Cribl LogStream supports receiving metric data from Prometheus instances that are configured to send data via the remote write protocol.
Type: Push | TLS Support: YES | Event Breaker Support: No
Configuring LogStream to Receive Metrics from Prometheus Remote Write Sources
In the QuickConnect UI: Click + New Source, or click + Add beside Sources. From the resulting drawer's tiles, select [Push >] Prometheus > Remote Write. Next, click either + Add New or (if displayed) Select Existing. The drawer will now provide the following options and fields.
Or, in the Data Routes UI: From the top nav of a LogStream instance or Group, select Data > Sources. From the resulting page's tiles or the Sources left nav, select [Push >] Prometheus > Remote Write. Next, click + Add New to open a New Source modal that provides the following options and fields.
Input ID: Enter a unique name to identify this Source definition.
Address: Enter the hostname/IP to listen to. Defaults to
Port: Enter the port number to listen on..
Remote Write API endpoint: Enter the absolute path on which to listen for Prometheus requests. Defaults to
/write, which will (in this example) expand as:
Select one of the following options for authentication:
None: Don't use authentication.
Auth token: Use HTTP token authentication. In the resulting Token field, enter the bearer token that must be included in the HTTP authorization header, or click Generate if you need a new token.
Auth token (text secret): Provide an HTTP token referenced by a secret. Select a stored text secret in the resulting drop-down, or click Create to configure a new secret.
Basic: Displays Username and Password fields for you to enter HTTP Basic authentication credentials. Click Generate if you need a new password.
Basic (credentials secret): Provide username and password credentials referenced by a secret. Select a stored text secret in the resulting Credentials secret drop-down, or click Create to configure a new secret.
TLS Settings (Server Side)
Enabled defaults to
No. When toggled to
Certificate name: Name of the predefined certificate.
Private key path: Server path containing the private key (in PEM format) to use. Path can reference
Passphrase: Passphrase to use to decrypt private key.
Certificate path: Server path containing certificates (in PEM format) to use. Path can reference
CA certificate path: Server path containing CA certificates (in PEM format) to use. Path can reference
Authenticate client (mutual auth): Require clients to present their certificates. Used to perform mutual authentication using SSL certs. Defaults to
No. When toggled to
Validate client certs: Reject certificates that are not authorized by a CA in the CA certificate path, or by another trusted CA (e.g., the system's CA). Defaults to
Common name: Regex matching subject common names in peer certificates allowed to connect. Defaults to
.*. Matches on the substring after
CN=. As needed, escape regex tokens to match literal characters. E.g., to match the subject
CN=worker.cribl.local, you would enter:
Minimum TLS version: Optionally, select the minimum TLS version to accept from connections.
Maximum TLS version: Optionally, select the maximum TLS version to accept from connections.
In a LogStream Cloud deployment, do not set the TLS Settings (Server Side) tab's Enabled slider to
Yes, nor configure any of the tab's resulting TLS fields. Any settings that you configure here would conflict with LogStream Cloud's predefined TLS configuration.
You can ingest Prometheus remote write data on any of your Cribl.Cloud portal's open ports
20010, all of which have TLS enabled.
In this section, you can add fields/metadata to each event using Eval-like functionality.
Name: Field name.
In this section's Pipeline drop-down list, you can select a single existing Pipeline to process data from this input before the data is sent through the Routes.
Enable Proxy Protocol: Enable if the connection is proxied by a device that supports Proxy Protocol v1 or v2.
Max active requests: Maximum number of active requests allowed for this Source, per Worker Process. Defaults to
0 for unlimited.
Keep alive timeout (seconds): Maximum time to keep a socket connection open to wait for additional data, after the last response was sent. When the incoming request frequency is high, increase this from the default
5 seconds, to avoid creating a new connection per request. (By default, Prometheus will attempt to keep connections open for up to 5 minutes.)
Environment: If you're using GitOps, optionally use this field to specify a single Git branch on which to enable this configuration. If empty, the config will be enabled everywhere.
Select Send to Routes to enable conditional routing, filtering, and cloning of this Source's data via the Routing table.
Select QuickConnect to send this Source’s data to one or more Destinations via independent, direct connections.
Cribl LogStream uses a set of internal fields to assist in handling of data. These "meta" fields are not part of an event, but they are accessible, and Functions can use them to make processing decisions.
Fields for this Source:
Detecting Metrics' Types
Because Prometheus remote write requests don’t specify metrics' types, LogStream applies the following rules to determine the type as we ingest them:
- If the metric’s name ends with
_bucket, the type is set to
- Otherwise, the metric's type is set to
Note that LogStream supports the
timer type in addition to