This is a brief overview of getting Cribl LogStream up and running on CentOS 7. (LogStream has since been renamed Cribl Stream; the steps are the same.)

Installation

  1. Download Cribl LogStream from cribl.io.

  2. Extract to /opt:

shell tar xzvf cribl-<version>.tgz -C /opt/ cd /opt/cribl

  1. Bootstrap the instance:

shell ./bin/cribl boot-start enable

  1. Start Cribl:

shell ./bin/cribl start

Accessing the Web UI

  1. Cribl listens on port 9000 by default.

http://<server-ip>:9000

  1. Default credentials on first login: - Username: admin - Password: <randomly generated - shown in logs>

  2. Retrieve the initial password:

shell cat /opt/cribl/local/cribl/auth/users.json

Or check the logs:

shell tail -f /opt/cribl/log/cribl.log | grep password

  1. After first login, set a new admin password via the UI.

Firewall Configuration

Open the web UI port:

1
2
firewall-cmd --permanent --add-port=9000/tcp
firewall-cmd --reload

For receiving syslog data, open additional ports:

1
2
3
4
firewall-cmd --permanent --add-port=514/tcp
firewall-cmd --permanent --add-port=514/udp
firewall-cmd --permanent --add-port=10514/tcp  # Custom syslog port
firewall-cmd --reload

Basic Configuration

1. Add a Data Source

Navigate to Data > Sources and add a source:

  • Syslog: Configure port and protocol (TCP/UDP)
  • TCP: Raw TCP input on custom port
  • HTTP: Receive data via HTTP endpoint
  • File: Monitor log files on disk

Example syslog source config:

1
2
3
Protocol: UDP
Port: 514
Format: Auto-detect

2. Add a Route

Navigate to Routing > QuickConnect to route data to destinations.

Example route: - Filter: source == 'syslog' - Pipeline: (optional) syslog_processing - Output: splunk_hec or s3

3. Add a Destination

Navigate to Data > Destinations and configure outputs:

  • Splunk HEC: Send to Splunk via HTTP Event Collector
  • S3: Write to AWS S3 bucket
  • Elasticsearch: Index in Elasticsearch
  • Syslog: Forward to another syslog server

4. Create a Pipeline (Optional)

Navigate to Processing > Pipelines to transform data:

Common pipeline functions: - Eval: Add/modify fields - Drop: Filter out unwanted events - Parser: Extract fields from raw logs - Mask: Redact sensitive data

Example: an Eval function that pulls the first IP address out of syslog messages.

  • Filter: __inputId.startsWith('syslog:')
  • Evaluate Fields → Name: source_ip
  • Evaluate Fields → Value Expression: (_raw.match(/(\d{1,3}\.){3}\d{1,3}/) || [])[0]

Testing

Send a test syslog message:

1
logger -n <cribl-server-ip> -P 514 "Test message from logger"

Monitor live data in Data > Live Data in the UI.

Check metrics in Monitoring > Data Flow.

Running as a Service

Cribl creates a systemd service automatically with boot-start enable:

1
2
3
systemctl status cribl
systemctl restart cribl
systemctl enable cribl

View logs:

1
tail -f /opt/cribl/log/cribl.log

Upgrading

  1. Download the new version.

  2. Stop Cribl:

shell /opt/cribl/bin/cribl stop

  1. Back up your configuration:

shell cp -a /opt/cribl/local /opt/cribl-local-backup-$(date +%F)

  1. Extract the new version over the existing install. The tarball unpacks into cribl/, replacing the binaries and leaving your local/ config in place:

shell tar xzvf cribl-<new-version>.tgz -C /opt/

  1. Start Cribl:

shell /opt/cribl/bin/cribl start