Config Files
Understanding Configuration Paths and Files
Even though all Cribl Stream Routes, Pipelines, and Functions can be managed from the UI, it’s important to understand how the configuration works under the hood. Here is how configuration paths and files are laid out on the filesystem.
Path Placeholder | Expanded Path |
---|---|
$CRIBL_HOME | Standalone Install:/path/to/install/cribl/ – referred tobelow as $CRIBL_HOME Cribl App for Splunk Install: $SPLUNK_HOME/etc/apps/cribl/ |
All paths below are relative to $CRIBL_HOME
in a single-instance deployment, or to $CRIBL_HOME/groups/<group‑name>/
in a distributed deployment.
Category | Relative Path |
---|---|
Default Configurations Out-of-the-box defaults (rewritable) and libraries (expandable) | default/cribl |
Local Configurations User-created integrations and resources | local/cribl |
System Configuration | (default|local)/cribl/cribl.yml See cribl.yml |
API Configuration | (default|local)/cribl/cribl.yml > [api] sectionSee cribl.yml |
Source Configuration | (default|local)/cribl/inputs.yml See inputs.yml |
Destination Configuration | (default|local)/cribl/outputs.yml See outputs.yml |
License Configuration | (default|local)/cribl/licenses.yml |
Regexes Configuration | (default|local)/cribl/regexes.yml |
Breakers Configuration | (default|local)/cribl/breakers.yml |
Limits Configuration | (default|local)/cribl/limits.yml |
Service Processes Configuration | (default|local)/cribl/service.yml See service.yml |
Pipelines Configuration | (default|local)/cribl/pipelines/<pipeline_name> Each Pipeline’s config resides within its subdirectory. |
Packs Configuration | default/<pack_name> Each Pack’s code and config reside within its subdirectory. |
Routes Configuration | (default|local)/cribl/pipelines/routes.yml |
Functions | (default|local)/cribl/functions/<function_name> Each Function’s code resides within its subdirectory. |
Functions Configuration | (default|local)/cribl/functions/<function_name>/... Each Function’s config resides within its subdirectory. |
Roles Configuration | (default|local)/cribl/roles.yml RBAC Role definitions. See roles.yml. |
Policies Configuration | (default|local)/cribl/policies.yml RBAC Policy definitions. See policies.yml. |
Permissions Configuration | (default|local)/cribl/perms.yml User permissions. See perms.yml. |
Secrets Configuration | (default|local)/cribl/secrets.yml Cribl Stream secrets. See secrets.yml. |
Configurations and Restart
You can Restart and Reload via the UI. On the top nav, go to Settings > Global Settings > System > Controls then click on the Reload button or the Restart button.
In a distributed environment, Worker Nodes poll the Leader for configuration changes. Many of these changes require a quick reload to read the new configuration, while others require a restart of the Cribl processes on the Worker Node.
Upon restarts, be aware of the following:
- Syslog data still being received over UDP might be dropped.
- Worker Nodes will temporarily disappear from the Leader’s Manage Workers or Manage Edge Nodes page.
- Aggregation and suppression operations will start over.
- Worker Nodes’ local copies of Monitoring metrics will be dropped.
- Cribl Stream will drop any events still in RAM that were bound for persistent queues. (However, PQ data already written to disk will persist through the restart.)
Changes that require reloads include configuration changes to:
- Functions
- Pipelines
- Packs
- Routes
- Lookups
- Parquet schemas
- Global variables
- Group Settings > Limits
- Group Settings > Logging > Levels
Changes that require restarts include configuration changes to:
- Distributed mode (Leader versus Managed Worker Node or Single instance)
- Worker Group assignment
- Event Breakers
- QuickConnect configs
- Sources
- Destinations
- Group Settings > General Settings > TLS
- Group Settings > General Settings > Advanced
- Group Settings > Worker Processes > Process count and Memory
Some general guidelines to keep in mind:
- Configuration changes generated by most UI interactions – for instance, changing the order of Functions in a Pipeline, or changing the order of Routes – do not require restarts.
- Some configuration changes in the Settings UI do require restarts. These will prompt you for confirmation before restarting.
- All direct edits of configuration files in
(bin|local|default)/cribl/...
will require restarts. - Worker Nodes might temporarily disappear from the Leader’s Workers or Edge Nodes tab while restarting.
- A
git commit
command on the Leader Node’s host (using a freestandinggit
client not embedded in Cribl’s CLI or UI) will require either a reload or restart. - When using the Cribl App for Splunk, changes to Splunk configuration files might or might not require restarts. Please check current Splunk docs.
Configuration Layering and Precedence
As on most *nix systems, Cribl configurations in local
take precedence over those in default
. There is no layering of configuration files.
Editing Configuration Files Manually
When config files must be edited manually, save all changes in
local
.