Cribl Stream Route Filter Using host.includes Stops Matching After Hostname Case Change

Symptom

A Cribl Stream Route that uses a JavaScript filter similar to host.includes('LI1SOINDC01') suddenly stops matching events after an upgrade to Cribl Stream 4.14.1, even though:

• The Route definition and filter expression have not changed.
• The hostname value appears unchanged to the user.
• Manually forcing the filter to check both upper- and lowercase hostnames (for example, host.includes('LI1SOINDC01') || host.includes('li1soindc01')) restores matching.

Environment

• Product: Cribl Stream
• Feature: Routes (JavaScript filter expressions)
• Deployment type: Self-managed
• Version: Observed in Cribl Stream 4.14.1

Resolution

1. In Cribl Stream, open the Routes page for the Worker Group receiving the affected data.
2. Identify the Route whose JavaScript filter expression is no longer matching the expected events (for example, a filter using host.includes('LI1SOINDC01')).
3. Use Capture or a similar preview method on the relevant Source or Route to inspect recent events that should match this Route.
4. In the captured events, check the value of the host field (or the field your filter is using) and note its exact casing (for example, li1soindc01 instead of LI1SOINDC01).
5. Edit the Route’s Filter so it normalizes the field’s casing before performing the comparison. For example, change the filter from:
   • Old filter: host.includes('LI1SOINDC01')
   • New filter: host && host.toLowerCase().includes('li1soindc01')
6. This pattern ensures the comparison succeeds even if the incoming hostname casing changes.
7. Save the Route changes, then commit and deploy the configuration as appropriate for your environment.
8. Repeat the Capture or send test traffic again and verify that events with the expected hostname now match the Route as intended.
9. (Optional) Investigate upstream components (for example, collectors, Sources, or earlier Pipelines) to find where the hostname casing changed, and decide whether to standardize casing at that point as well.

Cause

This can be caused by:

• Upstream systems or configuration changes that alter the case of the hostname field (for example, converting LI1SOINDC01 to li1soindc01) without changing its logical value.
• Assuming that JavaScript String.prototype.includes() and Cribl Stream Route filters are case-insensitive, when they are in fact case-sensitive and evaluated as standard JavaScript expressions.
• Misinterpreting the upgrade impact: the underlying JavaScript string behavior and Stream’s evaluation of JS filters did not change between the involved versions; instead, the incoming data’s casing changed, exposing the existing case-sensitive behavior.

Additional Information

• As a general pattern in Cribl Stream, when matching string fields that may vary in case (such as hostnames or usernames), normalize both the field and the comparison value using .toLowerCase() or .toUpperCase() in JavaScript filter expressions.
• For guidance on choosing efficient JavaScript string functions (includes, indexOf, startsWith, etc.) in Stream filters, see High-Performance JavaScript in Stream – Why the Function in Your Filter Matters.