Cribl LogStream – Docs

Cribl LogStream Documentation

Questions? We'd love to help you! Meet us in #Cribl Community Slack (sign up here)
Download entire manual as PDF – v.3.1.1

Working with Cribl Support

If you run into issues with LogStream, please first check our Known Issues page for recommended resolutions or workarounds. For questions not addressed there, this page outlines how to engage with the Cribl Support staff to resolve problems as quickly as possible.

Creating a Support Case

You have several options for opening a support case.

Contact via Email

The most direct way to engage with Support is to email [email protected], with the information outlined below. This will automatically open a case for us to track, and will send you an auto-confirmation email that includes your case number. A Support engineer will then contact you to begin troubleshooting.

Email via Help Button

Within LogStream's UI, you can click the left nav's (?) Help link and, from the resulting fly-out, select Contact Support. This will prompt creation of a new email in your email client.

Email from the UIEmail from the UI

Email from the UI

Contact via Intercom Button

Intercom widgetIntercom widget

Within LogStream's UI, you can click the Intercom button at the bottom right to send Cribl Support questions and (if necessary) screenshots and other files.

We recommend Intercom only for quick questions/answers, because it doesn't provide robust tracking of communications or files.

Slack Community Channels

Our Support staff monitors Cribl's Community Slack for any issues customers are experiencing: https://cribl‑ If you are not already registered for our Community Slack, please register at to get started.

Slack might not get you the same timely response as an email, but it's a great way to get questions about LogStream answered by a wide range of Cribl insiders, and expert peer users, who enjoy sharing their knowledge of the product. Check out individual channels dedicated to feature requests, docs, and other concerns.

Private Slack Channels

Our Enterprise customers have their own private channels where they can communicate directly with their Cribl account team.

Relevant Information We Need

When emailing Cribl Support, please provide as many of the following details as you can – the more, the better:

  • Your name.
  • Preferred contact method (phone or email).
  • LogStream version number affected.
  • Description of the issue you’re having.
  • What's the issue's scope? (Leader Node, specific Worker Nodes or Groups, or entire deployment; number of nodes impacted) .
  • When did the issue begin, or when was it first noticed?
  • Did you make any known changes around that time? (Upgrade, config change, network change, etc.).
  • Diags for one or more affected systems (the Leader Node does not process data, so typically, only diags from Workers are necessary).
  • Sample event data for testing Pipeline issues (provide a text file, rather than screenshots).
  • Any troubleshooting steps that you've already taken.

Pulling Diags

Providing us diags from your environment will speed up the time to resolution. For instructions on how to pull a diag file, see Diagnosing Issues.

With LogStream 2.4.1 or later, the diag is uploaded from the browser, rather than from the LogStream Node. This means that your LogStream Worker Nodes do not need Internet access. With LogStream 2.4.0 or earlier, you’ll need to transfer the diags from your Worker Nodes.


Diag bundles for Leader Nodes do not include diag bundles for any Worker Nodes.

If you would like to upload your diag file via the GUI or CLI, you'll need outbound Internet access to, plus a valid support case number (provided in your case confirmation email).

Diag Workarounds

If your organization does not permit outbound access to, you can also submit diags through Intercom.

If none of these options work with your organization's policies, please work directly with your Support engineer to find a solution.

Updated 4 months ago

Working with Cribl Support

Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.