Skip to main content
Question

Assistance with a REST collector

  • March 11, 2025
  • 2 replies
  • 17 views

Shawn Cannon
Forum|alt.badge.img

I used a standalone test box to get my REST collector working like I wanted.  authentication, discover and collect worked great.  When I moved it into my distributed environment, it errors out but does pull in some events.  The discovery and collect phases are distrubuted across my 5 workers.  It seems like the authentication token may not be working properly when it runs on more than one worker?  I am guessing of course.  I get errors like 503 Service Temporaily Unavailable and 500 Internal Server Error.  This does not happen when I run it from my single standalone test server.  I may need some assistance trying to figure this one out.

2 replies

  • Employee
  • 15 replies
  • March 11, 2025

since this question was posted, we’ve introduced Retries to the REST collector (4.3) - this might be a way around it such that when the API returns a 500, the worker can retry after a certain amount of time with a backoff. might be worth a shot,  https://docs.cribl.io/stream/collectors-rest/#retries


  • Known Participant
  • 26 replies
  • March 11, 2025

@seancannon what other context or logs can you provide if you haven’t figured this out