Cribl Edge 4.19.1 (Coming Soon) ​

The following draft provides early access to release notes for the upcoming Cribl Suite product release. Features or functionality presented are not considered binding commitments and are subject to change at the discretion of Cribl at any time for any reason without notice. This information should not be relied upon in making purchasing decisions.

Important Changes

This release introduces deprecations and notices that require action if you use the affected features:

• Notice: Cribl as Code TypeScript and Go SDK Discontinuation
• Deprecation Notice: Smart Mode for Source Persistent Queue
• Notice: End of Support for Edge Nodes Running Version 3.x

Review the full list of important changes for additional critical updates.

New Features ​

This release provides the following improvements:

Centralize Credentials in On-Prem Deployments with Global Secrets ​

On-prem deployments now support global secrets, which you can retrieve from HashiCorp Vault or the built-in Cribl secret store. Use global secrets to define credentials once and reuse them across Cribl Stream and Edge. Teams can share and rotate credentials in one place instead of maintaining duplicates.

CORS Support for Raw HTTP Source ​

The Raw HTTP Source now supports configurable CORS, including allowed origins, methods, and headers. Browser-based OTLP/HTTP clients can send telemetry directly to Cribl without a reverse proxy.

Apps (Preview): Cribl Marketplace ​

Cribl Marketplace is the in-product catalog of Cribl-supported Apps. Administrators can install Apps from the catalog without importing package files from App builders or GitHub. You can browse each App’s overview, declared permissions, and external API access to see what is available and what an App will use before an administrator installs it.

Experience Improvements ​

• The OTLP Metrics Function now includes a Resource attributes field that matches attribute names exactly unless an entry includes a * wildcard. Wildcards and ! negation are supported. Resource attribute prefixes are deprecated but continue to work unchanged for existing configurations. When Resource attributes is set, it takes precedence. To migrate, copy each prefix entry to Resource attributes and append * where prefix matching is still desired.
• The Kubernetes Logs Event Breaker now breaks events whose timestamps use numeric timezone offsets (such as -04:00) instead of only the Z suffix.

Sources and Destinations ​

• OpenTelemetry Destinations now report more detailed metrics in the Destination Status tab, including batches flushed over time and a breakdown of metric types such as counters, gauges, and histograms.
• The Prometheus Remote Write Source now parses Prometheus native histograms for both Remote Write v1 and v2, including exponential histograms and native histograms with custom buckets. Parsed histogram data is available on events for downstream processing. The OTLP Metrics Function and OpenTelemetry Destination convert these native histograms to OTLP formats.
• New Cribl HTTP and Cribl TCP Destinations now exclude __raw from the event payload by default, reducing serialization and wire volume. Existing Destination configurations are unchanged.
• Destination metrics now include a throttling chart that tracks how often a Destination is throttled, making it easier to diagnose performance issues caused by rate limiting.
• HTTP-based Destinations now honor the Retry timed out HTTP requests setting. Previously, timed-out requests were retried indefinitely even when this setting was disabled or had never been saved. After upgrade, Destinations that never saved this setting (or have it disabled) drop timed-out batches instead of retrying them. To restore timeout retries, re-save the Destination with Retry timed out HTTP requests enabled.

Important Changes ​

Notice: Cribl as Code TypeScript and Go SDK Discontinuation ​

Cribl is stopping active development of the Cribl as Code Go and TypeScript SDKs, which were previously in preview. To give existing users a clear path forward, we are moving the SDKs from the criblio GitHub organization to the Cribl Community GitHub organization and open sourcing them as community resources. This allows customers and community members to continue using the SDKs and build on them, while Cribl steps back from active feature development and long-term support.

The SDKs will continue to be available through their new home in the Cribl Community GitHub organization, where users can keep using them, fork them, and extend them based on their own needs. Customers looking to stay on a supported integration should consider migrating to either the Python SDK, Terraform Provider, or direct Cribl API access. Cribl support will be limited to critical issues only, such as security vulnerabilities or P0 blockers, for the defined transition period. On October 1, 2026, the SDK repositories will be archived and marked read-only.

Deprecation Notice: Smart Mode for Source Persistent Queue ​

To improve data integrity, Smart mode is now deprecated for Source persistent queue for hybrid and on-prem deployments. In January 2027, configurations for all deployments will automatically migrate to Always On mode, which uses a persistent queue buffer for all events.

Consider updating existing configurations to Always On mode prior to the automatic migration date. Before changing the configuration:

• Monitor your persistent queue needs to correctly size your persistent queue disk space needs and then allocate sufficient disk space.
• When making changes to your persistent queue, remember to first drain queues before disabling them to avoid orphaned data.
• Verify that data routing and filtering behaves as expected in a test environment before rolling out the new configuration to production.

Deprecation Notice: Disable Node Persistence ​

The Disable Node persistence setting is deprecated and will be removed in a future release. Node information is persisted by default. Use the Fleet-level Time to keep disconnected Nodes setting to control how long Nodes are tracked.

Notice: Future Removal of AppScope Source ​

The AppScope Source has reached End of Support (EOS) and will be removed from Cribl Edge in a future release.

Notice: End of Support for Edge Nodes Running Version 3.x ​

To optimize Leader performance and accelerate the delivery of modern edge observability features, Cribl is officially ending support and testing for Edge Nodes running version 3.x that connect to the Leader. To ensure a smooth transition for legacy environments, modern Leaders will not actively block inbound connections from Edge Nodes running version 3.x at this time. However, backward compatibility is no longer actively maintained or tested.

If you have legacy Edge Nodes running 3.x remaining in your Fleet, we strongly recommend upgrading them to a supported 4.x release to guarantee uninterrupted configuration management and telemetry collection.

Notice: Upcoming Removal of Legacy Edge Upgrade Option ​

The Enable Legacy Edge upgrades checkbox will be removed as an upgrade option in a future release. If you are running Cribl Edge Nodes older than version 4.5.0, they can no longer be upgraded automatically via the Leader. You must manually upgrade these specific Nodes to version 4.5.0 or later. Once they are on a modern version, they will automatically inherit the standard upgrade framework for all future updates.

Notice: Upcoming Removal of Stream-Specific Sources ​

The following three Sources will be removed from Cribl Edge in an upcoming release:

• Zscaler Cloud NSS
• Model Driven Telemetry
• Amazon Firehose

These Sources are designed for high-volume, remote data streaming and are architecturally optimized for Cribl Stream rather than Cribl Edge. If you are using these Sources in Cribl Edge, consider migrating to the Cribl Stream Sources instead.

Notice: Upcoming Removal of Legacy Windows Collection Settings ​

The legacy Use Windows Tools setting (found in the Windows Event Logs, Windows Metrics, and System State Sources) will be removed in a future release. This setting enables a legacy PowerShell-based collection method. By default, these Sources use the newer native collection method, which is faster, more reliable, and collects the same data.

No action is required. When Cribl removes these settings, affected Sources automatically use the native method.

Corrections ​

Security Fixes ​

Operational Fixes ​

Source and Destination Fixes ​

SDK Changelogs ​

The Cribl SDKs help you integrate with Cribl and reduce the need for repetitive tasks. We maintain changelogs for each version of the Cribl SDKs in their GitHub repositories:

• Go SDK changelogs: control plane and management plane
• Python SDK changelogs: control plane and management plane
• Typescript SDK changelogs: control plane and management plane