Skip to main content
Solved

Cribl Audit Logs Not Sending From Leader Node To Custom Destination

  • March 19, 2026
  • 4 replies
  • 3 views
S
This message originated from Cribl Community Slack.
Click here to view the original link.

Quick question.. Whats the simplest way to get the cribl audit logs from the leader node to a destination. The docs say the audit logs are written to the leader node logs dir; but i need to send these to a custom destination

Best answer by mario

For REST we do have template that you can adjust to jour needs: https://github.com/criblio/collector-templates/tree/main/collectors/rest/cribl-leader-logs This should run on one of your worker groups.

4 replies

B
You can use Edge or a REST collector on Stream.
S
  • steve198
  • Author
  • New Participant
  • March 19, 2026
So to summarise Install a collector on the leader node Send the data to the cribl worker group load balancer for cribl to process as normal
M
  • mario
  • Employee
  • Answer
  • March 19, 2026
For REST we do have template that you can adjust to jour needs: https://github.com/criblio/collector-templates/tree/main/collectors/rest/cribl-leader-logs This should run on one of your worker groups.
B
Install Edge or use a Collector in Stream, using the template that Mario referenced.
Terms & ConditionsAccessibility statement