In a Cribl source could be added fields https://docs.cribl.io/stream/sources-tcp-raw#fields.
So just wondering if such option could be possible also in destinations.
PS: yes, I know I can use post-processing pipelines.
In a Cribl source could be added fields https://docs.cribl.io/stream/sources-tcp-raw#fields.
So just wondering if such option could be possible also in destinations.
PS: yes, I know I can use post-processing pipelines.
Best answer by Dan Schmitz
Pawel, Sources have a Fields config because they're creating events from raw input — they need a way to attach metadata at the point of origin. Destinations are sending already-processed events to an external system, so enrichment happens upstream in the pipeline, not at the delivery point. I do think there may be use cases for enrichment at the destination. Can you expand a little more on the use case of what you are wanting to enrich? Tags on a destination may be a better solution depending on your use case.
Already have an account? Login
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.