Cribl Stream 4.19.1
| PRODUCT | DATE | RELEASE | ADDITIONAL RESOURCES |
|---|---|---|---|
| Stream | 2026-08-19 | Maintenance | Known Issues, Cribl Edge Release Notes |
Important Changes
This release introduces deprecations and notices that require action if you use the affected features:
- Notice: Cribl as Code TypeScript and Go SDK Discontinuation
- Deprecation Notice: Smart Mode for Source Persistent Queue
- Notice: Upcoming HTTP/S (Bulk API) Source byte accounting change affects Cribl.Cloud billing
- Notice: Destination post-processing Pipeline drops now count in total dropped events
Review the full list of important changes for additional critical updates.
New Features
This release provides the following improvements:
Centralize Credentials in On-Prem Deployments with Global Secrets
On-prem deployments now support global secrets, which you can retrieve from HashiCorp Vault or the built-in Cribl secret store. Use global secrets to define credentials once and reuse them across Cribl Stream and Edge. Teams can share and rotate credentials in one place instead of maintaining duplicates.
CORS Support for Raw HTTP Source
The Raw HTTP Source now supports configurable CORS, including allowed origins, methods, and headers. Browser-based OTLP/HTTP clients can send telemetry directly to Cribl without a reverse proxy.
Apps (Preview): Cribl Marketplace
Cribl Marketplace is the in-product catalog of Cribl-supported Apps. Administrators can install Apps from the catalog without importing package files from App builders or GitHub. You can browse each App’s overview, declared permissions, and external API access to see what is available and what an App will use before an administrator installs it.
Terraform Resource and Example for Apps (Preview)
Use the criblio_app resource to install Apps in a repeatable way with Terraform. You can install an App from Git, a file, or a URL or create a minimal App scaffold. The GitHub repository for the Cribl Terraform provider includes an example.
Experience Improvements
- On Cribl.Cloud, AWS Cloud Connections now supports connecting an AWS Organization. You can scan and configure Sources across multiple member accounts from a single onboarding flow, instead of connecting each account separately.
- The OTLP Metrics Function now includes a Resource attributes field that matches attribute names exactly unless an entry includes a
*wildcard. Wildcards and!negation are supported. Resource attribute prefixes are deprecated but continue to work unchanged for existing configurations. When Resource attributes is set, it takes precedence. To migrate, copy each prefix entry to Resource attributes and append*where prefix matching is still desired.
Sources and Destinations
- OpenTelemetry Destinations now report more detailed metrics in the Destination Status tab, including batches flushed over time and a breakdown of metric types such as counters, gauges, and histograms.
- The Prometheus Remote Write Source now parses Prometheus native histograms for both Remote Write v1 and v2, including exponential histograms and native histograms with custom buckets. Parsed histogram data is available on events for downstream processing. The OTLP Metrics Function and OpenTelemetry Destination convert these native histograms to OTLP formats.
- New Cribl HTTP and Cribl TCP Destinations now exclude
__rawfrom the event payload by default, reducing serialization and wire volume. Existing Destination configurations are unchanged. - Destination metrics now include a throttling chart that tracks how often a Destination is throttled, making it easier to diagnose performance issues caused by rate limiting.
- HTTP-based Destinations now honor the Retry timed out HTTP requests setting. Previously, timed-out requests were retried indefinitely even when this setting was disabled or had never been saved. After upgrade, Destinations that never saved this setting (or have it disabled) drop timed-out batches instead of retrying them. To restore timeout retries, re-save the Destination with Retry timed out HTTP requests enabled.
- The Google Pub/Sub Source can now connect with subscription-only permissions when you select Monitor subscription for new messages. This enables ingestion from hosted Pub/Sub topics that grant only subscription consume access or use non-standard topic names.
Important Changes
Notice: Cribl as Code TypeScript and Go SDK Discontinuation
Cribl is stopping active development of the Cribl as Code Go and TypeScript SDKs, which were previously in preview. To give existing users a clear path forward, we are moving the SDKs from the criblio GitHub organization to the Cribl Community GitHub organization and open sourcing them as community resources. This allows customers and community members to continue using the SDKs and build on them, while Cribl steps back from active feature development and long-term support.
