--- title: "Update a Destination within a Pack" method: PATCH path: "/p/{pack}/system/outputs/{id}" tags: ["destinations"] --- # Update a Destination within a Pack `PATCH /p/{pack}/system/outputs/{id}` Update the specified Destination.

Provide a complete representation of the Destination that you want to update in the request body. This endpoint does not support partial updates. Cribl removes any omitted fields when updating the Destination.

Confirm that the configuration in your request body is correct before sending the request. If the configuration is incorrect, the updated Destination might not function as expected within the specified Pack. ## Path parameters - `id` string, required - `pack` string, required ## Request body - union - OutputDefault - `id` string — Unique ID for this output - `type` 'default', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `defaultId` string, nullable, required — ID of the default output. This will be used whenever a nonexistent/deleted output is referenced. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - union - object - `id` string — Unique ID for this output - `type` 'webhook', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `method` 'POST' | 'PUT' | 'PATCH' — The method to use when sending events - `format` 'ndjson' | 'json_array' | 'custom' | 'advanced' — How to format events before sending out - `keepAlive` boolean — Disable to close the connection immediately after sending the outgoing request - `concurrency` number — Maximum number of ongoing requests before blocking - `maxPayloadSizeKB` number — Maximum size, in KB, of the request body - `maxPayloadEvents` number — Maximum number of events to include in the request body. Default is 0 (unlimited). - `compress` boolean — Compress the payload body before sending - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's). Enabled by default. When this setting is also present in TLS Settings (Client Side), that value will take precedence. - `timeoutSec` number — Amount of time, in seconds, to wait for a request to complete before canceling it - `maxConnectionReuseSec` number — How long, in seconds, to reuse a keep-alive connection after its first use before forcing it closed. Set to 0 to disable the time-based close and reuse connections for as long as the destination server permits. - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Body size limit. - `extraHttpHeaders` ExtraHttpHeaderConfInputElastic[] — Headers to add to all events. You can also add headers dynamically on a per-event basis in the __headers field, as explained in [Cribl Docs](https://docs.cribl.io/stream/destinations-webhook/#internal-fields). - `name` string — Field Name - `value` string, required — Field Value - `useRoundRobinDns` boolean — Enable round-robin DNS lookup. When a DNS server returns multiple addresses, @{product} will cycle through them in the order returned. For optimal performance, consider enabling this setting for non-load balanced destinations. - `failedRequestLoggingMode` 'payload' | 'payloadAndHeaders' | 'none' — Data to log when a request fails. All headers are redacted by default, unless listed as safe headers below. - `safeHeaders` string[] — List of headers that are safe to log in plain text - `responseRetrySettings` ResponseRetrySettingConfOutputWebhook[] — Automatically retry after unsuccessful response status codes, such as 429 (Too Many Requests) or 503 (Service Unavailable) - `httpStatus` number, required — The HTTP response status code that will trigger retries - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `timeoutRetrySettings` TimeoutRetrySettingsType - `timeoutRetry` boolean, required — Retry timed-out HTTP requests - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `responseHonorRetryAfterHeader` boolean — Honor any Retry-After header that specifies a delay (in seconds) no longer than 180 seconds after the retry request. @{product} limits the delay to 180 seconds, even if the Retry-After header specifies a longer delay. When enabled, takes precedence over user-configured retry options. When disabled, all Retry-After headers are ignored. - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `authType` 'none' | 'basic' | 'credentialsSecret' | 'token' | 'textSecret' | 'oauth' — Authentication method to use for the HTTP request - `tls` TlsSettingsClientSideTypeCaPathCertPathExtended — TLS settings (client side) - `disabled` boolean — Disabled - `servername` string — Server name for the SNI (Server Name Indication) TLS extension. It must be a host name, and not an IP address. - `certificateName` string — The name of the predefined certificate - `caPath` string — Path on client in which to find CA certificates to verify the server's cert. PEM format. Can reference $ENV_VARS. - `privKeyPath` string — Path on client in which to find the private key to use. PEM format. Can reference $ENV_VARS. - `certPath` string — Path on client in which to find certificates to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `totalMemoryLimitKB` number — Maximum total size of the batches waiting to be sent. If left blank, defaults to 5 times the max body size (if set). If 0, no limit is enforced. - `loadBalanced` boolean — Enable for optimal performance. Even if you have one hostname, it can expand to multiple IPs. If disabled, consider enabling round-robin DNS. - `description` string — Optional description for this configuration. - `customSourceExpression` string — Expression to evaluate on events to generate output. Example: `raw=${_raw}`. See [Cribl Docs](https://docs.cribl.io/stream/destinations-webhook#custom-format) for other examples. If empty, the full event is sent as stringified JSON. - `customDropWhenNull` boolean — Whether to drop events when the source expression evaluates to null - `customEventDelimiter` string — Delimiter string to insert between individual events. Defaults to newline character. - `customContentType` string — Content type to use for request. Defaults to application/x-ndjson. Any content types set in Advanced Settings > Extra HTTP headers will override this entry. - `customPayloadExpression` string — Expression specifying how to format the payload for each batch. To reference the events to send, use the `${events}` variable. Example expression: `{ "items" : [${events}] }` would send the batch inside a JSON object. - `advancedContentType` string — HTTP content-type header value - `formatEventCode` string — Custom JavaScript code to format incoming event data accessible through the __e variable. The formatted content is added to (__e['__eventOut']) if available. Otherwise, the original event is serialized as JSON. Caution: This function is evaluated in an unprotected context, allowing you to execute almost any JavaScript code. - `formatPayloadCode` string — Optional JavaScript code to format the payload sent to the Destination. The payload, containing a batch of formatted events, is accessible through the __e['payload'] variable. The formatted payload is returned in the __e['__payloadOut'] variable. Caution: This function is evaluated in an unprotected context, allowing you to execute almost any JavaScript code. - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `username` string — Username - `password` string — Password - `token` string — Bearer token to include in the authorization header - `credentialsSecret` string — Select or create a secret that references your credentials - `textSecret` string — Select or create a stored text secret - `loginUrl` string — URL for OAuth - `secretParamName` string — Secret parameter name to pass in request body - `secret` string — Secret parameter value to pass in request body - `tokenAttributeName` string — Name of the auth token attribute in the OAuth response. Can be top-level (e.g., 'token'); or nested, using a period (e.g., 'data.token'). - `authHeaderExpr` string — JavaScript expression to compute the Authorization header value to pass in requests. The value `${token}` is used to reference the token obtained from authentication, e.g.: `Bearer ${token}`. - `tokenTimeoutSecs` number — How often the OAuth token should be refreshed. - `oauthParams` OauthParamConfInputServicenowTable[] — Additional parameters to send in the OAuth login request. @{product} will combine the secret with these parameters, and will send the URL-encoded result in a POST request to the endpoint specified in the 'Login URL'. We'll automatically add the content-type header 'application/x-www-form-urlencoded' when sending this request. - `name` string, required — OAuth parameter name - `value` string, required — OAuth parameter value - `oauthHeaders` OauthHeaderConfInputServicenowTable[] — Additional headers to send in the OAuth login request. @{product} will automatically add the content-type header 'application/x-www-form-urlencoded' when sending this request. - `name` string, required — OAuth header name - `value` string, required — OAuth header value - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, @{product} will use the refresh token to obtain new access tokens without re-sending credentials. - `rotateRefreshToken` boolean — @{product} will update the stored value on each successful refresh. Enable if the server issues a new refresh token on every use. - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL. - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauthSecret[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, @{product} sends only grant_type, refresh_token, and client_secret. - `name` string, required — Name - `value` string, required — Value - `url` string, required — URL of a webhook endpoint to send events to, such as http://localhost:10200 - `excludeSelf` boolean — Exclude all IPs of the current host from the list of any resolved hostnames - `urls` object[] — Webhook URLs - `url` string, required — URL of a webhook endpoint to send events to, such as http://localhost:10200 - `weight` number — Assign a weight (>0) to each endpoint to indicate its traffic-handling capability - `__template_url` string — Binds 'url' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'url' at runtime. - `dnsResolvePeriodSec` number — The interval in which to re-resolve any hostnames and pick up destinations from A records - `loadBalanceStatsPeriodSec` number — How far back in time to keep traffic stats for load balancing purposes - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_failedRequestLoggingMode` string — Binds 'failedRequestLoggingMode' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'failedRequestLoggingMode' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime. - `__template_secret` string — Binds 'secret' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'secret' at runtime. - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime. - `__template_url` string — Binds 'url' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'url' at runtime. - object - `id` string — Unique ID for this output - `type` 'webhook', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `method` 'POST' | 'PUT' | 'PATCH' — The method to use when sending events - `format` 'ndjson' | 'json_array' | 'custom' | 'advanced' — How to format events before sending out - `keepAlive` boolean — Disable to close the connection immediately after sending the outgoing request - `concurrency` number — Maximum number of ongoing requests before blocking - `maxPayloadSizeKB` number — Maximum size, in KB, of the request body - `maxPayloadEvents` number — Maximum number of events to include in the request body. Default is 0 (unlimited). - `compress` boolean — Compress the payload body before sending - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's). Enabled by default. When this setting is also present in TLS Settings (Client Side), that value will take precedence. - `timeoutSec` number — Amount of time, in seconds, to wait for a request to complete before canceling it - `maxConnectionReuseSec` number — How long, in seconds, to reuse a keep-alive connection after its first use before forcing it closed. Set to 0 to disable the time-based close and reuse connections for as long as the destination server permits. - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Body size limit. - `extraHttpHeaders` ExtraHttpHeaderConfInputElastic[] — Headers to add to all events. You can also add headers dynamically on a per-event basis in the __headers field, as explained in [Cribl Docs](https://docs.cribl.io/stream/destinations-webhook/#internal-fields). - `name` string — Field Name - `value` string, required — Field Value - `useRoundRobinDns` boolean — Enable round-robin DNS lookup. When a DNS server returns multiple addresses, @{product} will cycle through them in the order returned. For optimal performance, consider enabling this setting for non-load balanced destinations. - `failedRequestLoggingMode` 'payload' | 'payloadAndHeaders' | 'none' — Data to log when a request fails. All headers are redacted by default, unless listed as safe headers below. - `safeHeaders` string[] — List of headers that are safe to log in plain text - `responseRetrySettings` ResponseRetrySettingConfOutputWebhook[] — Automatically retry after unsuccessful response status codes, such as 429 (Too Many Requests) or 503 (Service Unavailable) - `httpStatus` number, required — The HTTP response status code that will trigger retries - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `timeoutRetrySettings` TimeoutRetrySettingsType - `timeoutRetry` boolean, required — Retry timed-out HTTP requests - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `responseHonorRetryAfterHeader` boolean — Honor any Retry-After header that specifies a delay (in seconds) no longer than 180 seconds after the retry request. @{product} limits the delay to 180 seconds, even if the Retry-After header specifies a longer delay. When enabled, takes precedence over user-configured retry options. When disabled, all Retry-After headers are ignored. - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `authType` 'none' | 'basic' | 'credentialsSecret' | 'token' | 'textSecret' | 'oauth' — Authentication method to use for the HTTP request - `tls` TlsSettingsClientSideTypeCaPathCertPathExtended — TLS settings (client side) - `disabled` boolean — Disabled - `servername` string — Server name for the SNI (Server Name Indication) TLS extension. It must be a host name, and not an IP address. - `certificateName` string — The name of the predefined certificate - `caPath` string — Path on client in which to find CA certificates to verify the server's cert. PEM format. Can reference $ENV_VARS. - `privKeyPath` string — Path on client in which to find the private key to use. PEM format. Can reference $ENV_VARS. - `certPath` string — Path on client in which