging
• Generate basic KQL: In the drop-down next to the Cribl Copilot text box, select Generate KQL. For more advanced KQL generation in Cribl Search, see Writing KQL queries with Cribl Copilot.

Get Started ​

An Owner or Admin must enable Cribl AI before the chatbot is available. Select Settings > Global > AI Settings to enable it. For full instructions, see Enable or Disable Cribl AI Features.

To start using the chatbot, select the Cribl Copilot icon at the bottom right of any page. If you have not yet accepted the Cribl AI terms of service, the widget is still visible and you can complete consent through the in-widget modal. After accepting the terms, activate the feature and start typing a question or request.

How to Use Prompts Successfully ​

Follow these guidelines to get clear answers, thorough instructions, and helpful tips tailored to your specific context.

Ask About Your Cribl Deployment ​

In addition to product knowledge, the chatbot can answer questions about your Cribl deployment. When you ask about the state of your environment, the chatbot uses read-only tools to inspect your configuration and live status, then summarizes the results. This saves you from manually navigating the UI or running multiple queries.

You can ask the chatbot about:

• Worker Nodes and Groups: Worker Groups, Distributed deployment summaries, system information, and enabled features.
• Sources and Destinations: Configured Sources and Destinations, live I/O status, byte counts, event counts, and persistent queue status.
• Routing and processing: Routes, Pipelines, Packs, Collectors, Event Breakers, Global Variables, and Lookups in Cribl Stream.
• Search resources: Datasets, saved queries, macros, and search engines in Cribl Search.
• Edge deployments: Edge Fleets, Edge Node processes, containers, and host information in Cribl Edge.
• Lake resources: Lake Datasets, Lakehouses, Lake Sources, and Lake storage locations in Cribl Lake.
• System status: Overall health, system messages and notifications, running processes, logger configuration, alert conditions, monitor configuration, and Notification Policies.

The chatbot provides answers based only on the inspection tools available in your deployment. For example, it surfaces Cribl Search resources only when Cribl Search is part of your deployment.

Example Prompts ​

How the Chatbot Protects Your Configuration ​

When the chatbot reads your configuration, Cribl applies the following safeguards before any data leaves your deployment for the AI model:

• Sensitive value redaction: Tokens, secrets, passwords, private keys, credentials, access keys, and Global Variable values are stripped from inspection tool responses.
• Summary projections: Inspection tools return metadata-level summaries, such as IDs, types, and short descriptions, rather than complete configuration objects, Route expressions, or credential values.
• Capability gating: Inspection tools that don’t apply to your deployment are not available to the chatbot. For example, Distributed-only tools are unavailable in a Single-instance deployment.

How the Chatbot Works ​

The Cribl Copilot chatbot combines a foundational large language model (LLM) with two grounding systems:

• Documentation retrieval: A Retrieval-Augmented Generation (RAG) system that draws on Cribl product documentation to answer questions about Cribl concepts and features. Documentation answers include citations to the source pages on Cribl Docs.
• Deployment inspection: A set of read-only tools that the chatbot can call to inspect your live Cribl configuration, as described in Ask About Your Cribl Deployment.

For troubleshooting questions, the chatbot can use both grounding systems together. It retrieves relevant documentation for context, then inspects your deployment for specifics, and synthesizes the two sources into a single answer. Responses clearly separate guidance based on documentation from observations about your specific deployment.

What the Chatbot Doesn’t Do ​

The chatbot has no direct access to the data flowing through Cribl, so it can’t answer questions like, “Where are my VPC logs?” or summarize event content. Inspection tools see your configuration and operational status only, and not the events themselves.

This chatbot, like any AI, is still learning. It may not answer all questions perfectly, so review responses carefully. To help Cribl Copilot learn, select the thumbs-up or thumbs-down button on any response to provide feedback.

Disable the Chatbot Widget ​

Admins can hide the chatbot widget for all Workspace members without disabling other Cribl AI features. Select Settings > Global > AI Settings, then toggle off Cribl Copilot chatbot in the Core Functionality section.

Users who have not yet accepted the Cribl AI terms of service can still see the widget so they can complete consent via the in-widget modal.