The SDKs will continue to be available through their new home in the Cribl Community GitHub organization, where users can keep using them, fork them, and extend them based on their own needs. Customers looking to stay on a supported integration should consider migrating to either the Python SDK, Terraform Provider, or direct Cribl API access. Cribl support will be limited to critical issues only, such as security vulnerabilities or P0 blockers, for the defined transition period. On October 1, 2026, the SDK repositories will be archived and marked read-only.
Deprecation Notice: Smart Mode for Source Persistent Queue
To improve data integrity, Smart mode is now deprecated for Source persistent queue for hybrid and on-prem deployments. In January 2027, configurations for all deployments will automatically migrate to Always On mode, which uses a persistent queue buffer for all events.
Consider updating existing configurations to Always On mode prior to the automatic migration date. Before changing the configuration:
- Monitor your persistent queue needs to correctly size your persistent queue disk space needs and then allocate sufficient disk space.
- When making changes to your persistent queue, remember to first drain queues before disabling them to avoid orphaned data.
- Verify that data routing and filtering behaves as expected in a test environment before rolling out the new configuration to production.
Deprecation Notice: Disable Node Persistence
The Disable Node persistence setting is deprecated and will be removed in a future release. Node information is persisted by default. Use the Worker Group-level Time to keep disconnected Nodes setting to control how long Nodes are tracked.
Notice: Future Removal of AppScope Source
The AppScope Source will be removed from Cribl Stream in a future release.
Notice: Upcoming HTTP/S (Bulk API) Source Byte Accounting Change Affects Cribl.Cloud Billing
The upcoming 4.20.0 release will correct byte accounting for the HTTP/S (Bulk API) Source. Previously, when events arrived with an object-valued _raw field rather than a string, Cribl counted events but reported zero bytes. In Cribl.Cloud, billed ingress uses the same bytes-ingested metric, so that traffic was not charged.
After this change, Source monitoring will reflect the actual inbound payload size. Cribl.Cloud customers who send object-valued _raw events to this Source may see higher billed ingress. That increase aligns with data already being processed.
Notice: Destination Post-Processing Pipeline Drops Now Count in Total Dropped Events
Events that a Destination’s post-processing Pipeline drops (for example, with a Drop Function) now increment total.dropped_events (Total events dropped in Monitoring). Previously, Cribl Stream counted those events in total.in_events but not in total.dropped_events or total.out_events. Per-Pipeline dropped events (pipe.dropped_events) were already correct.
After you upgrade, Total events dropped can increase for Destinations whose post-processing Pipeline drops events. Events sent to the Destination (total.out_events) do not change. total.dropped_events now includes events that were already being dropped.
Corrections
Security Fixes
| ID | Description |
|---|---|
AI-4653 | Authentication header values for external MCP server connections are now obscured by default, with a show/hide toggle for when you need to view them. |
Operational Fixes
| ID | Description |
|---|---|
CRIBL-31682 | Fixed an issue where Live Capture on a Route or Pipeline inside a Pack returned 403 Forbidden when the Leader was in GitOps Push (read-only) mode. |
| CRIBL-43444 | Fixed an issue where tooltips on the Routes page could remain stuck on screen and overlap the UI, making Routes hard to edit. |
| CRIBL-36573 | Fixed an issue in the Schema Library where schemas that declared JSON Schema Draft 06 or earlier showed a false validation error in the UI (for example, No schema request service available), even though the schema was valid and usable. |
| CRIBL-43070 | Fixed case-sensitive Pack ID lookups for get, update, upgrade, and delete operations. Packs installed with mixed-case IDs before the lowercase-ID requirement was implemented in 4.17.0 could return not found or block CI/CD when referenced with a different casing. |
| CRIBL-39191 | Pack READMEs in the Packs Dispensary, including the in-product Add from Dispensary drawer, now render Markdown tables correctly. Previously, table syntax appeared as plain pipe-delimited text. |