to find certificates to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `totalMemoryLimitKB` number — Maximum total size of the batches waiting to be sent. If left blank, defaults to 5 times the max body size (if set). If 0, no limit is enforced. - `loadBalanced` boolean — Enable for optimal performance. Even if you have one hostname, it can expand to multiple IPs. If disabled, consider enabling round-robin DNS. - `description` string — Optional description for this configuration. - `customSourceExpression` string — Expression to evaluate on events to generate output. Example: `raw=${_raw}`. See [Cribl Docs](https://docs.cribl.io/stream/destinations-webhook#custom-format) for other examples. If empty, the full event is sent as stringified JSON. - `customDropWhenNull` boolean — Whether to drop events when the source expression evaluates to null - `customEventDelimiter` string — Delimiter string to insert between individual events. Defaults to newline character. - `customContentType` string — Content type to use for request. Defaults to application/x-ndjson. Any content types set in Advanced Settings > Extra HTTP headers will override this entry. - `customPayloadExpression` string — Expression specifying how to format the payload for each batch. To reference the events to send, use the `${events}` variable. Example expression: `{ "items" : [${events}] }` would send the batch inside a JSON object. - `advancedContentType` string — HTTP content-type header value - `formatEventCode` string — Custom JavaScript code to format incoming event data accessible through the __e variable. The formatted content is added to (__e['__eventOut']) if available. Otherwise, the original event is serialized as JSON. Caution: This function is evaluated in an unprotected context, allowing you to execute almost any JavaScript code. - `formatPayloadCode` string — Optional JavaScript code to format the payload sent to the Destination. The payload, containing a batch of formatted events, is accessible through the __e['payload'] variable. The formatted payload is returned in the __e['__payloadOut'] variable. Caution: This function is evaluated in an unprotected context, allowing you to execute almost any JavaScript code. - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `username` string — Username - `password` string — Password - `token` string — Bearer token to include in the authorization header - `credentialsSecret` string — Select or create a secret that references your credentials - `textSecret` string — Select or create a stored text secret - `loginUrl` string — URL for OAuth - `secretParamName` string — Secret parameter name to pass in request body - `secret` string — Secret parameter value to pass in request body - `tokenAttributeName` string — Name of the auth token attribute in the OAuth response. Can be top-level (e.g., 'token'); or nested, using a period (e.g., 'data.token'). - `authHeaderExpr` string — JavaScript expression to compute the Authorization header value to pass in requests. The value `${token}` is used to reference the token obtained from authentication, e.g.: `Bearer ${token}`. - `tokenTimeoutSecs` number — How often the OAuth token should be refreshed. - `oauthParams` OauthParamConfInputServicenowTable[] — Additional parameters to send in the OAuth login request. @{product} will combine the secret with these parameters, and will send the URL-encoded result in a POST request to the endpoint specified in the 'Login URL'. We'll automatically add the content-type header 'application/x-www-form-urlencoded' when sending this request. - `name` string, required — OAuth parameter name - `value` string, required — OAuth parameter value - `oauthHeaders` OauthHeaderConfInputServicenowTable[] — Additional headers to send in the OAuth login request. @{product} will automatically add the content-type header 'application/x-www-form-urlencoded' when sending this request. - `name` string, required — OAuth header name - `value` string, required — OAuth header value - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, @{product} will use the refresh token to obtain new access tokens without re-sending credentials. - `rotateRefreshToken` boolean — @{product} will update the stored value on each successful refresh. Enable if the server issues a new refresh token on every use. - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL. - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauthSecret[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, @{product} sends only grant_type, refresh_token, and client_secret. - `name` string, required — Name - `value` string, required — Value - `url` string — URL of a webhook endpoint to send events to, such as http://localhost:10200 - `excludeSelf` boolean — Exclude all IPs of the current host from the list of any resolved hostnames - `urls` object[], required — Webhook URLs - `url` string, required — URL of a webhook endpoint to send events to, such as http://localhost:10200 - `weight` number — Assign a weight (>0) to each endpoint to indicate its traffic-handling capability - `__template_url` string — Binds 'url' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'url' at runtime. - `dnsResolvePeriodSec` number — The interval in which to re-resolve any hostnames and pick up destinations from A records - `loadBalanceStatsPeriodSec` number — How far back in time to keep traffic stats for load balancing purposes - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_failedRequestLoggingMode` string — Binds 'failedRequestLoggingMode' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'failedRequestLoggingMode' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime. - `__template_secret` string — Binds 'secret' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'secret' at runtime. - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime. - `__template_url` string — Binds 'url' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'url' at runtime. - OutputSentinel - `id` string — Unique ID for this output - `type` 'sentinel', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `keepAlive` boolean — Disable to close the connection immediately after sending the outgoing request - `concurrency` number — Maximum number of ongoing requests before blocking - `maxPayloadSizeKB` number — Maximum size (KB) of the request body (defaults to the API's maximum limit of 1000 KB) - `maxPayloadEvents` number — Maximum number of events to include in the request body. Default is 0 (unlimited). - `compress` boolean — Compress the payload body before sending - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's). Enabled by default. When this setting is also present in TLS Settings (Client Side), that value will take precedence. - `timeoutSec` number — Amount of time, in seconds, to wait for a request to complete before canceling it - `maxConnectionReuseSec` number — How long, in seconds, to reuse a keep-alive connection after its first use before forcing it closed. Set to 0 to disable the time-based close and reuse connections for as long as the destination server permits. - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Body size limit. - `extraHttpHeaders` ExtraHttpHeaderConfInputElastic[] — Headers to add to all events. You can also add headers dynamically on a per-event basis in the __headers field, as explained in [Cribl Docs](https://docs.cribl.io/stream/destinations-webhook/#internal-fields). - `name` string — Field Name - `value` string, required — Field Value - `useRoundRobinDns` boolean — Enable round-robin DNS lookup. When a DNS server returns multiple addresses, @{product} will cycle through them in the order returned. For optimal performance, consider enabling this setting for non-load balanced destinations. - `failedRequestLoggingMode` 'payload' | 'payloadAndHeaders' | 'none' — Data to log when a request fails. All headers are redacted by default, unless listed as safe headers below. - `safeHeaders` string[] — List of headers that are safe to log in plain text - `responseRetrySettings` ResponseRetrySettingConfOutputWebhook[] — Automatically retry after unsuccessful response status codes, such as 429 (Too Many Requests) or 503 (Service Unavailable) - `httpStatus` number, required — The HTTP response status code that will trigger retries - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `timeoutRetrySettings` TimeoutRetrySettingsType - `timeoutRetry` boolean, required — Retry timed-out HTTP requests - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `responseHonorRetryAfterHeader` boolean — Honor any Retry-After header that specifies a delay (in seconds) no longer than 180 seconds after the retry request. @{product} limits the delay to 180 seconds, even if the Retry-After header specifies a longer delay. When enabled, takes precedence over user-configured retry options. When disabled, all Retry-After headers are ignored. - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `authType` 'oauth' — Discriminator value. - `loginUrl` string, required — URL for OAuth - `secret` string, required — Secret parameter value to pass in request body - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, @{product} will use the refresh token to obtain new access tokens without re-sending credentials. - `rotateRefreshToken` boolean — @{product} will update the stored value on each successful refresh. Enable if the server issues a new refresh token on every use. - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL. - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauthSecret[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, @{product} sends only grant_type, refresh_token, and client_secret. - `name` string, required — Name - `value` string, required — Value - `client_id` string, required — JavaScript expression to compute the Client ID for the Azure application. Can be a constant. - `scope` string — Scope to pass in the OAuth request - `endpointURLConfiguration` 'url' | 'ID', required — Enter the data collection endpoint URL or the individual ID - `totalMemoryLimitKB` number — Maximum total size of the batches waiting to be sent. If left blank, defaults to 5 times the max body size (if set). If 0, no limit is enforced. - `description` string — Optional description for this configuration. - `format` 'ndjson' | 'json_array' | 'custom' | 'advanced' - `customSourceExpression` string — Expression to evaluate on events to generate output. Example: `raw=${_raw}`. See [Cribl Docs](https://docs.cribl.io/stream/destinations-webhook#custom-format) for other examples. If empty, the full event is sent as stringified JSON. - `customDropWhenNull` boolean — Whether to drop events when the source expression evaluates to null - `customEventDelimiter` string — Delimiter string to insert between individual events. Defaults to newline character. - `customContentType` string — Content type to use for request. Defaults to application/x-ndjson. Any content types set in Advanced Settings > Extra HTTP headers will override this entry. - `customPayloadExpression` string — Expression specifying how to format the payload for each batch. To reference the events to send, use the `${events}` variable. Example expression: `{ "items" : [${events}] }` would send the batch inside a JSON object. - `advancedContentType` string — HTTP content-type header value - `formatEventCode` string — Custom JavaScript code to format incoming event data accessible through the __e variable. The formatted content is added to (__e['__eventOut']) if available. Otherwise, the original event is serialized as JSON. Caution: This function is evaluated in an unprotected context, allowing you to execute almost any JavaScript code. - `formatPayloadCode` string — Optional JavaScript code to format the payload sent to the Destination. The payload, containing a batch of formatted events, is accessible through the __e['payload'] variable. The formatted payload is returned in the __e['__payloadOut'] variable. Caution: This function is evaluated in an unprotected context, allowing you to execute almost any JavaScript code. - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `url` string — URL to send events to. Can be overwritten by an event's __url field. - `dcrID` string — Immutable ID for the Data Collection Rule (DCR) - `dceEndpoint` string — Data collection endpoint (DCE) URL. In the format: `https://-..ingest.monitor.azure.com` - `streamName` string — The name of the stream (Sentinel table) in which to store the events - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_failedRequestLoggingMode` string — Binds 'failedRequestLoggingMode' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'failedRequestLoggingMode' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime. - `__template_secret` string — Binds 'secret' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'secret' at runtime. - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime. - `__template_client_id` string — Binds 'client_id' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'client_id' at runtime. - `__template_scope` string — Binds 'scope' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'scope' at runtime. - `__template_url` string — Binds 'url' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'url' at runtime. - `__template_dcrID` string — Binds 'dcrID' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'dcrID' at runtime. - `__template_dceEndpoint` string — Binds 'dceEndpoint' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'dceEndpoint' at runtime. - `__template_streamName` string — Binds 'streamName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamName' at runtime. - OutputDevnull - `id` string — Unique ID for this output - `type` 'devnull', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - OutputSyslog - `id` string — Unique ID for this output - `type` 'syslog', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `protocol` 'tcp' | 'udp' — The network protocol to use for sending out syslog messages - `facility` 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 — Default value for message facility. Will be overwritten by value of __facility if set. Defaults to user. - `severity` 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 — Default value for message severity. Will be overwritten by value of __severity if set. Defaults to notice. - `appName` string — Default name for device or application that originated the message. Defaults to Cribl, but will be overwritten by value of __appname if set. - `messageFormat` 'rfc3164' | 'rfc5424' — The syslog message format depending on the receiver's support - `timestampFormat` 'syslog' | 'iso8601' — Timestamp format to use when serializing event's time field - `throttleRatePerSec` string — Rate (in bytes per second) to throttle while writing to an output. Accepts values with multiple-byte units, such as KB, MB, and GB. (Example: 42 MB) Default value of 0 specifies no throttling. - `octetCountFraming` boolean — Prefix messages with the byte count of the message. If disabled, no prefix will be set, and the message will be appended with a \n. - `logFailedRequests` boolean — Use to troubleshoot issues with sending data - `description` string — Optional description for this configuration. - `loadBalanced` boolean — For optimal performance, enable load balancing even if you have one hostname, as it can expand to multiple IPs. If this setting is disabled, consider enabling round-robin DNS. - `host` string — The hostname of the receiver - `port` number — The port to connect to on the provided host - `excludeSelf` boolean — Exclude all IPs of the current host from the list of any resolved hostnames - `hosts` HostConfOutputSyslog[] — Set of hosts to load-balance data to - `host` string, required — The hostname of the receiver - `port` number, required — The port to connect to on the provided host - `tls` 'inherit' | 'off' — Whether to inherit TLS configs from group setting or disable TLS - `servername` string — Servername to use if establishing a TLS connection. If not specified, defaults to connection host (if not an IP); otherwise, uses the global TLS settings. - `weight` number — Assign a weight (>0) to each endpoint to indicate its traffic-handling capability - `__template_host` string — Binds 'host' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'host' at runtime. - `__template_port` string — Binds 'port' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'port' at runtime. - `dnsResolvePeriodSec` number — The interval in which to re-resolve any hostnames and pick up destinations from A records - `loadBalanceStatsPeriodSec` number — How far back in time to keep traffic stats for load balancing purposes - `maxConcurrentSenders` number — Maximum number of concurrent connections (per Worker Process). A random set of IPs will be picked on every DNS resolution period. Use 0 for unlimited. - `connectionTimeout` number — Amount of time (milliseconds) to wait for the connection to establish before retrying - `writeTimeout` number — Amount of time (milliseconds) to wait for a write to complete before assuming connection is dead - `tls` TlsSettingsClientSideTypeCaPathCertPath — TLS settings (client side) - `disabled` boolean — Disabled - `rejectUnauthorized` boolean — Reject certificates that are not authorized by a CA in the CA certificate path, or by another trusted CA (such as the system's). Defaults to Enabled. Overrides the toggle from Advanced Settings, when also present. - `servername` string — Server name for the SNI (Server Name Indication) TLS extension. It must be a host name, and not an IP address. - `certificateName` string — The name of the predefined certificate - `caPath` string — Path on client in which to find CA certificates to verify the server's cert. PEM format. Can reference $ENV_VARS. - `privKeyPath` string — Path on client in which to find the private key to use. PEM format. Can reference $ENV_VARS. - `certPath` string — Path on client in which to find certificates to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `maxRecordSize` number — Maximum size of syslog messages. Make sure this value is less than or equal to the MTU to avoid UDP packet fragmentation. - `udpDnsResolvePeriodSec` number — How often to resolve the destination hostname to an IP address. Ignored if the destination is an IP address. A value of 0 means every message sent will incur a DNS lookup. - `enableIpSpoofing` boolean — Send Syslog traffic using the original event's Source IP and port. To enable this, you must install the external `udp-sender` helper binary at `/usr/bin/udp-sender` on all Worker Nodes and grant it the `CAP_NET_RAW` capability. - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_host` string — Binds 'host' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'host' at runtime. - `__template_port` string — Binds 'port' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'port' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - OutputSplunk - `id` string — Unique ID for this output - `type` 'splunk', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `host` string, required — The hostname of the receiver - `port` number, required — The port to connect to on the provided host - `nestedFields` 'json' | 'none' — How to serialize nested fields into index-time fields - `throttleRatePerSec` string — Rate (in bytes per second) to throttle while writing to an output. Accepts values with multiple-byte units, such as KB, MB, and GB. (Example: 42 MB) Default value of 0 specifies no throttling. - `connectionTimeout` number — Amount of time (milliseconds) to wait for the connection to establish before retrying - `writeTimeout` number — Amount of time (milliseconds) to wait for a write to complete before assuming connection is dead - `tls` TlsSettingsClientSideTypeCaPathCertPath — TLS settings (client side) - `disabled` boolean — Disabled - `rejectUnauthorized` boolean — Reject certificates that are not authorized by a CA in the CA certificate path, or by another trusted CA (such as the system's). Defaults to Enabled. Overrides the toggle from Advanced Settings, when also present. - `servername` string — Server name for the SNI (Server Name Indication) TLS extension. It must be a host name, and not an IP address. - `certificateName` string — The name of the predefined certificate - `caPath` string — Path on client in which to find CA certificates to verify the server's cert. PEM format. Can reference $ENV_VARS. - `privKeyPath` string — Path on client in which to find the private key to use. PEM format. Can reference $ENV_VARS. - `certPath` string — Path on client in which to find certificates to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `enableMultiMetrics` boolean — Output metrics in multiple-metric format in a single event. Supported in Splunk 8.0 and above. - `enableACK` boolean — Check if indexer is shutting down and stop sending data. This helps minimize data loss during shutdown. - `logFailedRequests` boolean — Use to troubleshoot issues with sending data - `maxS2Sversion` 'v3' | 'v4' — The highest S2S protocol version to advertise during handshake - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `authType` 'manual' | 'secret' — Select Manual to enter an auth token directly, or select Secret to use a text secret to authenticate - `description` string — Optional description for this configuration. - `maxFailedHealthChecks` number — Maximum number of times healthcheck can fail before we close connection. If set to 0 (disabled), and the connection to Splunk is forcibly closed, some data loss might occur. - `compress` 'disabled' | 'auto' | 'always' — Controls whether the sender should send compressed data to the server. Select 'Disabled' to reject compressed connections or 'Always' to ignore server's configuration and send compressed data. - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `authToken` string — Shared secret token to use when establishing a connection to a Splunk indexer. - `textSecret` string — Select or create a stored text secret - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_host` string — Binds 'host' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'host' at runtime. - `__template_port` string — Binds 'port' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'port' at runtime. - `__template_nestedFields` string — Binds 'nestedFields' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'nestedFields' at runtime. - `__template_maxS2Sversion` string — Binds 'maxS2Sversion' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'maxS2Sversion' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_compress` string — Binds 'compress' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'compress' at runtime. - OutputSplunkLb - `id` string — Unique ID for this output - `type` 'splunk_lb', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `dnsResolvePeriodSec` number — The interval in which to re-resolve any hostnames and pick up destinations from A records - `loadBalanceStatsPeriodSec` number — How far back in time to keep traffic stats for load balancing purposes - `maxConcurrentSenders` number — Maximum number of concurrent connections (per Worker Process). A random set of IPs will be picked on every DNS resolution period. Use 0 for unlimited. - `nestedFields` 'json' | 'none' — How to serialize nested fields into index-time fields - `throttleRatePerSec` string — Rate (in bytes per second) to throttle while writing to an output. Accepts values with multiple-byte units, such as KB, MB, and GB. (Example: 42 MB) Default value of 0 specifies no throttling. - `connectionTimeout` number — Amount of time (milliseconds) to wait for the connection to establish before retrying - `writeTimeout` number — Amount of time (milliseconds) to wait for a write to complete before assuming connection is dead - `tls` TlsSettingsClientSideTypeCaPathCertPath — TLS settings (client side) - `disabled` boolean — Disabled - `rejectUnauthorized` boolean — Reject certificates that are not authorized by a CA in the CA certificate path, or by another trusted CA (such as the system's). Defaults to Enabled. Overrides the toggle from Advanced Settings, when also present. - `servername` string — Server name for the SNI (Server Name Indication) TLS extension. It must be a host name, and not an IP address. - `certificateName` string — The name of the predefined certificate - `caPath` string — Path on client in which to find CA certificates to verify the server's cert. PEM format. Can reference $ENV_VARS. - `privKeyPath` string — Path on client in which to find the private key to use. PEM format. Can reference $ENV_VARS. - `certPath` string — Path on client in which to find certificates to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `enableMultiMetrics` boolean — Output metrics in multiple-metric format in a single event. Supported in Splunk 8.0 and above. - `enableACK` boolean — Check if indexer is shutting down and stop sending data. This helps minimize data loss during shutdown. - `logFailedRequests` boolean — Use to troubleshoot issues with sending data - `maxS2Sversion` 'v3' | 'v4' — The highest S2S protocol version to advertise during handshake - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `indexerDiscovery` boolean — Automatically discover indexers in indexer clustering environment. - `senderUnhealthyTimeAllowance` number — How long (in milliseconds) each LB endpoint can report blocked before the Destination reports unhealthy, blocking the sender. (Grace period for fluctuations.) Use 0 to disable; max 1 minute. - `authType` 'manual' | 'secret' — Select Manual to enter an auth token directly, or select Secret to use a text secret to authenticate - `description` string — Optional description for this configuration. - `maxFailedHealthChecks` number — Maximum number of times healthcheck can fail before we close connection. If set to 0 (disabled), and the connection to Splunk is forcibly closed, some data loss might occur. - `compress` 'disabled' | 'auto' | 'always' — Controls whether the sender should send compressed data to the server. Select 'Disabled' to reject compressed connections or 'Always' to ignore server's configuration and send compressed data. - `indexerDiscoveryConfigs` object — List of configurations to set up indexer discovery in Splunk Indexer clustering environment. - `site` string, required — Clustering site of the indexers from where indexers need to be discovered. In case of single site cluster, it defaults to 'default' site. - `masterUri` string, required — Full URI of Splunk cluster manager (scheme://host:port). Example: https://managerAddress:8089 - `refreshIntervalSec` number, required — Time interval, in seconds, between two consecutive indexer list fetches from cluster manager - `rejectUnauthorized` boolean — During indexer discovery, reject cluster manager certificates that are not authorized by the system's CA. Disable to allow untrusted (for example, self-signed) certificates. - `authTokens` object[] — Tokens required to authenticate to cluster manager for indexer discovery - `authType` 'manual' | 'secret' — Select Manual to enter an auth token directly, or select Secret to use a text secret to authenticate - `authToken` string — Shared secret to be provided by any client (in authToken header field). If empty, unauthorized access is permitted. - `textSecret` string — Select or create a stored text secret - `authType` 'manual' | 'secret' — Select Manual to enter an auth token directly, or select Secret to use a text secret to authenticate - `authToken` string — Shared secret to be provided by any client (in authToken header field). If empty, unauthorized access is permitted. - `textSecret` string — Select or create a stored text secret - `excludeSelf` boolean — Exclude all IPs of the current host from the list of any resolved hostnames - `hosts` HostConfOutputSyslog[], required — Set of Splunk indexers to load-balance data to. - `host` string, required — The hostname of the receiver - `port` number, required — The port to connect to on the provided host - `tls` 'inherit' | 'off' — Whether to inherit TLS configs from group setting or disable TLS - `servername` string — Servername to use if establishing a TLS connection. If not specified, defaults to connection host (if not an IP); otherwise, uses the global TLS settings. - `weight` number — Assign a weight (>0) to each endpoint to indicate its traffic-handling capability - `__template_host` string — Binds 'host' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'host' at runtime. - `__template_port` string — Binds 'port' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'port' at runtime. - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `authToken` string — Shared secret token to use when establishing a connection to a Splunk indexer. - `textSecret` string — Select or create a stored text secret - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_nestedFields` string — Binds 'nestedFields' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'nestedFields' at runtime. - `__template_maxS2Sversion` string — Binds 'maxS2Sversion' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'maxS2Sversion' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_compress` string — Binds 'compress' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'compress' at runtime. - OutputSplunkHec - `id` string — Unique ID for this output - `type` 'splunk_hec', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `loadBalanced` boolean — Enable for optimal performance. Even if you have one hostname, it can expand to multiple IPs. If disabled, consider enabling round-robin DNS. - `tls` TlsSettingsClientSideTypeCaPathCertPathExtended — TLS settings (client side) - `disabled` boolean — Disabled - `servername` string — Server name for the SNI (Server Name Indication) TLS extension. It must be a host name, and not an IP address. - `certificateName` string — The name of the predefined certificate - `caPath` string — Path on client in which to find CA certificates to verify the server's cert. PEM format. Can reference $ENV_VARS. - `privKeyPath` string — Path on client in which to find the private key to use. PEM format. Can reference $ENV_VARS. - `certPath` string — Path on client in which to find certificates to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `concurrency` number — Maximum number of ongoing requests before blocking - `maxPayloadSizeKB` number — Maximum size, in KB, of the request body - `maxPayloadEvents` number — Maximum number of events to include in the request body. Default is 0 (unlimited). - `compress` boolean — Compress the payload body before sending - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's). Enabled by default. When this setting is also present in TLS Settings (Client Side), that value will take precedence. - `timeoutSec` number — Amount of time, in seconds, to wait for a request to complete before canceling it - `maxConnectionReuseSec` number — How long, in seconds, to reuse a keep-alive connection after its first use before forcing it closed. Set to 0 to disable the time-based close and reuse connections for as long as the destination server permits. - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Body size limit. - `extraHttpHeaders` ExtraHttpHeaderConfInputElastic[] — Headers to add to all events - `name` string — Field Name - `value` string, required — Field Value - `failedRequestLoggingMode` 'payload' | 'payloadAndHeaders' | 'none' — Data to log when a request fails. All headers are redacted by default, unless listed as safe headers below. - `safeHeaders` string[] — List of headers that are safe to log in plain text - `enableMultiMetrics` boolean — Output metrics in multiple-metric format, supported in Splunk 8.0 and above to allow multiple metrics in a single event. - `authType` 'manual' | 'secret' — Select Manual to enter an auth token directly, or select Secret to use a text secret to authenticate - `responseRetrySettings` ResponseRetrySettingConfOutputWebhook[] — Automatically retry after unsuccessful response status codes, such as 429 (Too Many Requests) or 503 (Service Unavailable) - `httpStatus` number, required — The HTTP response status code that will trigger retries - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `timeoutRetrySettings` TimeoutRetrySettingsType - `timeoutRetry` boolean, required — Retry timed-out HTTP requests - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `responseHonorRetryAfterHeader` boolean — Honor any Retry-After header that specifies a delay (in seconds) no longer than 180 seconds after the retry request. @{product} limits the delay to 180 seconds, even if the Retry-After header specifies a longer delay. When enabled, takes precedence over user-configured retry options. When disabled, all Retry-After headers are ignored. - `nextQueue` string — In the Splunk app, define which Splunk processing queue to send the events after HEC processing. - `tcpRouting` string — In the Splunk app, set the value of _TCP_ROUTING for events that do not have _ctrl._TCP_ROUTING set. - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `description` string — Optional description for this configuration. - `url` string — URL to a Splunk HEC endpoint to send events to, e.g., http://localhost:8088/services/collector/event - `useRoundRobinDns` boolean — Enable round-robin DNS lookup. When a DNS server returns multiple addresses, @{product} will cycle through them in the order returned. For optimal performance, consider enabling this setting for non-load balanced destinations. - `excludeSelf` boolean — Exclude all IPs of the current host from the list of any resolved hostnames - `urls` object[] — Splunk HEC Endpoints - `url` string, required — URL to a Splunk HEC endpoint to send events to, e.g., http://localhost:8088/services/collector/event - `weight` number — Assign a weight (>0) to each endpoint to indicate its traffic-handling capability - `__template_url` string — Binds 'url' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'url' at runtime. - `dnsResolvePeriodSec` number — The interval in which to re-resolve any hostnames and pick up destinations from A records - `loadBalanceStatsPeriodSec` number — How far back in time to keep traffic stats for load balancing purposes - `token` string — Splunk HEC authentication token - `textSecret` string — Select or create a stored text secret - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_failedRequestLoggingMode` string — Binds 'failedRequestLoggingMode' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'failedRequestLoggingMode' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_url` string — Binds 'url' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'url' at runtime. - OutputWizHec - `id` string — Unique ID for this output - `type` 'wiz_hec', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `tls` TlsSettingsClientSideTypeCaPathCertPathExtended — TLS settings (client side) - `disabled` boolean — Disabled - `servername` string — Server name for the SNI (Server Name Indication) TLS extension. It must be a host name, and not an IP address. - `certificateName` string — The name of the predefined certificate - `caPath` string — Path on client in which to find CA certificates to verify the server's cert. PEM format. Can reference $ENV_VARS. - `privKeyPath` string — Path on client in which to find the private key to use. PEM format. Can reference $ENV_VARS. - `certPath` string — Path on client in which to find certificates to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `concurrency` number — Maximum number of ongoing requests before blocking - `maxPayloadSizeKB` number — Maximum size, in KB, of the request body - `maxPayloadEvents` number — Maximum number of events to include in the request body. Default is 0 (unlimited). - `compress` boolean — Compress the payload body before sending - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's). Enabled by default. When this setting is also present in TLS Settings (Client Side), that value will take precedence. - `timeoutSec` number — Amount of time, in seconds, to wait for a request to complete before canceling it - `maxConnectionReuseSec` number — How long, in seconds, to reuse a keep-alive connection after its first use before forcing it closed. Set to 0 to disable the time-based close and reuse connections for as long as the destination server permits. - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Body size limit. - `extraHttpHeaders` ExtraHttpHeaderConfInputElastic[] — Headers to add to all events - `name` string — Field Name - `value` string, required — Field Value - `failedRequestLoggingMode` 'payload' | 'payloadAndHeaders' | 'none' — Data to log when a request fails. All headers are redacted by default, unless listed as safe headers below. - `safeHeaders` string[] — List of headers that are safe to log in plain text - `authType` 'manual' | 'secret' — Select Manual to enter an auth token directly, or select Secret to use a text secret to authenticate - `responseRetrySettings` ResponseRetrySettingConfOutputWebhook[] — Automatically retry after unsuccessful response status codes, such as 429 (Too Many Requests) or 503 (Service Unavailable) - `httpStatus` number, required — The HTTP response status code that will trigger retries - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `timeoutRetrySettings` TimeoutRetrySettingsType - `timeoutRetry` boolean, required — Retry timed-out HTTP requests - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `responseHonorRetryAfterHeader` boolean — Honor any Retry-After header that specifies a delay (in seconds) no longer than 180 seconds after the retry request. @{product} limits the delay to 180 seconds, even if the Retry-After header specifies a longer delay. When enabled, takes precedence over user-configured retry options. When disabled, all Retry-After headers are ignored. - `wiz_connector_id` string, required — The unique identifier for the specific Cribl connector defined in your Wiz Settings. This is used to cross-validate the bearer token and ensure traffic is originating from the authorized integration. - `wiz_environment` string, required — Your Wiz deployment environment - `data_center` string, required — Your Wiz deployment data center (such as us1, us8, or eu1). From Tenant Info → Data Center and Regions → Tenant Data Center in your Wiz console. - `wiz_sourcetype` string, required — Wiz Defend Source type - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `description` string — Optional description for this configuration. - `token` string — Wiz Defend Auth token - `textSecret` string — Select or create a stored text secret - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_failedRequestLoggingMode` string — Binds 'failedRequestLoggingMode' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'failedRequestLoggingMode' at runtime. - `__template_wiz_environment` string — Binds 'wiz_environment' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'wiz_environment' at runtime. - `__template_data_center` string — Binds 'data_center' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'data_center' at runtime. - `__template_wiz_sourcetype` string — Binds 'wiz_sourcetype' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'wiz_sourcetype' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - OutputTcpjson - `id` string — Unique ID for this output - `type` 'tcpjson', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `loadBalanced` boolean — Use load-balanced destinations - `compression` 'none' | 'gzip' — Codec to use to compress the data before sending - `logFailedRequests` boolean — Use to troubleshoot issues with sending data - `throttleRatePerSec` string — Rate (in bytes per second) to throttle while writing to an output. Accepts values with multiple-byte units, such as KB, MB, and GB. (Example: 42 MB) Default value of 0 specifies no throttling. - `tls` TlsSettingsClientSideTypeCaPathCertPath — TLS settings (client side) - `disabled` boolean — Disabled - `rejectUnauthorized` boolean — Reject certificates that are not authorized by a CA in the CA certificate path, or by another trusted CA (such as the system's). Defaults to Enabled. Overrides the toggle from Advanced Settings, when also present. - `servername` string — Server name for the SNI (Server Name Indication) TLS extension. It must be a host name, and not an IP address. - `certificateName` string — The name of the predefined certificate - `caPath` string — Path on client in which to find CA certificates to verify the server's cert. PEM format. Can reference $ENV_VARS. - `privKeyPath` string — Path on client in which to find the private key to use. PEM format. Can reference $ENV_VARS. - `certPath` string — Path on client in which to find certificates to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `connectionTimeout` number — Amount of time (milliseconds) to wait for the connection to establish before retrying - `writeTimeout` number — Amount of time (milliseconds) to wait for a write to complete before assuming connection is dead - `tokenTTLMinutes` number — The number of minutes before the internally generated authentication token expires, valid values between 1 and 60 - `sendHeader` boolean — Upon connection, send a header-like record containing the auth token and other metadata.This record will not contain an actual event – only subsequent records will. - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `authType` 'manual' | 'secret' — Select Manual to enter an auth token directly, or select Secret to use a text secret to authenticate - `description` string — Optional description for this configuration. - `host` string — The hostname of the receiver - `port` number — The port to connect to on the provided host - `excludeSelf` boolean — Exclude all IPs of the current host from the list of any resolved hostnames - `hosts` HostConfOutputSyslog[] — Set of hosts to load-balance data to - `host` string, required — The hostname of the receiver - `port` number, required — The port to connect to on the provided host - `tls` 'inherit' | 'off' — Whether to inherit TLS configs from group setting or disable TLS - `servername` string — Servername to use if establishing a TLS connection. If not specified, defaults to connection host (if not an IP); otherwise, uses the global TLS settings. - `weight` number — Assign a weight (>0) to each endpoint to indicate its traffic-handling capability - `__template_host` string — Binds 'host' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'host' at runtime. - `__template_port` string — Binds 'port' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'port' at runtime. - `dnsResolvePeriodSec` number — The interval in which to re-resolve any hostnames and pick up destinations from A records - `loadBalanceStatsPeriodSec` number — How far back in time to keep traffic stats for load balancing purposes - `maxConcurrentSenders` number — Maximum number of concurrent connections (per Worker Process). A random set of IPs will be picked on every DNS resolution period. Use 0 for unlimited. - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `authToken` string — Optional authentication token to include as part of the connection header - `textSecret` string — Select or create a stored text secret - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_host` string — Binds 'host' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'host' at runtime. - `__template_port` string — Binds 'port' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'port' at runtime. - OutputWavefront - `id` string — Unique ID for this output - `type` 'wavefront', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `authType` 'manual' | 'secret' — Select Manual to enter an auth token directly, or select Secret to use a text secret to authenticate - `domain` string, required — WaveFront domain name, e.g. "longboard" - `concurrency` number — Maximum number of ongoing requests before blocking - `maxPayloadSizeKB` number — Maximum size, in KB, of the request body - `maxPayloadEvents` number — Maximum number of events to include in the request body. Default is 0 (unlimited). - `compress` boolean — Compress the payload body