This Pack is designed for Cribl LogStream users at all levels of experience, and maintained by Cribl Solution Engineers. Every time we solve an interesting use case, our intent is to add it to this Knowledge Pack.
For legibility, the Knowledge Pack is set up according to a simple principle:
The Route name matches the Pipeline name matches the Sample name.
The LogStream techniques explained in the Pack include how to:
- Manipulate time using
strptimeandstrftime. - Split, trim, slice, and join data streams.
- Extract fields without losing data.
- Turn a JSON string into an object literal.
- Validate JSON data against a schema.
- Tag and route data using lookup tables, tags, and output routers.
- Use the Mask Function to decode data.
- Use the Mask Function to convert hex to numbers, and use the
C.Decode.hex()function. - Apply a Mask Function (md5) to any values in the object literal, using multiple wildcards.
- Process Cisco ASA events, using a Lookup Function to drop events, or to return a regex for extracting fields.
- Convert a UTF-16 dynamic-length array into a string, using Spread syntax.
- Extract exception and
calling_methodfrom a stack trace, using split and array references.
- A insatiable thirst for knowledge.
- Knowledge of LogStream
- Power of the Pipeline
And don't see it addressed here? We will solve it, put it in the Pack, and add you to our Contributors list!
The Knowledge Pack is easiest to use like this:
When you first open the Knowledge Pack, the Routes tab should be selected. Use the column selector (
) to display the Description column and hide the Filter and Pipeline/Output columns. This lets you see and compare the Routes' Descriptions.
Once you display your first Pipeline, use the column selector to display Description and hide Filter. These display settings will now apply to all Pipelines.
Here's how to get started actually using the Pack's resources:
- Choose a Route that interests you.
- On the Pipelines tab, display the Pipeline of the same name.
- Open any Comment in the Functions list. The Comment gives you links to relevant LogStream docs. Open the docs in new browser tabs so you can refer to them as you work.
- Notice any Functions whose Description says Leave off, and read the explanation of why you should leave that kind of Function turned off (disabled).
- Turn off all the Functions.
Now, work through the Functions iteratively:
- Turn on the first Function.
- In the Sample Data tab, choose the sample whose name matches your chosen Route and Pipeline.
- Notice what the Function does to the data – and think about what else you might want to do with it!
- Turn on the next Function, repeat steps 3 and 4, etc.
Initial release!
Support for: Cribl LogStream Users
Discuss this pack on our Community Slack channel #packs.
The authors and contributors to this pack are:
David Maislin <david@cribl.io>
Brendan Dalpe <bdalpe@cribl.io>
Jon Rust <jrust@cribl.io>
This Pack uses the following license: Apache 2.0.