Cribl LogStream supports receiving metrics in these wire formats/protocols: StatsD, StatsD Extended, and Graphite. Automatic protocol detection will happen on the first line received over a TCP connection or a UDP packet. Lines not matching the detected protocol will be dropped.
Type: Push | TLS Support: No | Event Breaker Support: No
Select Data > Sources, then select Metrics from the Data Sources page's tiles or left menu. Click Add New to open the Metrics > New Source modal, which provides the following fields.
Input ID: Enter a unique name to identify this Source definition.
Address: Enter the hostname/IP to listen to. Defaults to
UDP port: Enter the UDP port number to listen on. Not required if listening on TCP.
TCP port: Enter the TCP port number to listen on. Not required if listening on UDP.
In this section, you can add fields/metadata to each event using Eval-like functionality.
Name: Field name.
In this section's Pipeline drop-down list, you can select a single existing Pipeline to process data from this input before the data is sent through the Routes.
Enable proxy protocol: Defaults to
No. Toggle to
Yes if the connection is proxied by a device that supports Proxy Protocol v1 or v2.
IP whitelist regex: Regex matching IP addresses that are allowed to send data. Defaults to
.* (i.e., all IPs.)
Max buffer size (events) : Maximum number of events to buffer when downstream is blocking. Defaults to
Cribl LogStream uses a set of internal fields to assist in handling of data. These "meta" fields are not part of an event, but they are accessible, and Functions can use them to make processing decisions.
Fields for this Source:
Metric data is read into the following event schema:
_metric - the metric name _metric_type - the type of the metric (gauge, counter, timer) _value - the value of the metric _time - metric_time or Date.now()/1000 dim1 - value of dimension1 dim3 - value of dimension2 ....
LogStream places sufficient information into a field called
__criblMetric to enable these events to be properly serialized out to any metric outputs (independent of the input type).
The following Destinations natively support the
- Splunk HEC
- Statsd Extended
Updated 4 months ago