Cribl Stream Packs: Deleting a Default-Layer Resource Does Not Persist

Symptom

When a destination, pipeline, or route is deleted from within a pack in the Cribl Stream UI, the resource appears to be removed. However, after a Commit & Deploy the resource reappears. Exporting the pack with local changes and re-importing it also brings the deleted resource back.

Additional observed symptoms:

• Copying the pack to another worker group with Overwrite enabled does not remove the deleted resource in the destination group.
• The deletion does not appear in the commit diff.

Environment

• Cribl Stream (all versions)
• Deployment type: Cloud (managed) and self-hosted
• Component: Packs

Resolution

Export the pack in merge mode, remove the resource from the exported file, bump the pack version, and re-import with Overwrite. Merge mode collapses the default/ and local/ layers into a single flat default/ layer. Because the re-imported pack contains no default entry for the deleted resource, there is nothing left to merge back.

1. In the Cribl UI navigate to Processing → Packs, find the pack, and click Export.

2. Select export mode Merge. This flattens both the default/ and local/ layers into one.

3. Extract the exported .crbl locally (it is a tar.gz archive):

   tar -xzf <pack>.crbl -C /tmp/pack-edit

4. Open the relevant file and remove the resource key block entirely:

   • Destinations → default/outputs.yml

   • Pipelines → default/pipelines/<pipeline-id>/conf.yml

   • Routes → default/route.yml

5. Confirm the deleted resource ID is not referenced anywhere else in the pack (e.g. output: fields in default/route.yml, or pipeline references in other conf.yml files). A dangling reference causes a deploy error.

6. Bump the version number in package.json (e.g. 0.22.0 → 0.22.1). Cribl rejects upgrades where the incoming version is not newer than the installed version.

7. Repack:

   tar -czf <pack>-fixed.crbl -C /tmp/pack-edit .

8. In the Cribl UI click Upgrade on the pack, upload the fixed .crbl, and select Overwrite to replace all existing contents.

9. Commit & Deploy.

Self-hosted only (filesystem access available): Edit the file directly on the leader under $CRIBL_HOME/config-volume/groups/<worker-group>/local/cribl/packs/<pack-id>/default/ and remove the resource key block, then Commit & Deploy. No version bump is required for this approach.

Cause

Cribl Stream packs use the same default/ and local/ configuration layering as Stream itself (see Configuration Layering and Precedence). Resources that ship with a pack live in the pack's default/ directory. When a user deletes a resource via the UI, the change is written to the local/ layer only. The local/ layer can override default/ entries but cannot remove them — no tombstone mechanism exists. When configuration is loaded or the pack is exported, local/ is merged on top of default/, and the default-layer entry is restored.

Additional Information

• This affects any resource that originated in the pack's default/ layer: destinations, pipelines, routes, inputs, and knowledge objects.
• Exporting with Local changes only mode does not resolve this — it exports only the local layer, leaving the default layer intact in the installed pack.