These docs are for Cribl Edge 4.11 and are no longer actively maintained.

See the latest version (4.13).

Schemas Library

Cribl Edge supports two kinds of schemas:

• JSON schemas for validating JSON events, described on this page.
• Parquet schemas for writing data from a Cribl Edge Destination to Parquet files.

These schemas obviously serve different purposes. Beware of assuming that operations that work for one kind of schema can be used with the other. For example, the validation method for JSON schemas – C.Schema('<schema_name>').validate(<object_field>) – can’t be used to validate Parquet schemas.

JSON Schemas

​

JSON schemas are based on the popular JSON Schema standard, and Cribl Edge supports schemas matching that standard’s Drafts 0 through 7.

To access the schema library, select Fleets from the sidebar, and choose a Fleet. Then, on the Fleets submenu, select More, then Knowledge, then Schemas.

Its purpose is to provide an interface for creating, editing, and maintaining schemas.

You validate a schema using this built-in method: C.Schema('<schema_name>').validate(<object_field>).

You can call this method anywhere in Cribl Edge that supports JavaScript expressions. Typical use cases for schema validation:

• Making a decision before sending an event down to a destination.
• Making a decision before accepting an event (for example, drop an event if invalid).
• Making a decision to route an event based on the result of validation.

JSON Schema Example

​

To add this example JSON Schema, on the Schemas page, select Add Schema. Enter the following:

• ID: schema1.
• Description: (Enter your own description here.)
• Schema: Paste the following schema.

{
  "$id": "https://example.com/person.schema.json",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "Person",
  "type": "object",
  "required": ["firstName", "lastName", "age"],
  "properties": {
    "firstName": {
      "type": "string",
      "description": "The person's first name."
    },
    "lastName": {
      "type": "string",
      "description": "The person's last name."
    },
    "age": {
      "description": "Age in years which must be equal to or greater than zero.",
      "type": "integer",
      "minimum": 0,
      "maximum": 42
    }
  }
}

Assume that events look like this:

{"employee":{"firstName": "John", "lastName": "Doe", "age": 21}}
{"employee":{"firstName": "John", "lastName": "Doe", "age": 43}}
{"employee":{"firstName": "John", "lastName": "Doe"}}

To validate whether the employee field is valid per schema1, we can use the following:
C.Schema('schema1').validate(employee)

Results:

• First event is valid.
• Second event is not valid because age is greater than the maximum of 42.
• Third event is not valid because age is missing.