Stream

Occasionally when looking at the Status of my Syslog Source, which has a configured TCP Port of 51111 : Error: Initialization error: bind EADDRINUSE 0.0.0.0:51111I don't have any other Sources or Destinations on the machine configured to leverage that port. I don't see there error on application startup either.

Which Config file stores the configured git branch? I don't see it in cribl.yml

I have a S3 Source configured, to collect Parquet Files, but I end up getting the following error:{ "time": "2023-03-31T00:00:00.000Z", "cid": "w1", "channel": "input:my_parquet_source", "level": "error", "message": "failed to process file", "file": "s3://super-awesome-s3bucket/folder/year=2023/month=03/day=30/hour=00/part-0abcde12-456f-78a9-b01c-de23f4a56b0c.c000.parquet", "receiveCount": 1, "messageId": "0abcde12-456f-78a9-b01c-de23f4a56b0c", "error": { "message": "Error while reading file.", "stack": "Error: malloc of size 65536 failed" }}How can I address this?

When configuring the WEF source, Stream shows the source as working, but the Windows Event Forwarding plugin event logs show: Error Event ID: 107 A subscription policy contains invalid configuration.How do I overcome this error?

I am trying to create multiple metrics events from a single log event. In my log event, I have six metrics and seven dimensions. I would like each metric to output to Prometheus as its own event with all seven dimensions. How can a achieve this?

My leader UI will randomly go down for roughly 10 minutes and when we look at the logs there are no errors that would cause the UI to go down for a period of time. Is there anything that conflicts with the UI’s processes that would cause the UI to go down for a period of time? We would like any guidance on how we would go about figuring out why the UI is none responsive.

Hi,We’re running Cribl in AWS, using ECS to manage docker containers on EC2 instances. We’re trying to tune our instance size and auto-scaling, and wondering if anyone else has any past experience on the matter.For example, should we use memory reservations, and if so what are the best settings for soft and hard limits?If we want to scale when under memory pressure, how do we get this information out?I.e. to know when we’re under memory pressure we need to see heap usage of the worker threads, not just memory usage for the box (since the threads pre-allocate heap), what’s the best way to get this?If anyone has anyone had any luck - good or bad - with this, I’d be keen to hear about your experiences!

I opted to have “Authenticate client (mutual auth)” turned on, which is under Distributed Settings > TLS Settings on the leader, and I also read to make sure to put your certs outside $CRIBL_HOME due to the issue of every time a new config version would be pushed it would overwrite the directory and would remove the certs on the workers. So I placed the certs outside $CRIBL_HOME, and on each worker I had distributed and API TLS (each worker has their own cert) enabled and pointing to the same cert. When I deployed a new config version to the workers, the distributed TLS cert would stay applied, but the API TLS cert would remove itself. This issue doesn’t allow me to access each worker independently via there DNS name using TLS/HTTPS. Is there a way to use the same TLS cert for both API and distributed? So that when a new config is deployed they both stay applied.

Hi, I am not seeing data come in on a Syslog Source I am setting up. But I do see the syslog data coming into the Worker with a TCP Dump. The worker OS is RHEL 9.

Hi,I've added some fields (lookups, etc) from a syslog source and trying to push it into the Log Insight API via a webhook.But, I'm struggling understand how to get it into the format Log Insight wants.I'll say up front, JSON and Javascript is pretty new to me so be gentle 🙂The JSON format Log Insight expects is…{“messages”: [{“fields”: [{“name”: “Field1”, “content”: “Field1_value”},{“name”: “Field2”, “content”: “Field2_value”},{“name”: “Field_xxx”, “content”: “Field_Last_xxx”}],“text”: “original message”,“timestamp”: timestamp}]}I've tried the Serialize to JSON, but it doesn't seem to have a way to arrange the fields for it to output in a custom way.I've seen a post about using Object.fromEntries, but I'm still not able to get working. Not sure if it's even the right way to go.Converting an array into a simplified JSON object:

Hey, if I have an event that is coming into Crible Stream, with format of “<?xml version="1.0" encoding="UTF-8"?>” how would I convert the event to JSON?I see the use of C.Text.parseXml(_raw, false), but that doesnt seem to parse it properly for me. Maybe I’m doing it wrong, but it doesnt seem to get parsed. How would I do that? Tools such as NiFi can convert from XML to JSON easily and quickly, but this seems a bit harder.

