How does Cribl Stream’s Redis function handle command injection risks?

Question

Are Redis function queries in Cribl Stream sanitized to prevent command injection attacks when using an external Redis instance (for example, AWS ElastiCache)?

Environment

• Cribl Stream
• Redis function used in a pipeline
• External Redis key-value store (for example, AWS ElastiCache for Redis)

Answer

Cribl Stream’s Redis function does not build raw Redis command strings by concatenating untrusted event data. Instead, it constructs Redis calls from two separate pieces:

• A configured Redis command verb (for example, GET, SET, HGETALL) defined in the function configuration.
• One or more expressions (keyExpr and argExpr) that are evaluated against each event to produce the key and arguments passed to that command.

When the Redis function runs, Cribl Stream:

1. Evaluates keyExpr/argExpr against the event to derive the key and any arguments.
2. Sends the configured command verb plus those evaluated values as separate parameters to the Redis driver, rather than as a single, concatenated command string.

This separation between the command and its arguments is what mitigates typical command injection scenarios: untrusted event data can influence the key and argument values, but it cannot turn into new Redis commands or alter the Redis verb itself unless you explicitly wire those fields into the function configuration.

However, the Redis function does not automatically “sanitize” or validate the semantics of what you choose to store in Redis. You are still responsible for:

• Carefully choosing which fields feed into keyExpr/argExpr (for example, avoiding user-controlled values for security-sensitive keys).
• Applying any necessary validation, normalization, or allow/deny logic in upstream pipeline functions (for example, Eval, Mask, or Drop) before the Redis function runs.
• Securing your Redis deployment itself (authentication, TLS, network segmentation, access control) according to your organization’s security standards.

Used this way, the Redis function behaves more like a parameterized call into Redis than a free-form command string, reducing the risk of command injection while still leaving input and infrastructure security under your control.

Additional Information

• See the Redis function documentation for configuration details, including commands, expressions, timeouts, and caching options: Redis function.
• For patterns and examples of using Redis with Cribl Stream (including enrichment and aggregation use cases), see the Redis-related blogs and the Redis Knowledge Pack referenced from the docs and blog content.