before sending - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's). Enabled by default. When this setting is also present in TLS Settings (Client Side), that value will take precedence. - `timeoutSec` number — Amount of time, in seconds, to wait for a request to complete before canceling it - `maxConnectionReuseSec` number — How long, in seconds, to reuse a keep-alive connection after its first use before forcing it closed. Set to 0 to disable the time-based close and reuse connections for as long as the destination server permits. - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Body size limit. - `extraHttpHeaders` ExtraHttpHeaderConfInputElastic[] — Headers to add to all events - `name` string — Field Name - `value` string, required — Field Value - `useRoundRobinDns` boolean — Enable round-robin DNS lookup. When a DNS server returns multiple addresses, @{product} will cycle through them in the order returned. For optimal performance, consider enabling this setting for non-load balanced destinations. - `failedRequestLoggingMode` 'payload' | 'payloadAndHeaders' | 'none' — Data to log when a request fails. All headers are redacted by default, unless listed as safe headers below. - `safeHeaders` string[] — List of headers that are safe to log in plain text - `responseRetrySettings` ResponseRetrySettingConfOutputWebhook[] — Automatically retry after unsuccessful response status codes, such as 429 (Too Many Requests) or 503 (Service Unavailable) - `httpStatus` number, required — The HTTP response status code that will trigger retries - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `timeoutRetrySettings` TimeoutRetrySettingsType - `timeoutRetry` boolean, required — Retry timed-out HTTP requests - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `responseHonorRetryAfterHeader` boolean — Honor any Retry-After header that specifies a delay (in seconds) no longer than 180 seconds after the retry request. @{product} limits the delay to 180 seconds, even if the Retry-After header specifies a longer delay. When enabled, takes precedence over user-configured retry options. When disabled, all Retry-After headers are ignored. - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `description` string — Optional description for this configuration. - `token` string — WaveFront API authentication token (see [here](https://docs.wavefront.com/wavefront_api.html#generating-an-api-token)) - `textSecret` string — Select or create a stored text secret - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_failedRequestLoggingMode` string — Binds 'failedRequestLoggingMode' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'failedRequestLoggingMode' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - OutputSignalfx - `id` string — Unique ID for this output - `type` 'signalfx', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `authType` 'manual' | 'secret' — Select Manual to enter an auth token directly, or select Secret to use a text secret to authenticate - `realm` string, required — SignalFx realm name, e.g. "us0". For a complete list of available SignalFx realm names, please check [here](https://docs.splunk.com/observability/en/get-started/service-description.html#sd-regions). - `concurrency` number — Maximum number of ongoing requests before blocking - `maxPayloadSizeKB` number — Maximum size, in KB, of the request body - `maxPayloadEvents` number — Maximum number of events to include in the request body. Default is 0 (unlimited). - `compress` boolean — Compress the payload body before sending - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's). Enabled by default. When this setting is also present in TLS Settings (Client Side), that value will take precedence. - `timeoutSec` number — Amount of time, in seconds, to wait for a request to complete before canceling it - `maxConnectionReuseSec` number — How long, in seconds, to reuse a keep-alive connection after its first use before forcing it closed. Set to 0 to disable the time-based close and reuse connections for as long as the destination server permits. - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Body size limit. - `extraHttpHeaders` ExtraHttpHeaderConfInputElastic[] — Headers to add to all events - `name` string — Field Name - `value` string, required — Field Value - `useRoundRobinDns` boolean — Enable round-robin DNS lookup. When a DNS server returns multiple addresses, @{product} will cycle through them in the order returned. For optimal performance, consider enabling this setting for non-load balanced destinations. - `failedRequestLoggingMode` 'payload' | 'payloadAndHeaders' | 'none' — Data to log when a request fails. All headers are redacted by default, unless listed as safe headers below. - `safeHeaders` string[] — List of headers that are safe to log in plain text - `responseRetrySettings` ResponseRetrySettingConfOutputWebhook[] — Automatically retry after unsuccessful response status codes, such as 429 (Too Many Requests) or 503 (Service Unavailable) - `httpStatus` number, required — The HTTP response status code that will trigger retries - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `timeoutRetrySettings` TimeoutRetrySettingsType - `timeoutRetry` boolean, required — Retry timed-out HTTP requests - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `responseHonorRetryAfterHeader` boolean — Honor any Retry-After header that specifies a delay (in seconds) no longer than 180 seconds after the retry request. @{product} limits the delay to 180 seconds, even if the Retry-After header specifies a longer delay. When enabled, takes precedence over user-configured retry options. When disabled, all Retry-After headers are ignored. - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `description` string — Optional description for this configuration. - `token` string — SignalFx API access token (see [here](https://docs.signalfx.com/en/latest/admin-guide/tokens.html#working-with-access-tokens)) - `textSecret` string — Select or create a stored text secret - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_failedRequestLoggingMode` string — Binds 'failedRequestLoggingMode' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'failedRequestLoggingMode' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - OutputFilesystem - `id` string — Unique ID for this output - `type` 'filesystem', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `destPath` string, required — Final destination for the output files - `stagePath` string — Filesystem location in which to buffer files, before compressing and moving to final destination. Use performant and stable storage. - `addIdToStagePath` boolean — Add the Output ID value to staging location - `removeEmptyDirs` boolean — Remove empty staging directories after moving files - `partitionExpr` string — JavaScript expression defining how files are partitioned and organized. Default is date-based. If blank, Stream will fall back to the event's __partition field value – if present – otherwise to each location's root directory. - `format` 'json' | 'raw' | 'parquet' — Format of the output data - `baseFileName` string — JavaScript expression to define the output filename prefix (can be constant) - `fileNameSuffix` string — JavaScript expression to define the output filename suffix (can be constant). The `__format` variable refers to the value of the `Data format` field (`json` or `raw`). The `__compression` field refers to the kind of compression being used (`none` or `gzip`). - `maxFileSizeMB` number — Maximum uncompressed output file size. Files of this size will be closed and moved to final output location. - `maxFileOpenTimeSec` number — Maximum amount of time to write to a file. Files open for longer than this will be closed and moved to final output location. - `maxFileIdleTimeSec` number — Maximum amount of time to keep inactive files open. Files open for longer than this will be closed and moved to final output location. - `maxOpenFiles` number — Maximum number of files to keep open concurrently. When exceeded, @{product} will close the oldest open files and move them to the final output location. - `headerLine` string — If set, this line will be written to the beginning of each output file - `writeHighWaterMark` number — Buffer size used to write to a file - `onBackpressure` 'block' | 'drop' — How to handle events when all receivers are exerting backpressure - `deadletterEnabled` boolean — If a file fails to move to its final destination after the maximum number of retries, move it to a designated directory to prevent further errors - `onDiskFullBackpressure` 'block' | 'drop' — How to handle events when disk space is below the global 'Min free disk space' limit - `forceCloseOnShutdown` boolean — Force all staged files to close during an orderly Node shutdown. This triggers immediate upload of in-progress data — regardless of idle time, file age, or size thresholds — to minimize data loss. - `retrySettings` RetrySettingsType - `enabled` boolean — Apply exponential backoff with jitter when file uploads fail repeatedly. - `initialBackoffMs` number — Initial delay before first retry attempt. Valid range: 1s-5min (1000-300000ms). Values outside this range will be clamped to the nearest valid value. - `backoffMultiplier` number — Multiplier applied to backoff delay after each retry. Valid range: 1-10. Values outside this range will be clamped to the nearest valid value. - `maxBackoffMs` number — Maximum delay between retry attempts. Valid range: 1s-10min (1000-600000ms). Values outside this range will be clamped to the nearest valid value. - `jitterPercent` number — Random jitter percentage added to backoff delay to prevent thundering herd. Valid range: 0-100. Values outside this range will be clamped to the nearest valid value. - `orphans` OrphanFileRecoveryType — Orphan file recovery - `disabled` boolean — Periodically scan the staging directory for files not tracked by any Worker manifest to recover them - `periodMin` number — Minimum interval between reconciliation runs - `description` string — Optional description for this configuration. - `compress` 'none' | 'gzip' — Data compression format to apply to HTTP content before it is delivered - `compressionLevel` 'best_speed' | 'normal' | 'best_compression' — Compression level to apply before moving files to final destination - `automaticSchema` boolean — Automatically calculate the schema based on the events of each Parquet file generated - `parquetSchema` string — To add a new schema, navigate to Processing > Knowledge > Parquet Schemas - `parquetVersion` 'PARQUET_1_0' | 'PARQUET_2_4' | 'PARQUET_2_6' — Determines which data types are supported and how they are represented - `parquetDataPageVersion` 'DATA_PAGE_V1' | 'DATA_PAGE_V2' — Serialization format of data pages. Note that some reader implementations use Data page V2's attributes to work more efficiently, while others ignore it. - `parquetRowGroupLength` number — The number of rows that every group will contain. The final group can contain a smaller number of rows. - `parquetPageSize` string — Target memory size for page segments, such as 1MB or 128MB. Generally, lower values improve reading speed, while higher values improve compression. - `shouldLogInvalidRows` boolean — Log up to 3 rows that @{product} skips due to data mismatch - `keyValueMetadata` KeyValueMetadataConfOutputFilesystem[] — The metadata of files the Destination writes will include the properties you add here as key-value pairs. Useful for tagging. Examples: "key":"OCSF Event Class", "value":"9001" - `key` string, required — Key - `value` string, required — Value - `enableStatistics` boolean — Statistics profile an entire file in terms of minimum/maximum values within data, numbers of nulls, etc. You can use Parquet tools to view statistics. - `enableWritePageIndex` boolean — One page index contains statistics for one data page. Parquet readers use statistics to enable page skipping. - `enablePageChecksum` boolean — Parquet tools can use the checksum of a Parquet page to verify data integrity - `emptyDirCleanupSec` number — How frequently, in seconds, to clean up empty directories - `directoryBatchSize` number — Number of directories to process in each batch during cleanup of empty directories. Minimum is 10, maximum is 10000. Higher values may require more memory. - `deadletterPath` string — Storage location for files that fail to reach their final destination after maximum retries are exceeded - `maxRetryNum` number — The maximum number of times a file will attempt to move to its final destination before being dead-lettered - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_partitionExpr` string — Binds 'partitionExpr' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'partitionExpr' at runtime. - `__template_format` string — Binds 'format' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'format' at runtime. - `__template_baseFileName` string — Binds 'baseFileName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'baseFileName' at runtime. - `__template_fileNameSuffix` string — Binds 'fileNameSuffix' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'fileNameSuffix' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_compress` string — Binds 'compress' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'compress' at runtime. - `__template_parquetSchema` string — Binds 'parquetSchema' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'parquetSchema' at runtime. - OutputS3 - `id` string — Unique ID for this output - `type` 's3', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `endpoint` string — S3 service endpoint. If empty, defaults to the AWS Region-specific endpoint. Otherwise, it must point to S3-compatible endpoint. - `enableAssumeRole` boolean — Use Assume Role credentials to access S3 - `assumeRoleArn` string — Amazon Resource Name (ARN) of the role to assume - `assumeRoleExternalId` string — External ID to use when assuming role - `durationSeconds` number — Duration of the assumed role's session, in seconds. Minimum is 900 (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12 hours). - `awsAuthenticationMethod` 'auto' | 'manual' | 'secret' — AWS authentication method. Choose Auto to use IAM roles. - `reuseConnections` boolean — Reuse connections between requests, which can improve performance - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA, such as self-signed certificates - `bucket` string, required — Name of the destination S3 bucket. Must be a JavaScript expression (which can evaluate to a constant value), enclosed in quotes or backticks. Can be evaluated only at initialization time. Example referencing a Global Variable: `myBucket-${C.vars.myVar}` - `region` string — Region where the S3 