Simplify parsing and speed up searches with AI-powered v2 Datatypes.

What’s a v2 Datatype?

​

A set of rules that tells Cribl Search how to interpret data, allowing for automatic parsing and faster searches than the older v1 Datasets.

For a comparison of v1 and v2 Datatypes, see v1 and v2 Datatypes.

For general info on Datatypes, see Datatypes in Cribl Search.

v2 Datatypes and Lakehouse Engines

​

v2 Datatypes help ingest your data into high-speed lakehouse engines. In this scenario, you can assign v2 Datatypes in different ways:

• Automatically, through AI Datatyping.
• Manually, by adding custom Datatype rules that match the stock v2 Datatypes.
• Manually, by editing or creating custom v2 Datatypes.

v2 Datatypes and Federated Datasets

​

v2 Datatypes are gradually replacing v1 Datatypes for federated searches, to offer more automated parsing and better search performance.

To see what’s currently supported, see Federated Search v2.

Edit a Stock v2 Datatype

​

To edit a stock v2 Datatype, clone it first.

1. On the Cribl.Cloud top bar, select Products > Search > Data > Datatypes.
2. On the Datatypes page, select the v2 Datatype you want to edit.
3. Select Clone Datatype.

   Now, you’re editing the clone.

4. Make your changes. To find out how, see individual sections in Add a Custom v2 Datatype.

Confirm with Save. Now, you can apply your custom v2 Datatype to your Datasets.

Add a Custom v2 Datatype

​

You can add custom v2 Datatypes to parse data that’s not covered by the auto-applied stock v2 Datatypes.

On the Cribl.Cloud top bar, select Products > Search > Data > Datatypes > Add Datatype.

1. Describe

​

In the New Datatype modal:

• Set Type of your Datatype to v2.
• In ID, enter a unique identifier for your v2 Datatype (for example, web_access_v2). Avoid spaces and special characters.
• In Description, give an overview of your v2 Datatype, so you and others know what it’s for.
• In Tags, add keywords that might help you find your v2 Datatype later (for example, web logs).

2. Set the Data Format

​

In Data format, specify how your incoming data is formatted:

{"time":"2020-05-25T18:00:54.201Z","cid":"w1","channel":"clustercomm","level":"info","message":"metric sender","total":720,"dropped":0}
{"time":"2020-05-25T18:01:01.120Z","cid":"w1","channel":"clustercomm","level":"info","message":"metric sender","total":715,"dropped":2}

time,cid,channel,level,message,total,dropped
2020-05-25T18:00:54.201Z,w1,clustercomm,info,metric sender,720,0
2020-05-25T18:01:01.120Z,w1,clustercomm,info,metric sender,715,2

[
  {
    "time": "2020-05-25T18:00:54.201Z",
    "cid": "w1",
    "channel": "clustercomm",
    "level": "info",
    "message": "metric sender",
    "total": 720,
    "dropped": 0
  },
  {
    "time": "2020-05-25T18:01:01.120Z",
    "cid": "w1",
    "channel": "clustercomm",
    "level": "info",
    "message": "metric sender",
    "total": 715,
    "dropped": 2
  }
]

{
  "w1-1": {
    "time": "2020-05-25T18:00:54.201Z",
    "channel": "clustercomm",
    "level": "info",
    "message": "metric sender",
    "total": 720,
    "dropped": 0
  },
  "w1-2": {
    "time": "2020-05-25T18:01:01.120Z",
    "channel": "clustercomm",
    "level": "info",
    "message": "metric sender",
    "total": 715,
    "dropped": 2
  }
}

2025-10-12 09:15:32 ALERT user=jdoe action=login_failed from 10.1.2.3 (reason: bad password)
2025-10-12 09:15:33 INFO starting background sweep job
2025-10-12 09:15:34 WARNING cache nearly full (92%)

<logs>
  <log>
    <time>2020-05-25T18:00:54.201Z</time>
    <cid>w1</cid>
    <channel>clustercomm</channel>
    <level>info</level>
    <message>metric sender</message>
    <total>720</total>
    <dropped>0</dropped>
  </log>
  <log>
    <time>2020-05-25T18:01:01.120Z</time>
    <cid>w1</cid>
    <channel>clustercomm</channel>
    <level>info</level>
    <message>metric sender</message>
    <total>715</total>
    <dropped>2</dropped>
  </log>
</logs>

3. Set the Maximum Event Size

​

In Max Bytes, set the maximum size of a single event before it’s truncated.

3. Set Additional Extractions

​

Use Additional Extractions to run secondary parsers for extracting more fields or peeling layered payloads.

This feature is not supported for federated Datasets.

4. Set Timestamp Extraction

​

Configure how to find timestamps in your data.

Set the Extraction type:

• Auto: Tries to detect the timestamp automatically. Set Scan depth to how many characters to scan after the anchor. Larger values are slower but may find timestamps farther into the event.
• Manual: Provide the exact strptime format (for example, %Y-%m-%dT%H:%M:%S.%LZ). Use when you know the exact format of your timestamps, and it’s consistent.

Then, configure these settings:

5. Add Schema Maps

​

Normalize vendor-specific field names into one or more canonical schemas (ECS, OCSF, your own), while keeping the original fields for backward compatibility and troubleshooting.

Under Schema Maps, select Add Row, and configure:

• Field Name: Name of the new field to add.
• Kusto Expression: Kusto expression to populate the new field.

This feature is not supported for federated Datasets.

6. Add Fields to Events

​

Enrich incoming events with new computed fields.

Under Add fields to events, select Add Row, and configure:

• Field Name: Name of the new field to add.
• Kusto Expression: Kusto expression to populate the new field.

This feature is not supported for federated Datasets.

Next Steps

​

Confirm with Save. Now, you’re ready to apply your custom v2 Datatype to your Datasets.

List of Stock v2 Datatypes

​

Cribl Search comes with a wide range of stock v2 Datatypes that automatically recognize and parse common log types. This list highlights some key supported types, but many others are available and applied automatically.