Cribl Stream AI Summary Generate Button Fails With Connection Error During Commit

Symptom

When clicking the Generate button to create an AI summary while committing changes in Cribl Stream, the UI returns a connection error and no summary is generated.

AI features appear to be enabled on the Leader (AI settings and consent are correctly configured).

A manual connectivity test from the leader succeeds:

curl -v -X POST https://ai.cribl.cloud/api/proxy/token \ -H "Content-Type: application/json" \ -d '{}'

Environment

• Cribl Stream Leader in an on-prem deployment
• Cribl AI / Copilot features enabled on the Leader
• Leader outbound connectivity to the internet controlled by an HTTP(S) proxy and/or firewall rules for domains such as ai.cribl.cloud

Resolution

1. Confirm Cribl Copilot is enabled on the leader. Navigate to Settings > AI Settings and verify Copilot is active and terms are accepted.

2. On the leader, run the connectivity test as the user that runs Cribl (typically cribl):

   curl -v -X POST https://ai.cribl.cloud/api/proxy/token \ -H "Content-Type: application/json" \ -d '{}'

3. Review the curl output. If curl reports Uses proxy env variable https_proxy == '<your proxy>' and returns HTTP 200, your proxy and firewall allow access to ai.cribl.cloud.

4. If curl succeeds via the proxy but Copilot features still fail in the UI, the leader's AiHttpProxy component is not honoring http_proxy/https_proxy. This is a known product limitation. Apply one of these workarounds:

   1. Option A — Allow direct access: Request a network exemption so the leader can reach ai.cribl.cloud on port 443 without going through the HTTP proxy. See Ports for Copilot connectivity requirements.

   2. Option B — Bring Your Own AI (BYOAI): Configure a custom AI provider so Copilot traffic routes through your own LLM endpoint instead of ai.cribl.cloud. See Configure Custom AI Providers.

5. If curl fails, work with your network team to allow outbound HTTPS from the leader to ai.cribl.cloud on port 443 through your proxy or firewall. See Configure System Proxy for Cribl proxy configuration guidance.

Cause

On self-managed leaders, Cribl Copilot requests to ai.cribl.cloud are proxied through the leader's AiHttpProxy service. AiHttpProxy uses Node.js fetch, which does not honor http_proxy/https_proxy environment variables.

Tools such as curl and other Cribl components that use native HTTP modules do honor those proxy variables. That is why a successful curl test does not guarantee Copilot will work when the leader requires a proxy for outbound traffic.

Cribl Copilot uses only ai.cribl.cloud on port 443. No additional domains are required for standard Copilot features.