Destination Post-Processing Pipeline Skipped After Cribl HTTP/TCP Hop From Pack Source

Symptom

In Cribl Stream, events that are forwarded from an upstream Cribl node to an on-prem or hybrid Worker Group over a Cribl HTTP or Cribl TCP destination do not receive the fields from a Pack-scoped destination post-processing pipeline, even though the same pipeline works for other sources (for example, a REST source) on the same worker group and destination.

In Live Capture on the downstream destination, the expected metatag fields from the post-processing pipeline are missing, and the cribl_pipe metadata does not include the post-processing pipeline name for the affected events.

Environment

• Cribl Stream 4.19.0 on a hybrid or on-prem Worker Group receiving events from another Cribl node over a Cribl HTTP or Cribl TCP destination.
• On the upstream node, events are processed inside a Pack where a route uses Send to Worker Group Routes (pack-to-group handoff) before being sent over Cribl HTTP/TCP.
• On the downstream Worker Group, the Cribl HTTP (or TCP) source, a passthrough processing pipeline, the destination post-processing pipeline, and the destination itself are all defined inside the same Pack.

Resolution

1. Navigate to the Cribl leader for the upstream environment (Cribl Edge fleet or Stream worker group) that sends events to the affected Worker Group over Cribl HTTP or Cribl TCP.
2. Open the Cribl HTTP or Cribl TCP destination that forwards events to the downstream Worker Group (the hop immediately before the Worker Group where post-processing is skipped).
3. Expand the Advanced Settings for that destination and locate the Exclude fields (or excludeFields) setting.
4. Add the following internal fields to the exclude list, each as a separate entry:
   • __srcPack
   • __dstPack
   • __packId
5. Save the destination configuration, then Commit and Deploy the changes to the upstream nodes.
6. On the downstream Worker Group, run a Live Capture on the affected destination and verify that:
   • cribl_pipe now includes the post-processing pipeline name for events coming from the upstream node.
   • The expected metatag fields added by the post-processing pipeline are present on those events.

Once these fields are excluded on the upstream Cribl HTTP/TCP destination, the downstream Pack-scoped post-processing pipeline runs as expected for events arriving over that hop.

Cause

This can be caused by transient Pack-context metadata leaking across a Cribl HTTP/TCP hop and corrupting the downstream pipeline-lookup context.

• On the upstream node, when a Pack route is configured with Send to Worker Group Routes, the pipeline engine sets transient internal fields such as __packId and __srcPack on the event to remember which Pack context processed it.
• The Cribl HTTP/TCP destination serializes these internal fields because they are not in the default exclusion list, and the downstream Cribl HTTP/TCP source deserializes them as top-level fields instead of nesting them under __forwardedAttrs.
• On the downstream Worker Group, the event processor sees a truthy __srcPack and resolves the destination’s post-processing pipeline against the global or group pipeline registry instead of the local Pack pipeline registry; the Pack-scoped pipeline is not found in that namespace and is silently skipped.
• REST-sourced events (or other sources that do not traverse an upstream Pack with Send to Worker Group Routes) never receive these Pack-context fields, so they resolve the post-processing pipeline against the correct Pack-local context and work as expected, explaining the difference between source types on the same destination.

Additional Information

• The Exclude-fields workaround removes only internal Pack bookkeeping fields (__srcPack, __dstPack, __packId) and has no impact on payload content or destination behavior beyond restoring correct post-processing.