Choose Your Foundation (Topology)
A topology defines the physical and architectural relationship between your Cribl components–specifically the Leader and the Worker Nodes. It answers the question: “How and where is the software actually installed and connected?”
Choose Your Foundation
Your deployment begins by selecting one of three topologies. Choose the one that best fits your environment:
| Topology | Best For… | Key Characteristics |
|---|---|---|
| Single-Instance | Labs, PoCs, and non-production use. | Collapses Leader and Worker functions onto one host. No HA or scaling. |
| Distributed: Single Worker Group/Fleet | The default production standard. | One Leader with one Group/Fleet. Sized for N-1 capacity to provide HA and horizontal scaling. |
| Distributed: Multi-Worker Group/Fleet | Complex or large-scale environments. | Two or more distinct Groups/Fleets. Used for logical segregation, security boundaries, and workload isolation. |
The Relationship Between Topology and Overlays
To understand the relatioship between toplogy and overlays, consider the following.
- Topology (The Base): You decide how many Leaders and Worker Groups/Fleets you need based on your infrastructure (On-prem, Cribl.Cloud, or Hybrid).
- Overlays (The Logic): You then layer on an Overlay to tell those Worker Groups how to behave (such as “This group is for Linux logs,” or “This group is for the EMEA region”).
An overlay’s primary purpose is to define the logical relationship between different Worker Groups/Fleets. Because of this, overlays are only relevant when you have moved beyond a single-group setup and are using a Distributed: Multi-Worker Group/Fleet topology.