Cribl LogStream – Docs

Cribl LogStream Documentation

Questions? We'd love to help you! Meet us in #Cribl Community Slack (sign up here)
Download entire manual as PDF - v2.4.4

Schema Library

What Are Schemas

Schemas are JSON definitions that are used to validate of JSON events. They're based on the popular JSON Schema standard, and all schemas matching draft version 2019-09 are supported. You can find the library under Knowledge > Schemas. Its purpose is to provide an interface for creating, editing, and maintaining Schemas.

You validate a schema using the C.Schema('<schema name>').validate(<object field>) built-in method. This function can be called anywhere in Cribl LogStream that JavaScript expressions are supported.

Typical use cases for Schema validation:

  • Making a decision before sending an event down to a destination.
  • Making a decision before accepting an event. (E.g., drop an event if invalid.)
  • Making a decision to route an event based on the result of validation.


To add this example JSON Schema, go to Knowledge > Schemas and click Add New.
Enter the following:

  • ID: schema1.
  • Description: (Enter your own description here.)
  • Schema: Paste the following schema.
  "$id": "",
  "$schema": "",
  "title": "Person",
  "type": "object",
  "required": ["firstName", "lastName", "age"],
  "properties": {
    "firstName": {
      "type": "string",
      "description": "The person's first name."
    "lastName": {
      "type": "string",
      "description": "The person's last name."
    "age": {
      "description": "Age in years which must be equal to or greater than zero.",
      "type": "integer",
      "minimum": 0,
      "maximum": 42

Assume that events look like this:

{"employee":{"firstName": "John", "lastName": "Doe", "age": 21}}
{"employee":{"firstName": "John", "lastName": "Doe", "age": 43}}
{"employee":{"firstName": "John", "lastName": "Doe"}}

To validate whether the employee field is valid per schema1, we can use the following:



  • First event is valid.
  • Second event is not valid because age is greater than the maximum of 42.
  • Third event is not valid because age is missing.

Schema validation results for the above events

Updated 6 months ago

Schema Library

Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.