Cribl Stream Cribl Edge Cribl Search Cribl Lake AppScope

Known Issues Release Notes Cribl Copilot

Sandbox GitHub Repos Docker Hub Cribl as Code

(Ctrl+K / Cmd+K)

No Results Try to type a different keyword or phrase

What are you looking for? Type a keyword or phrase above

All Results Press Enter

API Reference Cribl.Cloud

4.14

Release Notes 4.14 4.13 4.12 4.11 4.10 4.9 4.8 4.7 4.6 4.5 4.4 4.3 4.2 4.1 4.0

4.14

4.14 4.13 4.12 4.11 4.10 4.9 4.8 4.7 4.6 4.5 4.4 4.3 4.2 4.1 4.0

About Cribl Stream

Cribl Stream Basic Concepts Log in to Cribl QuickConnect

Setting Up Cribl Stream

Reference Architectures Cribl.Cloud vs. Self-Hosted

About Connected Environments

How to Connect On-Prem Leaders to Cribl.Cloud Simplify Billing with Universal Subscription Data Payloads for Connected Environments

Cribl Stream Tour Get Started with Cribl Stream Distributed Quick Start

Deployment Planning

Sizing and Scaling OS Tuning for Large Deployments Architectural Considerations Ports

Register Cribl.Cloud Organization Manage Cribl.Cloud Organization Cribl.Cloud Enterprise Manage Cribl.Cloud Worker Groups

About Connected Environments

How to Connect On-Prem Leaders to Cribl.Cloud Simplify Billing with Universal Subscription Data Payloads for Connected Environments

On-Prem Deployment

OS and System Requirements Single-Instance/Basic Deployment Run Cribl Stream Configure Cribl Stream for Non-Root User

Distributed Deployment

Set Up Leader and Worker Nodes Manage Worker Groups Manage Workers Map Workers to Worker Groups Manage Config Bundles Deploy Stream Configurations Persistent Socket Connections

Splunk App Deployment Bootstrap Workers from Leader Leader High Availability/Failover Converting a Single Instance to Distributed Deployment

Orchestrated Deployment

Kubernetes/Helm Deployment Kubernetes Worker Deployment Considerations for Cribl Stream on Kubernetes

Docker Deployment

Configuring Workspaces

Configuring Projects Configuring Subscriptions Adding Users to Projects

FinOps Center Licensing Version Control GitOps Configure Worker Group Settings

Email Notifications

Notification Targets

Webhook Notification Targets PagerDuty Notification Targets Slack Notification Targets AWS SNS Notification Targets Email Notification Targets

Customizing the Interface

Custom Banners Custom Login Page

Scripts Upgrade Uninstalling

Access Management

Authentication Permissions Members Teams Local Users Service Accounts Roles

Cribl.Cloud SSO

Configuring SSO groups SSO with Okta and OIDC SSO with Okta and SAML SSO with Microsoft Entra ID SSO with Ping Identity Manage SSO for Multiple Organizations SSO Troubleshooting

SSO with Okta and OIDC SSO with Okta and SAML SSO with Microsoft Entra ID SSO with Ping Identity SSO Troubleshooting

Secure your Cribl.Cloud Deployment Cribl.Cloud Security Practices Secure your On-Prem/Hybrid Deployment

Secure Leader and Communication

Secure the Leader Auth Token TLS Defaults and System-wide Settings Secure Cribl.Cloud with TLS and mTLS Configure mTLS Authentication On-Prem Import Certificates and Keys Configure TLS for API and UI Access Secure Sources and Destinations with Certificates Configure System Proxy Configure SOCKS Proxy

Manage Secrets and Keys

Create and Manage Encryption Keys Create and Manage Secrets Configure KMS Providers

FIPS Mode for Cribl Stream Running Cribl Stream on a Hardened OS SELinux (Enforcing Mode) Configuration

Internal Metrics Internal Logs

Working with Data

Event Model Event Processing Order Routes

Process Data with AI Assistance

Create Pipelines With Cribl Copilot Editor Convert Data into a Custom Schema

Import Packs Share Packs Collaborate on Developing Packs Packs Publication Standards

Using Datagens Manage Metrics and High Cardinality Data Onboarding

Enrich Data Using Lookups

About Lookups Configure Lookups Lookup Geographic Data from IP Addresses Lookups as Filters for Masks Lookups and Regex Magic

Ingest-Time Sampling Sample Logs Access Logs: Apache, ELB, CDN, S3, Etc.Firewall Logs: VPC Flow Logs, Cisco ASA, Etc.

Transforming Data

Build Custom Logic to Route and Process Your Data Code Function Examples Ingest-Time Fields Masking and Obfuscation Encryption of Data in Motion Reducing Windows XML Events Regex Filtering

Aggregations Aggregate Metrics Auto Timestamp CEF Serializer Chain Clone Code Comment DNS Lookup Drop Drop Dimensions Dynamic Sampling Eval Event Breaker Flatten Fold Keys GeoIP Grok Guard JSON Unroll Lookup Mask Numerify OTLP Logs OTLP Metrics OTLP Traces Parser Publish Metrics Redis Regex Extract Regex Filter Rename Rollup Metrics Sampling Serialize SNMP Trap Serialize Suppress Tee Unroll XML Unroll Prometheus Publisher (deprecated)Reverse DNS (deprecated)Trim Timestamp (deprecated)

Collector Sources

Azure Blob Storage Cribl Lake Database Filesystem/NFS Google Cloud Storage Health Check REST / API Endpoint S3 Script Splunk Search Manage Collector State in Database and REST API Collectors Scheduling and Running Job Limits