bucket is located - `destPath` string — Prefix to prepend to files before uploading. Must be a JavaScript expression (which can evaluate to a constant value), enclosed in quotes or backticks. Can be evaluated only at init time. Example referencing a Global Variable: `myKeyPrefix-${C.vars.myVar}` - `maxConcurrentFileParts` number — Maximum number of parts to upload in parallel per file. Minimum part size is 5MB. - `verifyPermissions` boolean — Disable if you can access files within the bucket but not the bucket itself - `maxClosingFilesToBackpressure` number — Maximum number of files that can be waiting for upload before backpressure is applied - `stagePath` string, required — Filesystem location in which to buffer files, before compressing and moving to final destination. Use performant and stable storage. - `addIdToStagePath` boolean — Add the Output ID value to staging location - `removeEmptyDirs` boolean — Remove empty staging directories after moving files - `partitionExpr` string — JavaScript expression defining how files are partitioned and organized. Default is date-based. If blank, Stream will fall back to the event's __partition field value – if present – otherwise to each location's root directory. - `format` 'json' | 'raw' | 'parquet' — Format of the output data - `baseFileName` string — JavaScript expression to define the output filename prefix (can be constant) - `fileNameSuffix` string — JavaScript expression to define the output filename suffix (can be constant). The `__format` variable refers to the value of the `Data format` field (`json` or `raw`). The `__compression` field refers to the kind of compression being used (`none` or `gzip`). - `maxFileSizeMB` number — Maximum uncompressed output file size. Files of this size will be closed and moved to final output location. - `maxFileOpenTimeSec` number — Maximum amount of time to write to a file. Files open for longer than this will be closed and moved to final output location. - `maxFileIdleTimeSec` number — Maximum amount of time to keep inactive files open. Files open for longer than this will be closed and moved to final output location. - `maxOpenFiles` number — Maximum number of files to keep open concurrently. When exceeded, @{product} will close the oldest open files and move them to the final output location. - `headerLine` string — If set, this line will be written to the beginning of each output file - `writeHighWaterMark` number — Buffer size used to write to a file - `onBackpressure` 'block' | 'drop' — How to handle events when all receivers are exerting backpressure - `deadletterEnabled` boolean — If a file fails to move to its final destination after the maximum number of retries, move it to a designated directory to prevent further errors - `onDiskFullBackpressure` 'block' | 'drop' — How to handle events when disk space is below the global 'Min free disk space' limit - `forceCloseOnShutdown` boolean — Force all staged files to close during an orderly Node shutdown. This triggers immediate upload of in-progress data — regardless of idle time, file age, or size thresholds — to minimize data loss. - `retrySettings` RetrySettingsType - `enabled` boolean — Apply exponential backoff with jitter when file uploads fail repeatedly. - `initialBackoffMs` number — Initial delay before first retry attempt. Valid range: 1s-5min (1000-300000ms). Values outside this range will be clamped to the nearest valid value. - `backoffMultiplier` number — Multiplier applied to backoff delay after each retry. Valid range: 1-10. Values outside this range will be clamped to the nearest valid value. - `maxBackoffMs` number — Maximum delay between retry attempts. Valid range: 1s-10min (1000-600000ms). Values outside this range will be clamped to the nearest valid value. - `jitterPercent` number — Random jitter percentage added to backoff delay to prevent thundering herd. Valid range: 0-100. Values outside this range will be clamped to the nearest valid value. - `orphans` OrphanFileRecoveryType — Orphan file recovery - `disabled` boolean — Periodically scan the staging directory for files not tracked by any Worker manifest to recover them - `periodMin` number — Minimum interval between reconciliation runs - `awsSecretKey` string — Secret key. This value can be a constant or a JavaScript expression. Example: `${C.env.SOME_SECRET}`) - `objectACL` 'private' | 'public-read' | 'public-read-write' | 'authenticated-read' | 'aws-exec-read' | 'bucket-owner-read' | 'bucket-owner-full-control' — Object ACL to assign to uploaded objects - `storageClass` 'STANDARD' | 'REDUCED_REDUNDANCY' | 'STANDARD_IA' | 'ONEZONE_IA' | 'INTELLIGENT_TIERING' | 'GLACIER' | 'GLACIER_IR' | 'DEEP_ARCHIVE' — Storage class to select for uploaded objects - `serverSideEncryption` 'AES256' | 'aws:kms' — Server-side encryption to use for uploaded objects - `kmsKeyId` string — ID or ARN of the KMS customer-managed key to use for encryption - `description` string — Optional description for this configuration. - `awsApiKey` string — This value can be a constant or a JavaScript expression (`${C.env.SOME_ACCESS_KEY}`) - `awsSecret` string — Select or create a stored secret that references your access key and secret key - `compress` 'none' | 'gzip' — Data compression format to apply to HTTP content before it is delivered - `compressionLevel` 'best_speed' | 'normal' | 'best_compression' — Compression level to apply before moving files to final destination - `automaticSchema` boolean — Automatically calculate the schema based on the events of each Parquet file generated - `parquetSchema` string — To add a new schema, navigate to Processing > Knowledge > Parquet Schemas - `parquetVersion` 'PARQUET_1_0' | 'PARQUET_2_4' | 'PARQUET_2_6' — Determines which data types are supported and how they are represented - `parquetDataPageVersion` 'DATA_PAGE_V1' | 'DATA_PAGE_V2' — Serialization format of data pages. Note that some reader implementations use Data page V2's attributes to work more efficiently, while others ignore it. - `parquetRowGroupLength` number — The number of rows that every group will contain. The final group can contain a smaller number of rows. - `parquetPageSize` string — Target memory size for page segments, such as 1MB or 128MB. Generally, lower values improve reading speed, while higher values improve compression. - `shouldLogInvalidRows` boolean — Log up to 3 rows that @{product} skips due to data mismatch - `keyValueMetadata` KeyValueMetadataConfOutputFilesystem[] — The metadata of files the Destination writes will include the properties you add here as key-value pairs. Useful for tagging. Examples: "key":"OCSF Event Class", "value":"9001" - `key` string, required — Key - `value` string, required — Value - `enableStatistics` boolean — Statistics profile an entire file in terms of minimum/maximum values within data, numbers of nulls, etc. You can use Parquet tools to view statistics. - `enableWritePageIndex` boolean — One page index contains statistics for one data page. Parquet readers use statistics to enable page skipping. - `enablePageChecksum` boolean — Parquet tools can use the checksum of a Parquet page to verify data integrity - `emptyDirCleanupSec` number — How frequently, in seconds, to clean up empty directories - `directoryBatchSize` number — Number of directories to process in each batch during cleanup of empty directories. Minimum is 10, maximum is 10000. Higher values may require more memory. - `deadletterPath` string — Storage location for files that fail to reach their final destination after maximum retries are exceeded - `maxRetryNum` number — The maximum number of times a file will attempt to move to its final destination before being dead-lettered - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_endpoint` string — Binds 'endpoint' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'endpoint' at runtime. - `__template_assumeRoleArn` string — Binds 'assumeRoleArn' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'assumeRoleArn' at runtime. - `__template_assumeRoleExternalId` string — Binds 'assumeRoleExternalId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'assumeRoleExternalId' at runtime. - `__template_bucket` string — Binds 'bucket' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'bucket' at runtime. - `__template_region` string — Binds 'region' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'region' at runtime. - `__template_destPath` string — Binds 'destPath' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'destPath' at runtime. - `__template_partitionExpr` string — Binds 'partitionExpr' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'partitionExpr' at runtime. - `__template_format` string — Binds 'format' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'format' at runtime. - `__template_baseFileName` string — Binds 'baseFileName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'baseFileName' at runtime. - `__template_fileNameSuffix` string — Binds 'fileNameSuffix' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'fileNameSuffix' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_awsSecretKey` string — Binds 'awsSecretKey' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'awsSecretKey' at runtime. - `__template_objectACL` string — Binds 'objectACL' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'objectACL' at runtime. - `__template_storageClass` string — Binds 'storageClass' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'storageClass' at runtime. - `__template_serverSideEncryption` string — Binds 'serverSideEncryption' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'serverSideEncryption' at runtime. - `__template_kmsKeyId` string — Binds 'kmsKeyId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'kmsKeyId' at runtime. - `__template_awsApiKey` string — Binds 'awsApiKey' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'awsApiKey' at runtime. - `__template_compress` string — Binds 'compress' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'compress' at runtime. - `__template_parquetSchema` string — Binds 'parquetSchema' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'parquetSchema' at runtime. - OutputAzureBlob - `id` string — Unique ID for this output - `type` 'azure_blob', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `containerName` string, required — The Azure Blob Storage container name. Name can include only lowercase letters, numbers, and hyphens. For dynamic container names, enter a JavaScript expression within quotes or backticks, to be evaluated at initialization. The expression can evaluate to a constant value and can reference Global Variables, such as `myContainer-${C.env["CRIBL_WORKER_ID"]}`. - `createContainer` boolean — Create the configured container in Azure Blob Storage if it does not already exist - `destPath` string — Root directory prepended to path before uploading. Value can be a JavaScript expression enclosed in quotes or backticks, to be evaluated at initialization. The expression can evaluate to a constant value and can reference Global Variables, such as `myBlobPrefix-${C.env["CRIBL_WORKER_ID"]}`. - `stagePath` string, required — Filesystem location in which to buffer files before compressing and moving to final destination. Use performant and stable storage. - `addIdToStagePath` boolean — Add the Output ID value to staging location - `maxConcurrentFileParts` number — Maximum number of parts to upload in parallel per file - `removeEmptyDirs` boolean — Remove empty staging directories after moving files - `partitionExpr` string — JavaScript expression defining how files are partitioned and organized. Default is date-based. If blank, Stream will fall back to the event's __partition field value – if present – otherwise to each location's root directory. - `format` 'json' | 'raw' | 'parquet' — Format of the output data - `baseFileName` string — JavaScript expression to define the output filename prefix (can be constant) - `fileNameSuffix` string — JavaScript expression to define the output filename suffix (can be constant). The `__format` variable refers to the value of the `Data format` field (`json` or `raw`). The `__compression` field refers to the kind of compression being used (`none` or `gzip`). - `maxFileSizeMB` number — Maximum uncompressed output file size. Files of this size will be closed and moved to final output location. - `maxFileOpenTimeSec` number — Maximum amount of time to write to a file. Files open for longer than this will be closed and moved to final output location. - `maxFileIdleTimeSec` number — Maximum amount of time to keep inactive files open. Files open for longer than this will be closed and moved to final output location. - `maxOpenFiles` number — Maximum number of files to keep open concurrently. When exceeded, @{product} will close the oldest open files and move them to the final output location. - `headerLine` string — If set, this line will be written to the beginning of each output file - `writeHighWaterMark` number — Buffer size used to write to a file - `onBackpressure` 'block' | 'drop' — How to handle events when all receivers are exerting backpressure - `deadletterEnabled` boolean — If a file fails to move to its final destination after the maximum number of retries, move it to a designated directory to prevent further errors - `onDiskFullBackpressure` 'block' | 'drop' — How to handle events when disk space is below the global 'Min free disk space' limit - `forceCloseOnShutdown` boolean — Force all staged files to close during an orderly Node shutdown. This triggers immediate upload of in-progress data — regardless of idle time, file age, or size thresholds — to minimize data loss. - `retrySettings` RetrySettingsType - `enabled` boolean — Apply exponential backoff with jitter when file uploads fail repeatedly. - `initialBackoffMs` number — Initial delay before first retry attempt. Valid range: 1s-5min (1000-300000ms). Values outside this range will be clamped to the nearest valid value. - `backoffMultiplier` number — Multiplier applied to backoff delay after each retry. Valid range: 1-10. Values outside this range will be clamped to the nearest valid value. - `maxBackoffMs` number — Maximum delay between retry attempts. Valid range: 1s-10min (1000-600000ms). Values outside this range will be clamped to the nearest valid value. - `jitterPercent` number — Random jitter percentage added to backoff delay to prevent thundering herd. Valid range: 0-100. Values outside this range will be clamped to the nearest valid value. - `orphans` OrphanFileRecoveryType — Orphan file recovery - `disabled` boolean — Periodically scan the staging directory for files not tracked by any Worker manifest to recover them - `periodMin` number — Minimum interval