These docs are for Cribl Stream 4.0 and are no longer actively maintained.

See the latest version (4.13).

Moogsoft/Webhook Integration

Written for Cribl by Douglas Bothwell, formerly of Moogsoft.

You can configure Cribl Stream to send Webhook notifications to Moogsoft, using custom integrations. A custom integration is a user-defined Moogsoft endpoint that ingests JSON payloads, and converts them to Moogsoft events or metrics.

Note these options:

• A Moogsoft custom integration can ingest either events or metrics. Each custom integration has its own separate API key, and its own Cribl-to-Moogsoft mappings.
• There is no limit to the number of custom integrations you can create.
• The examples below illustrate simple event and metric mappings. You can define your own mappings for each endpoint, based on the data types and payloads you want to send. For details, see Moogsoft’s Create Your Own Integration documentation.

Create the Moogsoft Custom Integration

​

Log into your Moogsoft SaaS instance as an Owner or Administrator, and then:

1. Choose Data Config > Ingestion Services > Create Your Own Integration.
2. Click Add New Integration.
3. Specify an integration endpoint and description.
4. Specify the data type to send to the endpoint: Events or Metrics.

The integration setup screen appears, with the URL and the API key for the new endpoint.

Configure the Webhook Destination

​

From a Cribl Stream instance’s or Group’s Manage submenu, select Data > Destinations, then select Webhook from the Manage Destinations page’s tiles or left nav. Click + Add New to open the Webhook > New Destination modal, and complete the following options and fields.

General Settings

​

URL: The URL for the new custom integration (copy this from the Moogsoft UI).

Method: POST.

Format: Custom.

Content type: application/json.

Advanced Settings

​

Extra HTTP Headers: Click + Add Header to define this extra header:

Click Save, then Commit and Deploy. Now you are ready to map your events and/or metrics.

Mapping Cribl Data to Moogsoft

​

Your mappings will differ, depending on the data you want to send. However, the simple examples below, in which we map a Cribl Stream payload to a Moogsoft custom integration, illustrate principles that apply to all custom mappings:

• Moogsoft has a defined event schema and metric schema. Each schema includes a set of required fields. Your custom integration must include mappings for all required fields.
• You can define custom tags for Cribl Stream fields that do not have Moogsoft equivalents.
• You can also specify default values in case Cribl Stream sends an object with a missing field.
• The Moogsoft event schema includes a severity field. You can map Cribl Stream fields and values to Moogsoft severities, or define a default severity if a payload does not include this information.

Define and validate your mappings based on the type of data you plan to send to Moogsoft:

• Event Mapping
• Metric Mapping

Event Mapping

​

To illustrate how to map Cribl Stream payloads to Moogsoft events, we’ll walk through an example with a payload of Cribl Stream syslog messages. You’ll follow the same overall workflow for any events payload.

Send a Sample Payload to Moogsoft

​

In Cribl Stream, navigate to your Webhook Destination’s configuration modal, click the Test tab, then:

1. In the Test input field, define one or more JSON payloads for the Cribl data you want to send. To map syslog events, set the Select sample drop-down to syslog.log.
2. Click Test.

Map the Event Fields

​

In Moogsoft, view the custom integration’s config screen. Under Map Your Data, you should now see the payload you just sent.

Select the payload, and then define your Cribl-to-Moogsoft mappings. Your Cribl Stream data will largely determine the mappings you want. See Events Object in the Moogsoft API docs.

Here are some reasonable mappings for the syslog payload in this example:

Map the Severities

​

The Moogsoft event schema has a severity field. You can specify integers or strings, from 0, meaning Clear, to 5, meaning Critical. Here are some reasonable mappings.

Verify your Mappings

​

Once you save and apply your mappings in Moogsoft, do the following:

1. In Cribl Stream, return to the Test tab for the Webhook Destination. Click Test again to send another payload.
2. In Moogsoft, go to the Alerts screen. You should now see a new alert based on the payload you just sent.

Metric Mapping

​

To illustrate how to map Cribl Stream payloads to Moogsoft events, we’ll walk through an example with a payload of Cribl Stream syslog messages. You’ll follow the same overall workflow for any metrics payload.

Send a Sample Payload to Moogsoft

​

In Cribl Stream, navigate to your Webhook Destination’s configuration modal, click the Test tab, then:

1. In the Test input field, define one or more JSON payloads for the Cribl data you want to send. To map syslog events, set the Select sample drop-down to appscope-metrics.log.
2. Click Test.

Map the Metrics Fields

​

In Moogsoft, view the custom integration’s config screen. Under Map Your Data, you should now see the payload you just sent.

Select the payload and then define the Cribl-to-Moogsoft mappings you want. Your Cribl data will largely determine these mappings. See Metric Datum Object in the Moogsoft API docs.

Here are some reasonable mappings for the AppScope payload you just sent:

Verify Your Mappings

​

After you save and apply your mappings in Moogsoft, test them like this:

1. In Cribl Stream, return to the Webhook Destination’s Test tab. Click Test again to send another payload.
2. In Moogsoft, go to the Metrics screen. You should now see a new alert, based on the payload you just sent.