Question
What do the r and b fields mean in TCP source debug log messages that show closed connections? For example:
{"message":"closed connection","r":90642,"b":5954}
Environment
- Cribl Stream
- TCP source with debug logging enabled
Answer
In TCP source closed connection log messages:
r= received events — the total count of events received by the TCP source, captured after the parser processes incoming data.b= broken events — the total count of events generated from event breaking (after the event breaker). This is the number of events produced by the event breaker, not a count of malformed or failed events.
Both values are monotonically increasing counters at the source level, not per individual socket connection. Each closed connection log entry shows the current running totals for the entire source at the time that socket closed. This is why r and b continually increase across multiple log entries.
Important: Despite the name, "broken" in this context refers to events produced by the event breaker process — not malformed events. For single-line data, r and b are typically equal. For multiline event breaking rules, b may be lower than r because multiple received lines are combined into fewer output events. A difference between r and b can also indicate partial or incomplete events at the time a connection closed.
Additional Information
These counters are useful for troubleshooting TCP source ingestion. Because they are source-level totals (not per-connection), compare values across successive closed connection messages to estimate per-connection throughput. A large and growing gap between r and b may indicate that multiline event breaking is combining many input lines into fewer events, or that event breaking is not keeping pace with incoming data.