On This Page

Home /Cribl Edge 4.19.1

Cribl Edge 4.19.1 ​

PRODUCTDATERELEASEADDITIONAL RESOURCES
Edge2026-08-19MaintenanceKnown Issues, Cribl Stream Release Notes

Important Changes

This release introduces deprecations and notices that require action if you use the affected features:

Review the full list of important changes for additional critical updates.

New Features ​

This release provides the following improvements:

Centralize Credentials in On-Prem Deployments with Global Secrets ​

On-prem deployments now support global secrets, which you can retrieve from HashiCorp Vault or the built-in Cribl secret store. Use global secrets to define credentials once and reuse them across Cribl Stream and Edge. Teams can share and rotate credentials in one place instead of maintaining duplicates.

CORS Support for Raw HTTP Source ​

The Raw HTTP Source now supports configurable CORS, including allowed origins, methods, and headers. Browser-based OTLP/HTTP clients can send telemetry directly to Cribl without a reverse proxy.

Apps (Preview): Cribl Marketplace ​

Cribl Marketplace is the in-product catalog of Cribl-supported Apps. Administrators can install Apps from the catalog without importing package files from App builders or GitHub. You can browse each App’s overview, declared permissions, and external API access to see what is available and what an App will use before an administrator installs it.

Terraform Resource and Example for Apps (Preview) ​

Use the criblio_app resource to install Apps in a repeatable way with Terraform. You can install an App from Git, a file, or a URL or create a minimal App scaffold. The GitHub repository for the Cribl Terraform provider includes an example.

Experience Improvements ​

  • The OTLP Metrics Function now includes a Resource attributes field that matches attribute names exactly unless an entry includes a * wildcard. Wildcards and ! negation are supported. Resource attribute prefixes are deprecated but continue to work unchanged for existing configurations. When Resource attributes is set, it takes precedence. To migrate, copy each prefix entry to Resource attributes and append * where prefix matching is still desired.
  • The Kubernetes Logs Event Breaker now breaks events whose timestamps use numeric timezone offsets (such as -04:00) in addition to offsets that have the Z suffix.
  • Cribl Edge Process explorer now displays a new Swap column on Linux and Windows, containing swapped memory for each process.

Sources and Destinations ​

  • OpenTelemetry Destinations now report more detailed metrics in the Destination Status tab, including batches flushed over time and a breakdown of metric types such as counters, gauges, and histograms.
  • The Prometheus Remote Write Source now parses Prometheus native histograms for both Remote Write v1 and v2, including exponential histograms and native histograms with custom buckets. Parsed histogram data is available on events for downstream processing. The OTLP Metrics Function and OpenTelemetry Destination convert these native histograms to OTLP formats.
  • New Cribl HTTP and Cribl TCP Destinations now exclude __raw from the event payload by default, reducing serialization and wire volume. Existing Destination configurations are unchanged.
  • Destination metrics now include a throttling chart that tracks how often a Destination is throttled, making it easier to diagnose performance issues caused by rate limiting.
  • HTTP-based Destinations now honor the Retry timed out HTTP requests setting. Previously, timed-out requests were retried indefinitely even when this setting was disabled or had never been saved. After upgrade, Destinations that never saved this setting (or have it disabled) drop timed-out batches instead of retrying them. To restore timeout retries, re-save the Destination with Retry timed out HTTP requests enabled.

Important Changes ​

Notice: Cribl as Code TypeScript and Go SDK Discontinuation ​

Cribl is stopping active development of the Cribl as Code Go and TypeScript SDKs, which were previously in preview. To give existing users a clear path forward, we are moving the SDKs from the criblio GitHub organization to the Cribl Community GitHub organization and open sourcing them as community resources. This allows customers and community members to continue using the SDKs and build on them, while Cribl steps back from active feature development and long-term support.

The SDKs will continue to be available through their new home in the Cribl Community GitHub organization, where users can keep using them, fork them, and extend them based on their own needs. Customers looking to stay on a supported integration should consider migrating to either the Python SDK, Terraform Provider, or direct Cribl API access. Cribl support will be limited to critical issues only, such as security vulnerabilities or P0 blockers, for the defined transition period. On October 1, 2026, the SDK repositories will be archived and marked read-only.

