For the complete documentation index, see llms.txt.

Cribl Stream Cribl Edge Cribl Search Cribl Lake Cribl Insights

Known Issues Release Notes What's New Cribl Copilot

Sandbox GitHub Repos Docker Hub Cribl as Code

(Ctrl+K / Cmd+K)

No Results Try to type a different keyword or phrase

What are you looking for? Type a keyword or phrase above

All Results Press Enter

API Reference Cribl.Cloud

4.17

Release Notes 4.18 4.17 4.16 4.15 4.14 4.13 4.12 4.11 4.10 4.9 4.8 4.7 4.6 4.5 4.4 4.3 4.2 4.1 4.0

4.17

4.18 4.17 4.16 4.15 4.14 4.13 4.12 4.11 4.10 4.9 4.8 4.7 4.6 4.5 4.4 4.3 4.2 4.1 4.0

About Cribl Edge

Basic Concepts Log in to Cribl QuickConnect

Onboard Faster With Packs

Get Pre-Built Pack Content

Explore Cribl Edge

Explore Cribl Edge Nodes

Cribl Edge on Linux

Install Cribl Edge on Linux Enable Start on Boot OS Tuning for Large Deployments Run Edge as an Unprivileged Linux User Install Edge on Linux via RPM Install Edge on Linux via .deb FIPS Mode for Cribl Edge (Linux)Use ACLs to Allow Cribl Edge to Read Files

Cribl Edge on Windows

Install Cribl Edge on Windows Windows User Permissions and Requirements System Proxy Configuration on Windows Windows Troubleshooting FIPS Mode for Cribl Edge (Windows)

Cribl Edge on MacOS

Install Cribl Edge on MacOS Deploy Cribl Edge with JAMF

Cribl Edge in Containers

Run Cribl Edge in a Docker Container Deploy Cribl Edge via Kubernetes

Set Up Cribl Edge

Get Started with Cribl Edge Cribl.Cloud vs. Self-Hosted

About Connected Environments

How to Connect On-Prem Leaders to Cribl.Cloud Simplify Billing with Universal Subscription Data Payloads for Connected Environments Send Data from On-Prem to Cribl.Cloud

Getting Started Tutorial Configure Cribl Edge Forward Custom Data with Cribl Edge Tags Monitor your Infrastructure with Cribl Edge Monitor and Troubleshoot Cribl Edge Migrate from Third-Party Agents to Cribl Edge

Deployment Planning

OS and System Requirements Large-Scale Deployments

Set Up Leader and Edge Nodes

Connect Through Cribl Outpost

Set Up Cribl Outpost Manage Cribl Outpost

Manage Edge Node Config Bundles

Leader High Availability/Failover

High Availability Requirements Configure Standby Leader Nodes Manage High Availability Deployment

Anti-Virus Exceptions Ports Configure Environment Variables

Register Cribl.Cloud Organization Manage Cribl.Cloud Organization Cribl.Cloud Enterprise

Work with Fleets and Edge Nodes

Design Fleet Hierarchy Fleet Inheritance Configure Fleet Settings Create and Manage Fleets and Subfleets Configure Fleets and Deploy Changes Recover a Deleted Fleet

Manage Edge Nodes Add and Update Edge Nodes Filter Edge Nodes Map Edge Nodes to Fleets

Configure Workspaces

Upgrade Cribl Edge

Upgrade Leader Node Upgrade Outpost

Edge Node Upgrades

Upgrade Edge Nodes in a Fleet Upgrade Edge Nodes Manually

Upgrade Containers Better Practices for Upgrading Cribl Edge Monitor Node Upgrade Status Fleet Upgrading Use Case Backup & Rollback via the UI Manual Rollback Troubleshoot Edge Upgrades

Email Notifications

Notification Targets

Webhook Notification Targets PagerDuty Notification Targets Slack Notification Targets AWS SNS Notification Targets Email Notification Targets

Licensing Uninstall Cribl Edge from Linux Uninstall Cribl Edge from Windows Uninstall Cribl Edge from MacOS

Customize the interface

Custom Banners Custom Login Page

Access Management

Secure Your Deployment

Secure Your Cribl.Cloud Deployment Secure Your On-Prem/Hybrid Deployment

Secure Leader and Communication

How to Secure the Auth Token for the Leader Node TLS Defaults and System-wide Settings Secure Cribl.Cloud with TLS and Mutual TLS Configure mTLS Authentication On-Prem Import Certificates and Keys Configure TLS for API and UI Access Secure Sources and Destinations with Certificates Configure System Proxy Configure SOCKS Proxy

Manage Secrets and Keys

Create and Manage Encryption Keys Create and Manage Secrets in Cribl Edge Configure KMS Providers

FIPS Mode for Cribl Edge (Linux)FIPS Mode for Cribl Edge (Windows)SELinux (Enforcing Mode) Configuration

Common Data Flows

Collect Logs with File Monitor Collect Windows Event Logs and Metrics Collect Kubernetes Logs, Events, and Metrics Cribl Edge to Cribl Stream Send Data to Loki and Prometheus

Exec File Monitor Journal Files Kubernetes Events Kubernetes Logs Kubernetes Metrics System Metrics System State

Cribl HTTP Cribl TCP Cribl Internal Datagen

Amazon Data Firehose

Prometheus Edge Scraper Prometheus Remote Write Grafana Loki

Splunk HEC Splunk TCP

Windows Event Forwarder

Client Certificate for WEF Kerberos for WEF

Windows Event Logs Windows Metrics

AppScope Cloudflare Datadog Agent Elasticsearch API HTTP/S (Bulk API)Raw HTTP/S Metrics Model Driven Telemetry OpenTelemetry (OTel)SNMP Trap Syslog TCP JSON TCP (Raw)UDP (Raw)Zscaler Cloud NSS

Manage Destinations

Cribl HTTP Cribl TCP Cribl Search Disk Spool Default DevNull Output Router

Amazon CloudWatch Logs Amazon Kinesis Data Streams Amazon S3 Compatible Stores Amazon SQS Amazon Security Lake

Azure Blob Storage Azure Data Explorer Azure Event Hubs Azure Monitor Logs Microsoft Sentinel

Elasticsearch Elastic Cloud

Google SecOps Google Cloud Chronicle API Google Cloud Logging Google Cloud Pub/Sub Google Cloud Storage

Kafka Confluent Cloud Amazon MSK

Graphite StatsD StatsD Extended

New Relic Ingest

New Relic Events New Relic Logs & Metrics

Prometheus Grafana Cloud Loki

Splunk HEC Splunk Single Instance Splunk Load Balanced

CrowdStrike Falcon LogScale ClickHouse Cloudflare R2 Cortex XSIAM CrowdStrike Falcon Next-Gen SIEM Databricks Datadog Dynatrace HTTP Dynatrace OTLP Exabeam Microsoft Fabric Real-Time Intelligence Filesystem/NFS Honeycomb InfluxDB MinIO OpenTelemetry (OTel)SentinelOne AI SIEM SentinelOne DataSet ServiceNow Cloud Observability SignalFx SNMP Trap Sumo Logic Syslog TCP JSON Wavefront Webhook

Manage Backpressure

About Persistent Queues Optimize Source Persistent Queues Optimize Destination Persistent Queues About Destination Backpressure Triggers Backpressure Impacts to Sources

About Load Balancing Transfer Data Between Workspaces or Environments Cribl-to-Cribl Compatibility Matrix

Integrate with Other Services

Cribl Edge as a Sidecar Container in AWS ECS Amazon Security Lake Integration Amazon Elastic Kubernetes Services (EKS) Add-On for Edge

Monitor Health and Metrics

Internal Metrics Internal Logs Track Data Activity for an Edge Node

Ingest and Inspect Data

Onboard Data Use Datagens to Simulate Live Data Create and Share Data Samples

Event Data Structure and Flow

Event Model Event Processing Order Event Breakers

Event Breaker Types

Azure Virtual Network (VNet) Flow Event Breaker CSV Event Breaker File Header Event Breaker JSON Array Event Breaker JSON New Line Delimited Event Breaker Regex Event Breaker Timestamp Event Breaker

Validate Pipeline Logic Using Data Preview

Process Data with AI Assistance

Create Pipelines With Cribl Copilot Editor Convert Data into a Custom Schema

Manage Metrics and High Cardinality Build Custom Logic to Route and Process Your Data

Aggregations Aggregate Metrics Auto Timestamp CEF Serializer Chain Clone Code Comment DNS Lookup Drop Drop Dimensions Dynamic Sampling Eval Event Breaker Function Flatten Fold Keys GeoIP Grok JSON Unroll Lookup Mask Numerify OTLP Logs OTLP Metrics OTLP Traces Parser Publish Metrics Redis Regex Extract Regex Filter Rename Rollup Metrics Sampling Serialize SNMP Trap Serialize Suppress Tee Unroll XML Unroll Windows SID Lookup Prometheus Publisher (deprecated)Reverse DNS (deprecated)Trim Timestamp (deprecated)

Pack-Based Config Management

Plan a Pack-Based Strategy Create a Pack Version Control Packs in External Git Repos

Packs Publication Standards

Knowledge Objects

Variables Library Regexes JSON Schemas Parquet Schemas AppScope Configs

Cribl Expressions

C.Crypto - Data Encryption and Decryption C.Decode and C.Encode - Encoding and Decoding C.Lookup - Inline Lookup Methods C.Mask - Data Masking Methods C.Net - Network Methods C.Text - Text Methods C.Time - Time Methods Miscellaneous Expression Methods String Date Math Number

auth boot-start cloud-workspace decrypt diag encrypt git help keys limits mode-master mode-single mode-edge mode-worker mode-managed-edge mode-outpost nc node pack parquet pipe pq reload restart start status stop vars version

Environment Variables

breakers.yml certificates.yml cribl.yml groups.yml inputs.yml instance.yml jobs.yml job-limits.yml leader.yml limits.yml logger.yml mappings.yml and fleet-mappings.yml messages.yml notifications.yml outpost.yml outputs.yml parsers.yml persistent-queue.yml regexes.yml samples.yml schemas.yml scripts.yml service.yml vars.yml

Kubernetes Metrics Details Linux System Metrics Details Windows System Metrics Details

Troubleshoot Cribl Edge

Common Challenges on the Edge Diagnose Issues

Known Issues Release Notes

On This Page

Home / Edge/Administration

These docs are for Cribl Edge 4.17 and are no longer actively maintained.
See the latest version (4.18).

Administration

Consult the following topics to learn how to manage and configure your Cribl Edge deployment.

Upgrade Cribl Edge
Notifications
Uninstall Cribl Edge from Linux
Uninstall Cribl Edge from Windows
Uninstall Cribl Edge from macOS
Customize the Interface
Scripts

Previous

Previous

Next

Next

How can I help you today?

Common Resources

Copyright © 2017-2026 Cribl, Inc. All rights reserved.