Cribl Stream
Using the Webhook destination, and the two near-identical destination types that will not work.
Cribl Stream can post to the datafeed endpoint through its generic HTTP destination. It is common in large estates already running it as a routing layer, and where it is deployed this adds no infrastructure.
Read The datafeed contract first.
Pick the right destination type
Use the Webhook destination. It is Cribl's generic HTTP destination.
Fails silently
Two near-identical names in the catalogue are the wrong thing.
Cribl HTTPis not a generic HTTP destination. It sends to a Cribl HTTP Source, which is to say Cribl-to-Cribl only. It will not talk to Stroom.HTTP/S (Bulk API)is a source, not a destination. If you are browsing a combined list, it is the wrong half of it.
Picking either costs an afternoon, because both look right in a list.
Configuring the webhook destination
Under Manage → Destinations → Add Destination → Webhook:
| Field | Value |
|---|---|
| Endpoint URL | https://stroom.example.com/<base>/datafeed |
| Method | POST |
| Format | Match how upstream data is shaped; NDJSON is usually easiest for a pipeline to parse |
| Extra HTTP headers | Feed: CRIBL_EVENTS, Type: Events, Compression: NONE |
| Auth | Bearer token, from Cribl's secret store |
Authentication
Store the data feed key in Cribl's secrets store and reference it from the destination's auth configuration, rather than typing it into the extra-headers field. Header fields are visible to anyone with configuration read access, and they are included in configuration exports.
Batch shape
The destination's format setting controls the body: NDJSON, a JSON array, or raw. Whichever you choose, the receiving pipeline's parser has to match.
Compression
If you enable the destination's compression, leave the Compression header at NONE. Cribl sets Content-Encoding: gzip, which Stroom's web server decodes before Stroom reads the body. Changing Compression to GZIP as well makes Stroom decompress the body a second time, and every post fails with 500 and Stroom-Status 400.
Persistent queues
Enable Persistent Queues on the destination. Without them, buffering is in memory only, and a worker restart during a Stroom outage loses events.
Several feeds
One destination sends to one feed. Split with Cribl Routes: match on source or event content and send each subset to its own Webhook destination. That is the cleanest way to keep the feed set small and explicit.
A pipeline eval function can set a field that the destination's header references, if you must derive the feed dynamically. Read Choosing a feed first.
How long: immediate
Posting is synchronous, subject to the destination's batching. With persistent queues, delivery during an outage is deferred rather than lost.
Check it worked
Use Cribl's Live Data capture on the destination to see the exact outbound request, headers included, before committing the route to production. Then confirm the stream is on the feed in Stroom.
The check that matters most
Live Data shows the headers you expect, and the stream appears on the feed.
The capture is the fastest way to catch a header that is missing or misspelled, which is otherwise invisible until Stroom rejects it.
This does not prove it worked
A destination reporting healthy is not proof of delivery. It reports Cribl's view of the connection.
Live Data showing a request is not proof it was accepted. Check the response, then check Stroom.
If it isn't working
In order. Each step rules out a class of cause, so don't skip ahead.
- Prove the endpoint without Cribl. Use the
curltest in The datafeed contract. - Is it actually a Webhook destination? See the trap above before anything else.
- What does Live Data show? The outbound request, with headers. Most problems on this page are visible there.
- What do the destination metrics say? Delivery errors and queue depth are the two signals to alert on.
- Does every post fail with
500andStroom-Status400? The destination's compression is on and theCompressionheader saysGZIP. Set it back toNONE. - Check field names against your installed version. Cribl's UI and destination catalogue change across major releases, and this page is written from the documentation rather than from a run.