Question
Can Cribl.Cloud identity event logs be forwarded directly to on-premises or self-managed Cribl Stream workers?
Environment
- Cribl.Cloud
- Cribl Stream managed worker groups in Cribl.Cloud
- On-prem Cribl Stream worker group
Answer
No. Identity event logs in Cribl.Cloud can currently be forwarded only to Cloud-managed Stream worker groups within your Cribl.Cloud organization. On-premises or other self-managed worker groups are not supported as direct forwarding targets for identity event logs. Forwarding targets must be configured as Cloud-managed worker groups exposed in the Cribl.Cloud UI for identity event log forwarding.
Additional Information
If you require on-premises processing or retention of identity event logs, you can:
- Forward identity event logs to a Cloud-managed worker group.
- From that worker group, route the events to on-premises destinations (for example, via secure TCP/HTTP or other supported destinations), subject to your network connectivity and firewall rules.