Using Collectors

Using S3 Storage and Replay Using REST/API Collectors Lacework API Collection Microsoft Graph API Collection ServiceNow API Collection Creating a Custom Collector Use REST Packs to Get Started With Okta Data REST Collection

Amazon Data Firehose Amazon Kinesis Data Streams Amazon S3 Amazon Security Lake Amazon SQS

Azure Blob Storage Azure Event Hubs

Google Cloud Pub/Sub

Kafka Confluent Cloud Amazon MSK

Office 365 Activity Office 365 Message Trace Office 365 Services

Prometheus Scraper Prometheus Remote Write Grafana Loki

Splunk HEC Splunk Search Splunk TCP

Cribl Internal Cribl HTTP Cribl TCP

Datagen Exec File Monitor Journal Files System Metrics System State

AppScope CrowdStrike FDR Datadog Agent Elasticsearch API HTTP/S (Bulk API)Raw HTTP/S Metrics Model Driven Telemetry NetFlow & IPFIX OpenTelemetry (OTel)SNMP Trap Syslog TCP JSON TCP (Raw)UDP (Raw)

Windows Event Forwarder

Client Certificate for WEF Kerberos for WEF

Wiz API Wiz Webhook

Zscaler Cloud NSS

Managing Destinations

Amazon CloudWatch Logs Amazon Kinesis Data Streams Amazon S3 Compatible Stores Amazon SQS

Azure Blob Storage Azure Data Explorer Azure Event Hubs Azure Monitor Logs Microsoft Sentinel

Cribl Lake Amazon S3 Amazon Security Lake

Elasticsearch Elastic Cloud

Google SecOps Google Cloud Chronicle API Google Cloud Logging Google Cloud Pub/Sub Google Cloud Storage

Kafka Confluent Cloud Amazon MSK

Graphite StatsD StatsD Extended

New Relic Ingest

New Relic Events New Relic Logs & Metrics

Prometheus Grafana Cloud Loki

Splunk HEC Splunk Single Instance Splunk Load Balanced

Cribl HTTP Cribl TCP Default DevNull Output Router

CrowdStrike Falcon LogScale ClickHouse Cortex XSIAM CrowdStrike Falcon Next-Gen SIEM Datadog Dynatrace HTTP Dynatrace OTLP Exabeam Filesystem/NFS Honeycomb InfluxDB MinIO NetFlow OpenTelemetry (OTel)SentinelOne AI SIEM SentinelOne DataSet ServiceNow Cloud Observability SignalFx SNMP Trap Sumo Logic Syslog TCP JSON Wavefront Webhook

Manage Backpressure

About Persistent Queues Optimize Source Persistent Queues Optimize Destination Persistent Queues About Destination Backpressure Triggers

About Load Balancing Configure Host Metadata Cribl Edge to Cribl Stream Transfer Data Between Workspaces or Environments

Integrating with Other Services

AWS Cross-Account Data Collection Amazon S3 Better Practices Amazon Security Lake Integration Collecting Logs from Amazon ECS Containers

Prepare the Azure Workspace for Cribl Integrations Azure Event Hubs Integrations Microsoft Sentinel SIEM Integration

Splunk Cloud Platform and BYOL Integrations Switch Cribl Stream Destinations from S2S to Splunk HEC Splunk to Elasticsearch Splunk to Exabeam Splunk Stream to Cribl Stream Decryption of Data in Splunk Stream-to-Splunk Encryption

Syslog Best Practices Syslog TLS to Cribl.Cloud (Palo Alto Example)

Configure Upstream Logging Agents BigPanda/Webhook Integration Gigamon to Cribl Stream System Metrics to Grafana Kafka Authentication with Kerberos Moogsoft/Webhook Integration Nightfall Integration Managing QRadar Licenses Slack/Webhook Integration Zscaler NSS Virtual Machine Tanium to Cribl Stream

Knowledge Libraries

Lookups Library Event Breakers Parsers Library Variables Library Regex Library Grok Patterns Library Schemas Library Parquet Schemas Database Connections HMAC Functions AppScope Configs

Cribl Expressions

C.Crypto C.Encode and C.Decode C.Lookup C.Mask C.Net C.Text C.Time Other expressions String Date Math Number

auth boot-start cloud-workspace decrypt diag encrypt git help keys limits mode-master mode-single mode-edge mode-worker mode-managed-edge nc node pack parquet pipe pq reload restart scope start status stop vars version

Environment Variables

breakers.yml certificates.yml cribl.yml groups.yml inputs.yml instance.yml iometrics.yml jobs.yml job-limits.yml leader.yml licenses.yml limits.yml logger.yml mappings.yml and fleet-mappings.yml messages.yml notifications.yml outpost.yml outputs.yml parsers.yml persistent-queue.yml regexes.yml samples.yml schemas.yml scripts.yml service.yml vars.yml

Troubleshooting

Known Issues Diagnosing Issues Common Errors and Warnings Git Push Errors Git Remote Repos & Trusted CAs Sample Logs for Login Scenarios

CrowdStream Third-Party Credits

Known Issues Release Notes

On This Page

Home / Stream/Reference

Reference

A reference for Cribl Stream, including:

Cribl Expressions
CLI
Environment variables
Config files

For reference documentation for the Cribl API, see the API Reference.

Previous

Previous

Next

Next

How can I help you today?

Common Resources

Copyright © 2017-2025 Cribl, Inc. All rights reserved.