between reconciliation runs - `authType` 'manual' | 'secret' | 'clientSecret' | 'clientCert' | 'clientAssertion' | 'clientAssertion_rpc' — Authentication method - `storageClass` 'Inferred' | 'Hot' | 'Cool' | 'Cold' | 'Archive' — Blob access tier - `description` string — Optional description for this configuration. - `compress` 'none' | 'gzip' — Data compression format to apply to HTTP content before it is delivered - `compressionLevel` 'best_speed' | 'normal' | 'best_compression' — Compression level to apply before moving files to final destination - `automaticSchema` boolean — Automatically calculate the schema based on the events of each Parquet file generated - `parquetSchema` string — To add a new schema, navigate to Processing > Knowledge > Parquet Schemas - `parquetVersion` 'PARQUET_1_0' | 'PARQUET_2_4' | 'PARQUET_2_6' — Determines which data types are supported and how they are represented - `parquetDataPageVersion` 'DATA_PAGE_V1' | 'DATA_PAGE_V2' — Serialization format of data pages. Note that some reader implementations use Data page V2's attributes to work more efficiently, while others ignore it. - `parquetRowGroupLength` number — The number of rows that every group will contain. The final group can contain a smaller number of rows. - `parquetPageSize` string — Target memory size for page segments, such as 1MB or 128MB. Generally, lower values improve reading speed, while higher values improve compression. - `shouldLogInvalidRows` boolean — Log up to 3 rows that @{product} skips due to data mismatch - `keyValueMetadata` KeyValueMetadataConfOutputFilesystem[] — The metadata of files the Destination writes will include the properties you add here as key-value pairs. Useful for tagging. Examples: "key":"OCSF Event Class", "value":"9001" - `key` string, required — Key - `value` string, required — Value - `enableStatistics` boolean — Statistics profile an entire file in terms of minimum/maximum values within data, numbers of nulls, etc. You can use Parquet tools to view statistics. - `enableWritePageIndex` boolean — One page index contains statistics for one data page. Parquet readers use statistics to enable page skipping. - `enablePageChecksum` boolean — Parquet tools can use the checksum of a Parquet page to verify data integrity - `emptyDirCleanupSec` number — How frequently, in seconds, to clean up empty directories - `directoryBatchSize` number — Number of directories to process in each batch during cleanup of empty directories. Minimum is 10, maximum is 10000. Higher values may require more memory. - `deadletterPath` string — Storage location for files that fail to reach their final destination after maximum retries are exceeded - `maxRetryNum` number — The maximum number of times a file will attempt to move to its final destination before being dead-lettered - `connectionString` string — Enter your Azure Storage account connection string. If left blank, Stream will fall back to env.AZURE_STORAGE_CONNECTION_STRING. - `textSecret` string — Select or create a stored text secret - `storageAccountName` string — The name of your Azure storage account - `tenantId` string — The service principal's tenant ID - `clientId` string — The service principal's client ID - `azureCloud` string — The Azure cloud to use. Defaults to Azure Public Cloud. - `endpointSuffix` string — Endpoint suffix for the service URL. Takes precedence over the Azure Cloud setting. Defaults to core.windows.net. - `clientTextSecret` string — Select or create a stored text secret - `certificate` CertificateType - `certificateName` string, required — The certificate you registered as credentials for your app in the Azure portal - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_containerName` string — Binds 'containerName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'containerName' at runtime. - `__template_destPath` string — Binds 'destPath' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'destPath' at runtime. - `__template_partitionExpr` string — Binds 'partitionExpr' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'partitionExpr' at runtime. - `__template_format` string — Binds 'format' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'format' at runtime. - `__template_baseFileName` string — Binds 'baseFileName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'baseFileName' at runtime. - `__template_fileNameSuffix` string — Binds 'fileNameSuffix' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'fileNameSuffix' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_compress` string — Binds 'compress' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'compress' at runtime. - `__template_parquetSchema` string — Binds 'parquetSchema' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'parquetSchema' at runtime. - `__template_connectionString` string — Binds 'connectionString' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'connectionString' at runtime. - `__template_storageAccountName` string — Binds 'storageAccountName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'storageAccountName' at runtime. - `__template_tenantId` string — Binds 'tenantId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tenantId' at runtime. - `__template_clientId` string — Binds 'clientId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientId' at runtime. - `__template_azureCloud` string — Binds 'azureCloud' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'azureCloud' at runtime. - OutputAzureDataExplorer - `id` string — Unique ID for this output - `type` 'azure_data_explorer', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `clusterUrl` string, required — The base URI for your cluster. Typically, `https://..kusto.windows.net`. - `database` string, required — Name of the database containing the table where data will be ingested - `table` string, required — Name of the table to ingest data into - `validateDatabaseSettings` boolean — When saving or starting the Destination, validate the database name and credentials; also validate table name, except when creating a new table. Disable if your Azure app does not have both the Database Viewer and the Table Viewer role. - `ingestMode` 'batching' | 'streaming' — Ingestion mode - `oauthEndpoint` 'https://login.microsoftonline.com' | 'https://login.microsoftonline.us' | 'https://login.partner.microsoftonline.cn', required — Endpoint used to acquire authentication tokens from Azure - `tenantId` string, required — Directory ID (tenant identifier) in Azure Active Directory - `clientId` string, required — client_id to pass in the OAuth request parameter - `scope` string, required — Scope to pass in the OAuth request parameter - `oauthType` 'clientSecret' | 'clientTextSecret' | 'certificate', required — The type of OAuth 2.0 client credentials grant flow to use - `description` string — Optional description for this configuration. - `clientSecret` string — The client secret that you generated for your app in the Azure portal - `textSecret` string — Select or create a stored text secret - `certificate` object - `certificateName` string — The certificate you registered as credentials for your app in the Azure portal - `format` 'json' | 'raw' | 'parquet' — Format of the output data - `compress` 'none' | 'gzip', required — Data compression format to apply to HTTP content before it is delivered - `compressionLevel` 'best_speed' | 'normal' | 'best_compression' — Compression level to apply before moving files to final destination - `automaticSchema` boolean — Automatically calculate the schema based on the events of each Parquet file generated - `parquetSchema` string — To add a new schema, navigate to Processing > Knowledge > Parquet Schemas - `parquetVersion` 'PARQUET_1_0' | 'PARQUET_2_4' | 'PARQUET_2_6' — Determines which data types are supported and how they are represented - `parquetDataPageVersion` 'DATA_PAGE_V1' | 'DATA_PAGE_V2' — Serialization format of data pages. Note that some reader implementations use Data page V2's attributes to work more efficiently, while others ignore it. - `parquetRowGroupLength` number — The number of rows that every group will contain. The final group can contain a smaller number of rows. - `parquetPageSize` string — Target memory size for page segments, such as 1MB or 128MB. Generally, lower values improve reading speed, while higher values improve compression. - `shouldLogInvalidRows` boolean — Log up to 3 rows that @{product} skips due to data mismatch - `keyValueMetadata` KeyValueMetadataConfOutputFilesystem[] — The metadata of files the Destination writes will include the properties you add here as key-value pairs. Useful for tagging. Examples: "key":"OCSF Event Class", "value":"9001" - `key` string, required — Key - `value` string, required — Value - `enableStatistics` boolean — Statistics profile an entire file in terms of minimum/maximum values within data, numbers of nulls, etc. You can use Parquet tools to view statistics. - `enableWritePageIndex` boolean — One page index contains statistics for one data page. Parquet readers use statistics to enable page skipping. - `enablePageChecksum` boolean — Parquet tools can use the checksum of a Parquet page to verify data integrity - `removeEmptyDirs` boolean — Remove empty staging directories after moving files - `emptyDirCleanupSec` number — How frequently, in seconds, to clean up empty directories - `directoryBatchSize` number — Number of directories to process in each batch during cleanup of empty directories. Minimum is 10, maximum is 10000. Higher values may require more memory. - `deadletterEnabled` boolean — If a file fails to move to its final destination after the maximum number of retries, move it to a designated directory to prevent further errors - `deadletterPath` string — Storage location for files that fail to reach their final destination after maximum retries are exceeded - `maxRetryNum` number — The maximum number of times a file will attempt to move to its final destination before being dead-lettered - `isMappingObj` boolean — Send a JSON mapping object instead of specifying an existing named data mapping - `mappingObj` string — Enter a JSON object that defines your desired data mapping - `mappingRef` string — Enter the name of a data mapping associated with your target table. Or, if incoming event and target table fields match exactly, you can leave the field empty. - `ingestUrl` string — The ingestion service URI for your cluster. Typically, `https://ingest-..kusto.windows.net`. - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `stagePath` string — Filesystem location in which to buffer files before compressing and moving to final destination. Use performant and stable storage. - `fileNameSuffix` string — JavaScript expression to define the output filename suffix (can be constant). The `__format` variable refers to the value of the `Data format` field (`json` or `raw`). The `__compression` field refers to the kind of compression being used (`none` or `gzip`). - `maxFileSizeMB` number — Maximum uncompressed output file size. Files of this size will be closed and moved to final output location. - `maxFileOpenTimeSec` number — Maximum amount of time to write to a file. Files open for longer than this will be closed and moved to final output location. - `maxFileIdleTimeSec` number — Maximum amount of time to keep inactive files open. Files open for longer than this will be closed and moved to final output location. - `maxOpenFiles` number — Maximum number of files to keep open concurrently. When exceeded, @{product} will close the oldest open files and move them to the final output location. - `maxConcurrentFileParts` number — Maximum number of parts to upload in parallel per file - `onDiskFullBackpressure` 'block' | 'drop' — How to handle events when disk space is below the global 'Min free disk space' limit - `addIdToStagePath` boolean — Add the Output ID value to staging location - `retrySettings` RetrySettingsType - `enabled` boolean — Apply exponential backoff with jitter when file uploads fail repeatedly. - `initialBackoffMs` number — Initial delay before first retry attempt. Valid range: 1s-5min (1000-300000ms). Values outside this range will be clamped to the nearest valid value. - `backoffMultiplier` number — Multiplier applied to backoff delay after each retry. Valid range: 1-10. Values outside this range will be clamped to the nearest valid value. - `maxBackoffMs` number — Maximum delay between retry attempts. Valid range: 1s-10min (1000-600000ms). Values outside this range will be clamped to the nearest valid value. - `jitterPercent` number — Random jitter percentage added to backoff delay to prevent thundering herd. Valid range: 0-100. Values outside this range will be clamped to the nearest valid value. - `orphans` OrphanFileRecoveryType — Orphan file recovery - `disabled` boolean — Periodically scan the staging directory for files not tracked by any Worker manifest to recover them - `periodMin` number — Minimum interval between reconciliation runs - `timeoutSec` number — Amount of time, in seconds, to wait for a request to complete before canceling it - `flushImmediately` boolean — Bypass the data management service's aggregation mechanism - `retainBlobOnSuccess` boolean — Prevent blob deletion after ingestion is complete - `extentTags` object[] — Strings or tags associated with the extent (ingested data shard) - `prefix` 'dropBy' | 'ingestBy' — Prefix (optional) - `value` string, required — Value - `ingestIfNotExists` object[] — Prevents duplicate ingestion by verifying whether an extent with the specified ingest-by tag already exists - `value` string, required — Value - `reportLevel` 'failuresOnly' | 'doNotReport' | 'failuresAndSuccesses' — Level of ingestion status reporting. Defaults to FailuresOnly. - `reportMethod` 'queue' | 'table' | 'queueAndTable' — Target of the ingestion status reporting. Defaults to Queue. - `additionalProperties` object[] — Optionally, enter additional configuration properties to send to the ingestion service - `key` string, required — Key - `value` string, required — Value - `responseRetrySettings` ResponseRetrySettingConfOutputWebhook[] — Automatically retry after unsuccessful response status codes, such as 429 (Too Many Requests) or 503 (Service Unavailable) - `httpStatus` number, required — The HTTP response status code that will trigger retries - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `timeoutRetrySettings` TimeoutRetrySettingsType - `timeoutRetry` boolean, required — Retry timed-out HTTP requests - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `responseHonorRetryAfterHeader` boolean — Honor any Retry-After header that specifies a delay (in seconds) no longer than 180 seconds after the retry request. @{product} limits