As you get started with Cribl Stream, consider using Packs to help streamline your onboarding process and get more value out of your Cribl deployment quickly.

Packs are self-contained, portable bundles of Cribl objects with pre-built logic that solves typical or specific data processing challenges. They can include configurations or example logic for a variety of objects, such as Routes, Pipelines, and Knowledge objects.

On the Cribl Packs Dispensary, Cribl officially publishes and maintains a variety of validate Packs that you might use to solve a particular challenge or process data from a variety of vendors, including many that do not yet have full Cribl Stream integrations. The Dispensary also hosts validated Packs submitted from the larger Cribl developer and user community.

Search and find for Packs that match your specific use case. Then download and import these Packs to:

• Reduce manual effort for common vendors and log formats: Find Packs for validated solutions created by Cribl employees and community members to skip the time-consuming process of writing complex logic for well-known log formats. Instead, import a Pack to begin ingesting, parsing, and enriching logs for common vendors quickly.

• Learn Cribl best practices: Use configurations created by experts from Cribl and the community to learn how to build an effective solution for common data processing challenges.

• Get value from Cribl more quickly: Move from initial source connection to usable, parsed data more quickly by using pre-programmed logic in Packs that you can adapt for your specific needs.

• Simplify complex collections: Use REST Packs to streamline configurations for the REST Collector. These officially supported Packs eliminate manual effort by providing validated authentication, pagination, and event-breaking settings tailored to specific upstream services that do not yet have a dedicated Source or Collector.

• Perform common data processing tasks: Use Packs for use cases such as normalizing timestamps, flattening JSON objects, or masking sensitive PII.

This page describes how to use Packs to accelerate the onboarding process with Cribl Stream. However, you can also use Packs for advanced environment templating as your Cribl Stream deployment becomes more complex and needs to scale. See Pack-Based Configuration Management for more information about this advanced configuration management use case.