Deprecation Notice: Smart Mode for Source Persistent Queue ​

To improve data integrity, Smart mode is now deprecated for Source persistent queue for hybrid and on-prem deployments. In January 2027, configurations for all deployments will automatically migrate to Always On mode, which uses a persistent queue buffer for all events.

Consider updating existing configurations to Always On mode prior to the automatic migration date. Before changing the configuration:

Deprecation Notice: Disable Node Persistence ​

The Disable Node persistence setting is deprecated and will be removed in a future release. Node information is persisted by default. Use the Fleet-level Time to keep disconnected Nodes setting to control how long Nodes are tracked.

Notice: Future Removal of AppScope Source ​

The AppScope Source will be removed from Cribl Edge in a future release.

Notice: Upcoming HTTP/S (Bulk API) Source Byte Accounting Change Affects Cribl.Cloud Billing ​

The upcoming 4.20.0 release will correct byte accounting for the HTTP/S (Bulk API) Source. Previously, when events arrived with an object-valued _raw field rather than a string, Cribl counted events but reported zero bytes. In Cribl.Cloud, billed ingress uses the same bytes-ingested metric, so that traffic was not charged.

After this change, Source monitoring will reflect the actual inbound payload size. Cribl.Cloud customers who send object-valued _raw events to this Source may see higher billed ingress. That increase aligns with data already being processed.

Notice: Destination Post-Processing Pipeline Drops Now Count in Total Dropped Events ​

Events that a Destination’s post-processing Pipeline drops (for example, with a Drop Function) now increment total.dropped_events (Total events dropped in Monitoring). Previously, Cribl Edge counted those events in total.in_events but not in total.dropped_events or total.out_events. Per-Pipeline dropped events (pipe.dropped_events) were already correct.

After you upgrade, Total events dropped can increase for Destinations whose post-processing Pipeline drops events. Events sent to the Destination (total.out_events) do not change. total.dropped_events now includes events that were already being dropped.

Notice: End of Support for Edge Nodes Running Version 3.x ​

To optimize Leader performance and accelerate the delivery of modern edge observability features, Cribl is officially ending support and testing for Edge Nodes running version 3.x that connect to the Leader. To ensure a smooth transition for legacy environments, modern Leaders will not actively block inbound connections from Edge Nodes running version 3.x at this time. However, backward compatibility is no longer actively maintained or tested.

If you have legacy Edge Nodes running 3.x remaining in your Fleet, we strongly recommend upgrading them to a supported 4.x release to guarantee uninterrupted configuration management and telemetry collection.

Notice: Upcoming Removal of Legacy Edge Upgrade Option ​

The Enable Legacy Edge upgrades checkbox will be removed as an upgrade option in a future release. If you are running Cribl Edge Nodes older than version 4.5.0, they can no longer be upgraded automatically via the Leader. You must manually upgrade these specific Nodes to version 4.5.0 or later. Once they are on a modern version, they will automatically inherit the standard upgrade framework for all future updates.

Notice: Upcoming Removal of Stream-Specific Sources ​

The following three Sources will be removed from Cribl Edge in an upcoming release:

  • Zscaler Cloud NSS
  • Model Driven Telemetry
  • Amazon Firehose

These Sources are designed for high-volume, remote data streaming and are architecturally optimized for Cribl Stream rather than Cribl Edge. If you are using these Sources in Cribl Edge, consider migrating to the Cribl Stream Sources instead.

Notice: Upcoming Removal of Legacy Windows Collection Settings ​

The legacy Use Windows Tools setting (found in the Windows Event Logs, Windows Metrics, and System State Sources) will be removed in a future release. This setting enables a legacy PowerShell-based collection method. By default, these Sources use the newer native collection method, which is faster, more reliable, and collects the same data.

No action is required. When Cribl removes these settings, affected Sources automatically use the native method.

Corrections ​

Security Fixes ​

IDDescription
AI-4653
Authentication header values for external MCP server connections are now obscured by default, with a show/hide toggle for when you need to view them.

