Skip to main content
Solved

Cribl Edge: Teleport usage logs and event emission to the leader

  • July 23, 2026
  • 4 replies
  • 8 views
steven.daniels584
This message originated from Cribl Community Slack.
Click here to view the original link.

Does teleport usage emit events to the leader? If so, what channel and at what level? We want to know when Edge Reader users are using it and how.

Best answer by Jon Rust

At least, you'll see logs with URI's like this indicating a teleport, and including the user who did it. /api/v1/w/<guid>/stuff...

4 replies

Jon Rust
Forum|alt.badge.img
  • Jon Rust
  • Employee
  • July 23, 2026
You can find evidence of teleport in access.log. Search for the worker guid to see them.
Jon Rust
Forum|alt.badge.img
  • Jon Rust
  • Employee
  • Answer
  • July 23, 2026
At least, you'll see logs with URI's like this indicating a teleport, and including the user who did it. /api/v1/w/<guid>/stuff...
Jon Rust
Forum|alt.badge.img
  • Jon Rust
  • Employee
  • July 23, 2026
In Cribl search land: 
dataset="cribl_internal_logs"  earliest=-1h url="/api/v1/w/*"
| extract source=url type=regexp @'/api/v1/w/(?<guid>[^/]+)/(?<target>.*)'
| summarize _time=max(_time), count() by user, guid, target
steven.daniels584
I think that will fit the bill, @user. Thank you!
Terms & ConditionsAccessibility statement