/ / / /

pipe

Feeds standard input (stdin) to a Pipeline.

By default, cribl pipe expects newline-delimited JSON (NDJSON): each line is one serialized event object that becomes an event (typically including _raw). If you pass -e / --breaker, stdin is treated as raw data instead, and your chosen Event Breaker Ruleset breaks the stream into events before the Pipeline runs. You can pass -f / --fields to add or overwrite fields on each event using the same name / value shape as Source Fields, where each value is a JavaScript expression evaluated on the event. When you use -f with -e, those fields are applied before breaking so rule conditions in the Ruleset can evaluate against them.

When you use -a / --pack for Pack context, Event Breaker Ruleset IDs are resolved in that Pack (and the default context) the same way as in the UI.

Usage:

cat sample.log |  ./cribl pipe -p pipelineName
cat sample.log |  ./cribl pipe -p pipelineName 2>/dev/null

Raw stdin through an Event Breaker Ruleset, with Source-style fields (shell-escape the value you pass to -f as needed):

cat api_dump.json | ./cribl pipe -p packPipeline -a myPack -e "My API Ruleset" -f '[{"name":"index","value":"\"myindex\""},{"name":"sourcetype","value":"\"mysourcetype\""}]'

Sample response:

...
{"time":"2021-08-20T20:37:00.017Z","cid":"api","channel":"commands","level":"info","message":"creating new pipeline","id":"main","conf":{"asyncFuncTimeout":1000,"functions":[{"id":"eval","disabled":false,"filter":"true","conf":{"add":[{"name":"cribl","value":"'yes'"}],"remove":[]}}]}}
{"time":"2021-08-20T20:37:00.019Z","cid":"api","channel":"pipe:main","level":"info","message":"start loading and initializing functions","count":1}
{"time":"2021-08-20T20:37:00.021Z","cid":"api","channel":"pipe:main","level":"info","message":"finished loading and initializing functions","count":1}
{"time":"2021-08-20T20:37:00.022Z","cid":"api","channel":"commands","level":"info","message":"START pushing stdin events","id":"main"}
{"time":"2021-08-20T20:37:00.028Z","cid":"api","channel":"GrokMgr","level":"info","message":"loaded grok patterns","count":152}
...

Arguments:

Option	Definition
`-p <pipeline>`	Pipeline to feed data through.
`-d`	Include dropped events.
`-c <cpuProfile>`	Perform CPU profiling.
`-t`	Perform Pipeline tracing.
`-a <pack>`	Optional Cribl Pack context. Mutually exclusive with -b.
`-b <project>`	Optional Cribl Project context.
`-e <ruleset>`	Event Breaker Ruleset ID to apply to raw stdin (`--breaker`). If you omit this flag, stdin is read as NDJSON. The Ruleset must exist in the active configuration. If it does not, the command fails and the error names the missing ID.
`-f <jsonArray>`	A JSON array of field objects (`--fields`), each with `name` and `value` keys. The `value` is a JavaScript expression string (same as Source Fields in configuration). Applied before the Pipeline runs. When you also use `-e`, applied before the Event Breaker runs so rule conditions can use those fields. The argument must parse as valid data whose top-level value is an array. If parsing fails or the top-level value is not an array, the command fails before events are processed.
`-i`	Runs the pipe command without sandboxing JavaScript expressions from potential attackers.

pipe ​

Common Resources

pipe