Operational Fixes ​

IDDescription
CRIBL-31682
Fixed an issue where Live Capture on a Route or Pipeline inside a Pack returned 403 Forbidden when the Leader was in GitOps Push (read-only) mode.
CRIBL-43444Fixed an issue where tooltips on the Routes page could remain stuck on screen and overlap the UI, making Routes hard to edit.
CRIBL-36573Fixed an issue in the Schema Library where schemas that declared JSON Schema Draft 06 or earlier showed a false validation error in the UI (for example, No schema request service available), even though the schema was valid and usable.
CRIBL-43070Fixed case-sensitive Pack ID lookups for get, update, upgrade, and delete operations. Packs installed with mixed-case IDs before the lowercase-ID requirement was implemented in 4.17.0 could return not found or block CI/CD when referenced with a different casing.
CRIBL-39191Pack READMEs in the Packs Dispensary, including the in-product Add from Dispensary drawer, now render Markdown tables correctly. Previously, table syntax appeared as plain pipe-delimited text.
CRIBL-42722Fixed an issue where Cribl.Cloud Fleets did not protect system.* host metrics by default on the Metrics never-drop list. Under heartbeat backpressure, CPU and memory metrics could be dropped, which left gaps or empty charts on the Monitoring page.
CRIBL-37759Fixed an issue where Clear Persistent Queue from Monitoring > System > Queues (Destinations) failed with a Not Found error, even though clearing the same queue from the Destination configuration page worked. You can now clear Destination persistent queues from the Monitoring Queues view.
CRIBL-43937Fixed an issue where Events (In) percentages on the Data Routes page could sum to about 50% instead of ~100%. Pack Route metrics were included in the overall total but not in the per-Route percentages on the global Routes view, which made traffic distribution look incorrect.
CRIBL-43116Fixed an issue where events dropped by a Destination’s post-processing Pipeline were counted in total.in_events but not in total.dropped_events. Per-Pipeline dropped events (pipe.dropped_events) were already correct. After upgrade, Total events dropped can increase for those Destinations even though total.out_events is unchanged.
CRIBL-43532Attempting to delete a parent Fleet that still has Subfleets now shows an error message.
CRIBL-41594Fixed an issue where Edge Node upgrades would hang indefinitely on package downloads when the Cribl CDN was unreachable.
CRIBL-43231Upgrading Windows Edge Nodes from version 4.4.x to 4.17.0 or later no longer fails.
CRIBL-43760Cribl Edge on Windows no longer depends on the deprecated wmic.exe binary. EC2 detection now uses a native WMI query; AWS EC2 metadata continues to come from the AWS metadata endpoint.
CRIBL-39310Upgrade package downloads from the Cribl CDN now verify TLS certificates by default. Disabling a new Settings > Global > Upgrade > Validate CDN server certificates setting permits invalid certificates for environments that use TLS-intercepting proxies.
CRIBL-43755Fixed an issue where a global Commit All did not refresh child Fleet inheritance caches on the Leader. After the committed-cache cleanup ran, inherited Destinations, Routes, and Pipelines could disappear from child Fleet views in the UI, even though Edge Nodes still had the correct config.
CRIBL-43089Fixed an issue where a Pipeline that failed to initialize (for example, from invalid Git-synced config) was still registered as an empty passthrough. Routes that used that Pipeline could deliver events with no Functions applied. Failed Pipeline loads are no longer registered for use.
CRIBL-43120Fixed an issue where the Regex Extract Function and Event Breakers could store incorrect values when _NAME_N/_VALUE_N extraction produced reserved field names such as constructor. Valid extracted fields are now stored correctly, and reserved names (__proto__, constructor, prototype) are skipped.
CRIBL-42903Fixed an issue where table sort order on the Fleets and Edge Nodes pages did not persist after navigating away and returning, even though the sort indicator still appeared active.
CRIBL-40199The Windows installer wizard now uses a correct label for the Username field, indicating that UPN-style usernames are also permitted.
CRIBL-44165Fixed an issue where the Edge Node bootstrap script rejected valid UPN-format usernames that contain @ or ., returning HTTP 400 Invalid query parameter: user.
PLAT-11792Fixed High Data Volume Notifications that reported about twice the actual input bytes for some service-path Sources (such as Cribl TCP and Google Pub/Sub). Notification volume now matches the Monitoring UI.
PLAT-13749When you add or update a HashiCorp Vault secret store, Cribl validates the configured Health check endpoint and returns an error for an invalid path, typo, or access-denied response. On update, the health check runs only if the secret store configuration changes. Editing only metadata (like the description) does not trigger validation.
PLAT-14630Fixed an issue where non-skippable scheduled jobs with Resume missed runs enabled could replay unbounded missed cron slots after a Leader restart and exhaust jobs service memory. Cribl now caps synchronous catch-up with the new Max replay slots job limit.
PLAT-14736Fixed an issue where editing a HashiCorp Vault secret store failed when you changed non-secret fields, such as the description.
AI-4308AI agents can now read and write Pipeline configurations scoped by Fleet, and filter Fleets by product type (Cribl Stream, Edge, or Search) when listing available groups. Configuration changes made through MCP now apply correctly. Previously, Pipeline configuration writes were silently failing.
AI-4647The MCP system metrics tool now works correctly in distributed (Group) deployments. Previously, it could return incomplete or malformed data when targeting a Fleet.
AI-4275Cribl Copilot no longer crashes when an external MCP server is configured with an invalid URL.

