This message originated from Cribl Community Slack.
Click here to view the original link.
Hi all - we've encountered a strange issue whereby pipeline(s), contained in a pack which we've authored, do not appear (as a pack or pipeline) in the WG's routes table in the route entry's pipeline/pack selection as long as the pack contains the Cribl HTTP destination. When we remove the Cribl HTTP dest from the pack, the pack becomes visible as a selectable option in the route's pipeline drop-down. Related support case is 00030881. Any ideas why this might be? Anyone else encountered this behavior?
Solved
Cribl Pack Not Visible In WG Routes Table When Containing Cribl HTTP Destination
Best answer by Jon Rust
Expected behavior. Once you enable a source or dest in a pack, it is isolated from the global source/dest table.
Expected behavior. Once you enable a source or dest in a pack, it is isolated from the global source/dest table.
@user, sorry, not quite sure I got you: is "it" in your statement the pack or source/dest?
So, my coworker & I are having a little trouble understanding this is the expected behavior, i.e., I would have hoped that packaging sources & destinations into a pack would be one of the big drivers & benefits of using packs.
Our pack (PwC_PaloAlto_xyz_0-0-6) has 1 configured but disabled source (syslog), and 2 configured dests (default & dev:null). In the WG's route table, the pack is unavailable - you're saying this is expected?
It cannot be because of the dests because the PaloAlto pack from the dispensary has the same dests configured but it is visible to the parent WG's routing table.
Links for this message:
image.png
image.png
image.png
image.png
Links for this message:
image.png
image.png
image.png
image.png
"it" being the pack. Once you have a source or dest defined in the Pack, the Pack is not available in the global context as a destination. The Pack is assumed to be self-sufficient at that point.
OK, so in the cases where the pack is "self-sufficient", how does one utilize that pack if it cannot be accessed/referenced in global routes or any other context for that matter?
The sources, routes, pipelines and destinations are in the Pack.
Yes, I see those artifacts in the pack - I was just under the (mistaken) impression that all data had to flow through the WG's master route table. You're saying that's not the case; so the pack will "work" just fine as is (post commit) - there just won't be any entry in the WG's routing table / it's all in the pack, yeah?
Links for this message:
image.png
Links for this message:
image.png
It is more than a little confusing
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.