| CRIBL-42722 | Fixed an issue where Cribl.Cloud Worker Groups did not protect system.* host metrics by default on the Metrics never-drop list. Under heartbeat backpressure, CPU and memory metrics could be dropped, which left gaps or empty charts on the Monitoring page. |
| CRIBL-37759 | Fixed an issue where Clear Persistent Queue from Monitoring > System > Queues (Destinations) failed with a Not Found error, even though clearing the same queue from the Destination configuration page worked. You can now clear Destination persistent queues from the Monitoring Queues view. |
| CRIBL-43937 | Fixed an issue where Events (In) percentages on the Data Routes page could sum to about 50% instead of ~100%. Pack Route metrics were included in the overall total but not in the per-Route percentages on the global Routes view, which made traffic distribution look incorrect. |
| CRIBL-43116 | Fixed an issue where events dropped by a Destination’s post-processing Pipeline were counted in total.in_events but not in total.dropped_events. Per-Pipeline dropped events (pipe.dropped_events) were already correct. After upgrade, Total events dropped can increase for those Destinations even though total.out_events is unchanged. |
| CRIBL-43120 | Fixed an issue where the Regex Extract Function and Event Breakers could store incorrect values when _NAME_N/_VALUE_N extraction produced reserved field names such as constructor. Valid extracted fields are now stored correctly, and reserved names (__proto__, constructor, prototype) are skipped. |
| CRIBL-43089 | Fixed an issue where a Pipeline that failed to initialize (for example, from invalid Git-synced config) was still registered as an empty passthrough. Routes that used that Pipeline could deliver events with no Functions applied. Failed Pipeline loads are no longer registered for use. |
| CRIBL-43042 | Fixed an issue where AWS S3 shared Persistent Queue storage configured with the Secret Key pair authentication method failed to load and silently fell back to local filesystem storage. Workers now correctly apply S3-backed shared PQ storage when you authenticate with a stored secret key pair. |
| CRIBL-42903 | Fixed an issue where table sort order on the Worker Groups and Workers pages did not persist after navigating away and returning, even though the sort indicator still appeared active. |
| CRIBL-44165 | Fixed an issue where the Worker bootstrap script rejected valid UPN-format usernames that contain @ or ., returning HTTP 400 Invalid query parameter: user. |
| PLAT-11792 | Fixed High Data Volume Notifications that reported about twice the actual input bytes for some service-path Sources (such as Cribl TCP and Google Pub/Sub). Notification volume now matches the Monitoring UI. |
| PLAT-13749 | When you add or update a HashiCorp Vault secret store, Cribl validates the configured Health check endpoint and returns an error for an invalid path, typo, or access-denied response. On update, the health check runs only if the secret store configuration changes. Editing only metadata (like the description) does not trigger validation. |
| PLAT-14630 | Fixed an issue where non-skippable scheduled jobs with Resume missed runs enabled could replay unbounded missed cron slots after a Leader restart and exhaust jobs service memory. Cribl now caps synchronous catch-up with the new Max replay slots job limit. |
| PLAT-14643 | Fixed an issue that could cause task artifacts from long-running or recurring Collector jobs to accumulate on Worker disk when high-availability Collectors was enabled. |
| PLAT-14736 | Fixed an issue where editing a HashiCorp Vault secret store failed when you changed non-secret fields, such as the description. |
| AI-4308 | AI agents can now read and write Pipeline configurations scoped by Worker Group, and filter Worker Groups by product type (Cribl Stream, Edge, or Search) when listing available groups. Configuration changes made through MCP now apply correctly. Previously, Pipeline configuration writes were silently failing. |
| AI-4647 | The MCP system metrics tool now works correctly in distributed (Group) deployments. Previously, it could return incomplete or malformed data when targeting a Worker Group. |
| AI-4275 | Cribl Copilot no longer crashes when an external MCP server is configured with an invalid URL. |
Source and Destination Fixes
| ID | Description |
|---|---|
CRIBL-43560 | When Hash length configured for File Monitor exceeds 16384 bytes, which can cause issues when re-ingesting files, the UI now shows a warning. |