Source and Destination Fixes ​

IDDescription
CRIBL-43560
When Hash length configured for File Monitor exceeds 16384 bytes, which can cause issues when re-ingesting files, the UI now shows a warning.
CRIBL-42015Fixed an issue where a persistent queue feeding a Splunk Load Balanced Destination could stall on a single event with more than 16,383 fields. S2S serialization could not encode that field count, which blocked the queue until you manually cleared or advanced it. Events that exceed the S2S field-count limit are now dropped so the queue can continue draining.
CRIBL-29558Fixed an issue where the Google Cloud Logging Destination could lose data when a single log entry exceeded Google’s 256 KB per-entry limit. Oversized entries are now detected and handled so they no longer cause the entire batch request to fail.
CRIBL-43048Fixed an issue where the Google Cloud Observability Destination rejected native OTLP Sum and Histogram metrics that were missing aggregation temporality.
CRIBL-43049Fixed an issue where OpenTelemetry and Google Cloud Observability Destinations could error when serializing histograms with negative or non-integer bucket counts.
CRIBL-43056Fixed an issue where the Google Cloud Observability Destination could error with Duplicate TimeSeries encountered when a batch contained multiple points for the same time series.
CRIBL-43135Fixed an issue where the OTLP Logs Function mishandled long-form AnyValue wrappers for body and attributes, causing downstream systems to see protobuf field names such as string_value as literal data instead of typed OTLP values. Other OTLP Functions and OpenTelemetry Destinations can opt in to the corrected behavior with the new Preserve native AnyValue wrappers setting. Existing configurations keep the previous behavior until you enable this setting; new configurations enable it by default.
CRIBL-42296Fixed an issue where the Google Cloud SecOps Destination did not JSON-escape __logType and __namespace override fields, which could produce invalid JSON and cause HTTP 400 failures with data loss.
CRIBL-41930Fixed an issue where setting Active Connection Limit to 0 on an OpenTelemetry (gRPC) Source blocked all inbound data, even though the UI indicates that 0 means unlimited.
CRIBL-42745Fixed an issue where idle FileSystemOut-based Destinations rewrote open-file state to disk every second with no change detection, generating unnecessary disk I/O even when no events were flowing.
CRIBL-41956Fixed an issue where the Syslog Source with TLS mutual authentication did not log client certificate information at debug or silly log levels.
CRIBL-43361The Windows Event Logs Source now trims trailing whitespace from event log names.
CRIBL-42820Fixed an issue where the Windows Event Logs Source would sometimes not show in the QuickConnect UI.
CRIBL-42646Fixed layout and alignment of settings in the File Monitor Source configuration modal.

SDK Changelogs ​

The Cribl SDKs help you integrate with Cribl and reduce the need for repetitive tasks. We maintain changelogs for each version of the Cribl SDKs in their GitHub repositories: