Cribl LogStream – Docs

Cribl LogStream Documentation

Questions? We'd love to help you! Meet us in #Cribl Community Slack (sign up here)
Download entire manual as PDF - v2.4.4



The Redis Function interacts with Redis stores, setting and getting key-hash and key-value combinations. Redis' in-memory caching of these key pairs enables large lookup tables that would be cumbersome with a .CSV or binary lookup file.

You can use LogStream Collectors (e.g., a REST Collector) to retrieve reference data from desired endpoints, and then use this Function to store the data on Redis and retrieve it to enrich your production data. Note that LogStream does not cache the data returned from this Redis Function.


Filter: Filter expression (JS) that selects data to be fed through the Function. Defaults to true, meaning that all events will be evaluated.

Description: Simple description of this Function. Defaults to empty.

Final: If true, stops data from being fed to downstream Functions. Defaults to No.

Result field: Name of the field in which to store the returned value. (Leave empty to discard the returned value.)

Command: Redis command to perform. Required. (A complete list of Redis commands is at:

Key: A JavaScript expression to compute the value of the key to operate on. Can also be a constant, e.g.: username. This is a required field. Click the icon at right to open a validation modal.

Args: A JavaScript expression to compute arguments to the operation. Can return an array. Click the icon at right to open a validation modal.

Redis URL: Redis URL to connect to. The format is:
[redis[s]:]//[[user][:[email protected]]][host][:port][/db-number][?db=db-number[&password=bar[&option=value]]]

For example: redis://user:[email protected]:6379/0?foo=bar&qux=baz

With no user specified: redis://[email protected]:6379/0?foo=bar&qux=baz


Redis URL Vs. Redis ACL

Through LogStream 2.4.3, the Redis URL field has limited compatibility with Redis 6.x's ACL (Access Control List) feature. When using an ACL, point this field to the Redis default account, either with a password (e.g., redis://default:[email protected]:6379) or with no password (redis://

Do not specify a specific user other than default, or authentication against Redis will fail.

Advanced Settings

Max blocking time: Maximum amount of time (in seconds) before assuming that Redis is down and passing events through. Defaults to 60 seconds. Use 0 to disable timeouts.


This Pipeline demonstrates the use of a pair of Redis Functions. The first Function sets two key-value pairs in Redis. The second Function their values, by key, into two corresponding new Result fields.

Redis set and get Functions

Redis Function #1

Description: Set keys to Redis

Command: set
Key: 'myFieldA'
Args: 420

Command: set
Key: 'myFieldB'
Args: 'sample value'

Redis Function #2

Description: Read keys from Redis

Result field: myField_AA
Command: get
Key: 'myFieldA'

Result field: myField_BB
Command: get
Key: 'myFieldB'

Updated 21 days ago


Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.