Knowledge Objects
Knowledge objects are reusable, customizable objects that help you scale and maintain your Cribl Edge more easily. You can reference these objects in multiple places, such as Functions or Pipelines. With these objects, you can change a single value in a central location and then populate everywhere that change everywhere you use that object. Access these objects in Processing > Knowledge.
| Knowledge Object | Description |
|---|---|
| Lookups | Reference tables that you can apply to raw data events in your Pipeline for routing and enrichment. |
| Event Breakers | Event Breaker Rulesets are ordered collections of event-breaking rules that help you define the boundaries and structure of raw log data. Once you have converted unstructured raw data into structured events, you can then send them through Pipelines for further routing and data processing. |
| Parsers | Parsers for use in the Parser Function. |
| Global Variables | Store values you can reference elsewhere in Cribl Edge. |
| Regexes | Regular expressions for use in regex-related Functions. |
| Grok Patterns | Grok pattern files for use in the Grok Function. |
| Schemas (JSON) | JSON schemas for validating events. |
| Parquet Schemas | Schemas for writing out data in the Apache Parquet format. |
| Database Connections | (Cribl Stream only) Reusable configuration objects in Cribl Edge that enable Database Collectors to access and retrieve data from a MySQL, Oracle, Postgres, or SQL Server database. |
| HMAC Functions | (Cribl Stream only) Keyed hashing functions that you use with REST Collectors. |
| AppScope Configs | Configurations for AppScope. Deprecated. |