| CRIBL-37506 | Fixed an issue where the S3 Source left empty temporary directories behind after processing Parquet files, which could exhaust disk space or inodes over time. |
| CRIBL-29558 | Fixed an issue where the Google Cloud Logging Destination could lose data when a single log entry exceeded Google’s 256 KB per-entry limit. Oversized entries are now detected and handled so they no longer cause the entire batch request to fail. |
| CRIBL-43048 | Fixed an issue where the Google Cloud Observability Destination rejected native OTLP Sum and Histogram metrics that were missing aggregation temporality. |
| CRIBL-43049 | Fixed an issue where OpenTelemetry and Google Cloud Observability Destinations could error when serializing histograms with negative or non-integer bucket counts. |
| CRIBL-43056 | Fixed an issue where the Google Cloud Observability Destination could error with Duplicate TimeSeries encountered when a batch contained multiple points for the same time series. |
| CRIBL-43135 | Fixed an issue where the OTLP Logs Function mishandled long-form AnyValue wrappers for body and attributes, causing downstream systems to see protobuf field names such as string_value as literal data instead of typed OTLP values. Other OTLP Functions and OpenTelemetry Destinations can opt in to the corrected behavior with the new Preserve native AnyValue wrappers setting. Existing configurations keep the previous behavior until you enable this setting; new configurations enable it by default. |
| CRIBL-42296 | Fixed an issue where the Google Cloud SecOps Destination did not JSON-escape __logType and __namespace override fields, which could produce invalid JSON and cause HTTP 400 failures with data loss. |
| CRIBL-41930 | Fixed an issue where setting Active Connection Limit to 0 on an OpenTelemetry (gRPC) Source blocked all inbound data, even though the UI indicates that 0 means unlimited. |
| CRIBL-42745 | Fixed an issue where idle FileSystemOut-based Destinations rewrote open-file state to disk every second with no change detection, generating unnecessary disk I/O even when no events were flowing. |
| CRIBL-41956 | Fixed an issue where the Syslog Source with TLS mutual authentication did not log client certificate information at debug or silly log levels. |
| CRIBL-43571 | OAuth authentication now correctly handles client secrets containing special characters (backticks, single quotes, backslashes). This affects all Sources and Destinations that use OAuth client credentials or refresh token flows. |
| CRIBL-41796 | Fixed an issue where Syslog UDP Destinations using IP Spoofing did not update Destination Worker Process metrics such as total_requests, failed_requests, and duration. |
| CRIBL-42015 | Fixed an issue where a persistent queue feeding a Splunk Load Balanced Destination could stall on a single event with more than 16,383 fields. S2S serialization could not encode that field count, which blocked the queue until you manually cleared or advanced it. Events that exceed the S2S field-count limit are now dropped so the queue can continue draining. |
| CRIBL-43979 | Fixed an issue on the Splunk TCP Source where Event Breaker metadata from a closed channel could persist when a forwarder reused the same channel ID. Subsequent events could inherit the previous stream’s index and be routed to the wrong Splunk index. |
| CRIBL-42646 | Fixed layout and alignment of settings in the File Monitor Source configuration modal. |
Other Functional Fixes
| ID | Description |
|---|---|
AI-4642 | Improved Guard recommendation generation by processing only the selected detection, reducing the time required to generate recommendations and preventing unrelated detections from being processed. |
| AI-4675 | When background detection recommendations can’t be generated because sample data is missing or older than 24 hours, a new button directs users to add Rule with Copilot instead. |
| AI-4611 | Generate Recommendations now shows clear progress indicators and status messaging throughout the analysis flow. |
SDK Changelogs
The Cribl SDKs help you integrate with Cribl and reduce the need for repetitive tasks. We maintain changelogs for each version of the Cribl SDKs in their GitHub repositories:
- Go SDK changelogs: control plane and management plane
- Python SDK changelogs: control plane and management plane
- Typescript SDK changelogs: control plane and management plane