Ingest Syslog Messages into Cribl Search
Collect data from syslog agents via TCP or UDP to store it in Cribl Search for fast analysis.
Before You Begin
You’ll need:
- Cribl.Cloud Enterprise. For details, see Pricing.
- Search Editor Permission, or higher. Learn who can do what at Cribl Search Permissions.
- A syslog sender that can reach Cribl Search over TCP or UDP: rsyslog, syslog-ng, or any other syslog client.
You don’t need Cribl Stream, Edge, or Lake. (Looking for the Syslog Source in Cribl Stream instead?)
1. Add a Lakehouse Engine
See Lakehouse Engines in Cribl Search.
2. Set Up Your Search Datasets
Create the Search Datasets you’ll route events into, and set their retention. See Create Search Datasets.
3. Add a Syslog Source in Cribl Search
On the Cribl.Cloud top bar, select Products > Search > Data > Add Source > Syslog.
Describe Your Source
Under General, configure:
| Setting | Description | Example |
|---|---|---|
| ID | Source ID, unique across your Cribl.Cloud Workspace. Use letters, numbers, underscores, hyphens. | syslog_prod |
| Description | Describe your Source so others know what it’s for. | Ingests syslog from prod servers |
Set Ports
Under General, set the ports you want to listen on:
| Setting | Description | Example |
|---|---|---|
| Address | Hostname (FQDN) that your syslog client connects to. You’ll need this to set up your syslog client. | search.main.foo-bar-abc123.cribl.cloud |
| TCP Port | Network port to listen on for TCP traffic. Set this if you want to receive data over TCP. | 9514 (default) |
| UDP Port | Network port to listen on for UDP traffic. Set this if you want to receive data over UDP. | 9514 (default) |
Set Up Encryption
TLS encryption protects your data in transit between upstream syslog senders and your Cribl Search Source. New Sources have TLS enabled by default, with TLS 1.2 as the minimum version.
TLS is supported for TCP connections only. UDP traffic is never encrypted.
Under Encrypt, you can review or adjust the Minimum TLS version you want to accept:
| TLS Version | When to Use |
|---|---|
| 1.3 | Provides the strongest security. Use when your clients support it. |
| 1.2 | The default. Use for broad client compatibility. |
| Older than 1.2 | Avoid if possible. These versions are no longer considered secure. |
Select Save to create the Source.
4. Set Up Datatyping
Configure Datatype rules to parse, filter, and normalize your syslog messages into structured fields. We call this process Datatyping.
On the Cribl.Cloud top bar, select Products > Search > Data > Datatyping (auto). Here, you can:
- Use Auto-Datatyping to parse your data automatically.
- Check for uncategorized data that didn’t match any Datatype rules.
- Handle the uncategorized data by adding custom Datatype rules.
See also:
- Datatypes in Cribl Search
- v2 Datatypes in Cribl Search
- List of Stock v2 Datatypes
- Add a Custom v2 Datatype
5. Set Up Dataset Rules
Configure Dataset rules to route the parsed events into your Search Datasets.
On the Cribl.Cloud top bar, select Products > Search > Data > Datasets: Organize Your Data, and see Organize Data with Dataset Rules for details.
6. Set Up Your Syslog Client
Configure your upstream syslog client to send data to Cribl Search.
You’ll need these details from your Source configuration:
| Name | Example |
|---|---|
| Address | search.main.foo-bar-abc123.cribl.cloud |
| TCP Port | 9514 (default) |
| UDP Port | 9514 (default) |
To find these for an existing Source: On the Cribl.Cloud top bar, select Products > Search > Data > Sources, and select your Source.
Example Message (Syslog > Cribl Search)
Replace the example address (search.main.foo-bar-abc123.cribl.cloud) and port (if you changed the default 9514) with
your Source values.
echo '<34>Oct 11 22:14:15 mymachine su: su root failed for lonvick on /dev/pts/8' | ncat --ssl --ssl-verify search.main.foo-bar-abc123.cribl.cloud 9514echo '<34>Oct 11 22:14:15 mymachine su: Sample syslog message' | nc -u search.main.foo-bar-abc123.cribl.cloud 95147. Start Sending Data and Verify
Start sending events from your syslog client, and verify that they’re successfully flowing into Cribl Search.
On the Cribl.Cloud top bar, select Products > Search > Data > Live Data.
Here, check for your syslog Source. For details, see Live Data.
Next Steps
Now that your data is in Cribl Search, you can start using it. For example: