What Are Schemas

Schemas are JSON definitions that are used to validate of JSON events. They're based on the popular JSON Schema standard, and all schemas matching draft version 2019-09 are supported. You can find the library under Knowledge > Schemas. Its purpose is to provide an interface for creating, editing, and maintaining Schemas.

You validate a schema using the C.Schema('<schema name>').validate(<object field>) built-in method. This function can be called anywhere in Cribl LogStream that JavaScript expressions are supported.

Typical use cases for Schema validation:

• Making a decision before sending an event down to a destination.
• Making a decision before accepting an event. (E.g., drop an event if invalid.)
• Making a decision to route an event based on the result of validation.

Example

To add this example JSON Schema, go to Knowledge > Schemas and click Add New.
Enter the following:

• ID: schema1.
• Description: (Enter your own description here.)
• Schema: Paste the following schema.

{
  "$id": "https://example.com/person.schema.json",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "Person",
  "type": "object",
  "required": ["firstName", "lastName", "age"],
  "properties": {
    "firstName": {
      "type": "string",
      "description": "The person's first name."
    },
    "lastName": {
      "type": "string",
      "description": "The person's last name."
    },
    "age": {
      "description": "Age in years which must be equal to or greater than zero.",
      "type": "integer",
      "minimum": 0,
      "maximum": 42
    }
  }
}

Assume that events look like this:

{"employee":{"firstName": "John", "lastName": "Doe", "age": 21}}
{"employee":{"firstName": "John", "lastName": "Doe", "age": 43}}
{"employee":{"firstName": "John", "lastName": "Doe"}}

To validate whether the employee field is valid per schema1, we can use the following:

C.Schema('schema1').validate(employee)

Results:

• First event is valid.
• Second event is not valid because age is greater than the maximum of 42.
• Third event is not valid because age is missing.