Skip to main content
Solved

Cribl Audit Logs Not Sending From Leader Node To Custom Destination

  • Mar 19, 2026 11:10 PM UTC
  • 4 replies
  • 119 views
This message originated from Cribl Community Slack.
Click here to view the original link.

Quick question.. Whats the simplest way to get the cribl audit logs from the leader node to a destination. The docs say the audit logs are written to the leader node logs dir; but i need to send these to a custom destination

Best answer by mario

For REST we do have template that you can adjust to jour needs: https://github.com/criblio/collector-templates/tree/main/collectors/rest/cribl-leader-logs This should run on one of your worker groups.
View original

4 replies

You can use Edge or a REST collector on Stream.
  • steve198
  • Author
  • New Participant
  • Mar 19, 2026 11:10 PM UTC
So to summarise Install a collector on the leader node Send the data to the cribl worker group load balancer for cribl to process as normal
  • mario
  • Employee
  • Answer
  • Mar 19, 2026 11:10 PM UTC
For REST we do have template that you can adjust to jour needs: https://github.com/criblio/collector-templates/tree/main/collectors/rest/cribl-leader-logs This should run on one of your worker groups.
Install Edge or use a Collector in Stream, using the template that Mario referenced.
Terms & ConditionsAccessibility statement