I have created an event breaker rule that works in the knowledge area of cribl stream. But when I run a filesystem collection job to pick up the same file I used to create the event breaker, it does not work.Event breaker rules in

I am seeing some irregularities with collecting large files from a filesystem.We batch process files anywhere from 100MB to 100GB in size. I am currently noticing an issue with larger files.To troubleshoot I created a collector that reads the data in, and directly writes it back to disk. No other ETL is done on the data.Result of 1 collectionResult of collecting the same file from the same location using the same event breakers and going to the same destination.My current environment is 1 leader, 1 worker, and the file is being picked up from an NFS mount.As you can see from the screenshots, only 3-4 million of the events are being collected of the ~24 million events in the file. The destination is writing to disk about 5-6 GB from the original ~38GB.There are no errors that I see in the job log, and I can't find any setting regarding worker process limits or job limits that would affect this.

Given a key-value formatted source, routed through a pipeline where data is parsed into JSON then manipulatued, how do I write the new data back out in KV format? Using the filesystem Destination, I’m getting JSON after my pipeline regardless of whether I use Raw or JSON output. I’m assuming there’s a function I’m missing that does this. The closest thing I can find is Serialize, but that doesn’t support KV format.

When I look at Monitoring > Logs, I can’t find logs from scheduled collection jobs using channel.includes(input_name)

Hello,i need some input.We want to have a separate dataflow between different stages within cribl.So we receive data in our prod environment and want to have an extra dataflow to QS stage, to test parsing changes etc.One way we know is to configure a second output wihtin “Output Router”Are there any other ways? Maybe within routes or pipelines?Thank you for your input

I’m writing a custom function and I’m able to add it to a pipeline. However, when I try to process an event, I get an error.Here’s the content of my index.js:exports.name = ‘MyCustomFunction’;exports.group = ‘Custom Functions’;exports.version = 0.1;exports.init = (opts) => {const conf = opts.conf || {};};exports.process = (event) => {return event; // noop};I’m unable to find where, if any, error messages are written to the logs. I looked at the logs under Monitoring (Logs tab) and docker logs with no success.Are errors of this type written anywhere?

Hello,We are trying to enable the cribl metrics to send to Splunk. We are specifically looking for the following metrics:cribl.logstream.host.(in_bytes,in_events,out_bytes,out_events)cribl.logstream.index.(in_bytes,in_events,out_bytes,out_events)cribl.logstream.source.(in_bytes,in_events,out_bytes,out_events)cribl.logstream.sourcetype.(in_bytes,in_events,out_bytes,out_events)The source has been configured with Full Fidelity set to Yes. In the settings under limits, we have removed all the values in Disable Field Metrics on both the leader and worker nodes. We have restarted all the services.The data is still not visible in the Sources → Live Data view.Have we missed a step?Thank you

Hi, we use Cribl 4.0.3 in our environment and have currently issues within a stable connection to Splunk Agents within version 9.0.2.It seems like, that the connection is up and dropping after some minutes.Could it be a possible error with the s2s protocol?In Sources config we can use v4 (beta). Does it work properly? Splunk says in their release document that v3 will be deprecated soon.

Hi,I have question about Cribl monitoring. When I go to Monitoring → Overview in Cribl GUI, I can see data (Free Memory, CPU Load etc.) that is at most 1 day old, because time picker not allows choose longer period. Is there any way how to see older data - for example for 1 week back? And is there any way for other monitoring dashboards with the same time picker setting? Thanks for any hint.Best regardsLukas Mecir

Hello community,we have a bunch of workers in different network zones with different sources (syslog,s2s,tls etc.)How would you prefer to proceed with the groups management?We got 2 options here:All workers in a single group with all sources (if you deploy a new source, all workers need a restart? Not good at all)A group for every network zone, with a worker, with dedicated sources (we think it is really uncomfortable to work with a lot of groups#, because every group has its own configuration)Thanks for feedback and suggestions

In regard to workers in a distributed environment, is there any recommendation on the Network bonding configuration? Would mode 5 balanced-tlb be a better choice than mode 1 active-backup?Thanks

our cribl_pipe field being a json array and they don’t know how to use splunk to mvexpand them, instruct them to use the flatten function instead in a post-processing pipeline.I have multiple values in the cribl_pipe field for my events. How do I correctly process those in Splunk when the events are sent downstream? I’m trying to use mvexpand but it’s not working as desired.

Hi, is it possible for the REST collector to save a checkpoint (e.g. sequential ID of last collected event) and use this as a starting point at the following execution?Something like Splunk’s DB Connect “growing column” setting.

When reviewing license usage in an Enterprise cribl.cloud instance, it’s been noticed that the license page only shows 1TB available, even though more has been provisioned to the Org.