The CVA Matrix serves as the primary selection tool, detailing all validated reference architectures for Cribl Stream and Cribl Edge.

Before using this matrix, you must first familiarize yourself with the available topology blueprints and overlays, and complete the topology decision tree.

CVA Archetypes

​

The following sections present the content of the CVA Matrix, organized by archetype. Use these details to confirm the required components and operational guardrails for the pattern you selected using the topology decision tree.

Vanilla Cloud

​

This architecture is the simplest, most operationally streamlined deployment for a cloud-native environment, ideal for smaller workloads managed entirely by Cribl.Cloud.

Vanilla On-Prem

​

The Vanilla On-Prem architecture offers a straightforward, self-managed solution for smaller, stable deployments where all components are hosted within your own data center.

Vanilla Hybrid

​

The Vanilla Hybrid archetype addresses environments with minimal on-prem collection needs that feed into a central, cloud-managed Cribl.Cloud Leader.

Small Push/Pull

​

This architecture introduces separation of concerns by dedicating different Worker Groups to handle a small to medium mix of actively received (Push) and actively retrieved (Pull) Sources, simplifying scaling and troubleshooting.

Medium Push/Pull

​

Designed for increasing scale and complexity (10-30+ Sources), this architecture uses multiple Worker Groups, often separated by data function or geographic region, to manage a large mix of Push and Pull data feeds.

All Cribl.Cloud (Large Worker Group)

​

This architecture is optimized for high-volume, Cribl.Cloud environments, using one or two large, Cribl-managed Worker Groups to ingest substantial throughput from cloud-native sources.

Cribl.Cloud/Hybrid (not Vanilla)

​

Moving beyond the “Vanilla” simplicity, this robust hybrid architecture handles multiple, geographically distributed Worker Groups spanning both Cribl.Cloud and customer-managed data centers for significant scale and complexity.

Hybrid Feed to Cribl.Cloud

​

This archteype is used when on-prem Sources need to be forwarded to a cloud-based analytics platform, relying on on-prem Worker Groups solely as forwarders into Cribl.Cloud Worker Groups for processing.

Large Push/Pull (Multi-Push)

​

Catering to environments with many large Push Sources, this highly segmented architecture uses three or more dedicated Worker Groups to ensure optimal performance and isolation for high-volume data streams like Syslog and HTTP.

Pull-Heavy Sources

​

This architecture is explicitly designed for Pull-heavy environments dominated by Sources like SQS, Event Hub, or Kafka, requiring optimized Worker Groups with tuned processes to manage numerous concurrent jobs.

Worker Group to Worker Group

​

This architecture introduces clear boundaries and isolation by chaining Worker Groups, typically to separate data processing by region, team, or function, and requires strict schema contracts and version control.

Edge Fleets to Worker Groups

​

This architecture is focused on distributed data collection and consolidation. It uses lightweight Cribl Edge Fleets deployed across numerous endpoints and remote sites to gather data. The Edge Fleets then efficiently feed all of that collective data into regional Worker Groups for centralized processing.