the delay to 180 seconds, even if the Retry-After header specifies a longer delay. When enabled, takes precedence over user-configured retry options. When disabled, all Retry-After headers are ignored. - `concurrency` number — Maximum number of ongoing requests before blocking - `maxPayloadSizeKB` number — Maximum size, in KB, of the request body - `maxPayloadEvents` number — Maximum number of events to include in the request body. Default is 0 (unlimited). - `maxConnectionReuseSec` number — How long, in seconds, to reuse a keep-alive connection after its first use before forcing it closed. Set to 0 to disable the time-based close and reuse connections for as long as the destination server permits. - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Body size limit. - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's). Enabled by default. When this setting is also present in TLS Settings (Client Side), that value will take precedence. - `useRoundRobinDns` boolean — Enable round-robin DNS lookup. When a DNS server returns multiple addresses, @{product} will cycle through them in the order returned. For optimal performance, consider enabling this setting for non-load balanced destinations. - `keepAlive` boolean — Disable to close the connection immediately after sending the outgoing request - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_clusterUrl` string — Binds 'clusterUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clusterUrl' at runtime. - `__template_database` string — Binds 'database' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'database' at runtime. - `__template_table` string — Binds 'table' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'table' at runtime. - `__template_oauthEndpoint` string — Binds 'oauthEndpoint' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'oauthEndpoint' at runtime. - `__template_tenantId` string — Binds 'tenantId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tenantId' at runtime. - `__template_clientId` string — Binds 'clientId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientId' at runtime. - `__template_scope` string — Binds 'scope' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'scope' at runtime. - `__template_clientSecret` string — Binds 'clientSecret' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientSecret' at runtime. - `__template_format` string — Binds 'format' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'format' at runtime. - `__template_compress` string — Binds 'compress' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'compress' at runtime. - `__template_parquetSchema` string — Binds 'parquetSchema' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'parquetSchema' at runtime. - `__template_mappingRef` string — Binds 'mappingRef' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'mappingRef' at runtime. - `__template_ingestUrl` string — Binds 'ingestUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'ingestUrl' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_fileNameSuffix` string — Binds 'fileNameSuffix' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'fileNameSuffix' at runtime. - OutputAzureLogs - `id` string — Unique ID for this output - `type` 'azure_logs', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `logType` string, required — The Log Type of events sent to this LogAnalytics workspace. Defaults to `Cribl`. Use only letters, numbers, and `_` characters, and can't exceed 100 characters. Can be overwritten by event field __logType. - `resourceId` string — Optional Resource ID of the Azure resource to associate the data with. Can be overridden by the __resourceId event field. This ID populates the _ResourceId property, allowing the data to be included in resource-centric queries. If the ID is neither specified nor overridden, resource-centric queries will omit the data. - `concurrency` number — Maximum number of ongoing requests before blocking - `maxPayloadSizeKB` number — Maximum size, in KB, of the request body - `maxPayloadEvents` number — Maximum number of events to include in the request body. Default is 0 (unlimited). - `compress` boolean - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's). Enabled by default. When this setting is also present in TLS Settings (Client Side), that value will take precedence. - `timeoutSec` number — Amount of time, in seconds, to wait for a request to complete before canceling it - `maxConnectionReuseSec` number — How long, in seconds, to reuse a keep-alive connection after its first use before forcing it closed. Set to 0 to disable the time-based close and reuse connections for as long as the destination server permits. - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Body size limit. - `extraHttpHeaders` ExtraHttpHeaderConfInputElastic[] — Headers to add to all events - `name` string — Field Name - `value` string, required — Field Value - `useRoundRobinDns` boolean — Enable round-robin DNS lookup. When a DNS server returns multiple addresses, @{product} will cycle through them in the order returned. For optimal performance, consider enabling this setting for non-load balanced destinations. - `failedRequestLoggingMode` 'payload' | 'payloadAndHeaders' | 'none' — Data to log when a request fails. All headers are redacted by default, unless listed as safe headers below. - `safeHeaders` string[] — List of headers that are safe to log in plain text - `apiUrl` string — The DNS name of the Log API endpoint that sends log data to a Log Analytics workspace in Azure Monitor. Defaults to .ods.opinsights.azure.com. @{product} will add a prefix and suffix to construct a URI in this format: /api/logs?api-version=. - `responseRetrySettings` ResponseRetrySettingConfOutputWebhook[] — Automatically retry after unsuccessful response status codes, such as 429 (Too Many Requests) or 503 (Service Unavailable) - `httpStatus` number, required — The HTTP response status code that will trigger retries - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `timeoutRetrySettings` TimeoutRetrySettingsType - `timeoutRetry` boolean, required — Retry timed-out HTTP requests - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `responseHonorRetryAfterHeader` boolean — Honor any Retry-After header that specifies a delay (in seconds) no longer than 180 seconds after the retry request. @{product} limits the delay to 180 seconds, even if the Retry-After header specifies a longer delay. When enabled, takes precedence over user-configured retry options. When disabled, all Retry-After headers are ignored. - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `authType` 'manual' | 'secret' — Enter workspace ID and workspace key directly, or select a stored secret - `description` string — Optional description for this configuration. - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `workspaceId` string — Azure Log Analytics Workspace ID. See Azure Dashboard Workspace > Advanced settings. - `workspaceKey` string — Azure Log Analytics Workspace Primary or Secondary Shared Key. See Azure Dashboard Workspace > Advanced settings. - `keypairSecret` string — Select or create a stored secret that references your access key and secret key - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_failedRequestLoggingMode` string — Binds 'failedRequestLoggingMode' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'failedRequestLoggingMode' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_workspaceId` string — Binds 'workspaceId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'workspaceId' at runtime. - `__template_workspaceKey` string — Binds 'workspaceKey' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'workspaceKey' at runtime. - OutputKinesis - `id` string — Unique ID for this output - `type` 'kinesis', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `streamName` string, required — Kinesis stream name to send events to. - `awsAuthenticationMethod` 'auto' | 'manual' | 'secret' — AWS authentication method. Choose Auto to use IAM roles. - `awsSecretKey` string — Secret key - `region` string, required — Region where the Kinesis stream is located - `endpoint` string — Kinesis stream service endpoint. If empty, defaults to the AWS Region-specific endpoint. Otherwise, it must point to Kinesis stream-compatible endpoint. - `reuseConnections` boolean — Reuse connections between requests, which can improve performance - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA, such as self-signed certificates - `enableAssumeRole` boolean — Use Assume Role credentials to access Kinesis stream - `assumeRoleArn` string — Amazon Resource Name (ARN) of the role to assume - `assumeRoleExternalId` string — External ID to use when assuming role - `durationSeconds` number — Duration of the assumed role's session, in seconds. Minimum is 900 (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12 hours). - `concurrency` number — Maximum number of ongoing put requests before blocking. - `maxRecordSizeKB` number — Maximum size (KB) of each individual record before compression. For uncompressed or non-compressible data 1MB is the max recommended size - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Max record size. - `compression` 'none' | 'gzip' — Compression type to use for records - `useListShards` boolean — Provides higher stream rate limits, improving delivery speed and reliability by minimizing throttling. See the [ListShards API](https://docs.aws.amazon.com/kinesis/latest/APIReference/API_ListShards.html) documentation for details. - `asNdjson` boolean — Batch events into a single record as NDJSON - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `description` string — Optional description for this configuration. - `awsApiKey` string — Access key - `awsSecret` string — Select or create a stored secret that references your access key and secret key - `maxEventsPerFlush` number — Maximum number of records to send in a single request - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_streamName` string — Binds 'streamName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamName' at runtime. - `__template_awsSecretKey` string — Binds 'awsSecretKey' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'awsSecretKey' at runtime. - `__template_region` string — Binds 'region' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'region' at runtime. - `__template_endpoint` string — Binds 'endpoint' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'endpoint' at runtime. - `__template_assumeRoleArn` string — Binds 'assumeRoleArn' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'assumeRoleArn' at runtime. - `__template_assumeRoleExternalId` string — Binds 'assumeRoleExternalId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'assumeRoleExternalId' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_awsApiKey` string — Binds 'awsApiKey' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'awsApiKey' at runtime. - OutputHoneycomb - `id` string — Unique ID for this output - `type` 'honeycomb', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `dataset` string, required — Name of the dataset to send events to – e.g., observability - `concurrency` number — Maximum number of ongoing requests before blocking - `maxPayloadSizeKB` number — Maximum size, in KB, of the request body - `maxPayloadEvents` number — Maximum number of events to include in the request body. Default is 0 (unlimited). - `compress` boolean — Compress the payload body before sending - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's). Enabled by default. When this setting is also present in TLS Settings (Client Side), that value will take precedence. - `timeoutSec` number — Amount of time, in seconds, to wait for a request to complete before canceling it - `maxConnectionReuseSec` number — How long, in seconds, to reuse a keep-alive connection after its first use before forcing it closed. Set to 0 to disable the time-based close and reuse connections for as long as the destination server permits. - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Body size limit. - `extraHttpHeaders` ExtraHttpHeaderConfInputElastic[] — Headers to add to all events - `name` string — Field Name - `value` string, required — Field Value - `useRoundRobinDns` boolean — Enable round-robin DNS lookup. When a DNS server returns multiple addresses, @{product} will cycle through them in the order returned. For optimal performance, consider enabling this setting for non-load balanced destinations. - `failedRequestLoggingMode` 'payload' | 'payloadAndHeaders' | 'none' — Data to log when a request fails. All headers are redacted by default, unless listed as safe headers below. - `safeHeaders` string[] — List of headers that are safe to log in plain text - `responseRetrySettings` ResponseRetrySettingConfOutputWebhook[] — Automatically retry after unsuccessful response status codes, such as 429 (Too Many Requests) or 503 (Service Unavailable) - `httpStatus` number, required — The HTTP response status code that will trigger retries - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `timeoutRetrySettings` TimeoutRetrySettingsType - `timeoutRetry` boolean, required — Retry timed-out HTTP requests - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `responseHonorRetryAfterHeader` boolean — Honor any Retry-After header that specifies a delay (in seconds) no longer than 180 seconds after the retry request. @{product} limits the delay to 180 seconds, even if the Retry-After header specifies a longer delay. When enabled, takes precedence over user-configured retry options. When disabled, all Retry-After headers are ignored. - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `authType` 'manual' | 'secret' — Enter API key directly, or select a stored secret - `description` string — Optional description for this configuration. - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `team` string — Team API key where the dataset belongs - `textSecret` string — Select or create a stored text secret - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_failedRequestLoggingMode` string — Binds 'failedRequestLoggingMode' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'failedRequestLoggingMode' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - OutputAzureEventhub - `id` string — Unique ID for this output - `type` 'azure_eventhub', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `brokers` string[], required — List of Event Hubs Kafka brokers to connect to, eg. yourdomain.servicebus.windows.net:9093. The hostname can be found in the host portion of the primary or secondary connection string in Shared Access Policies. - `topic` string, required — The name of the Event Hub (Kafka Topic) to publish events. Can be overwritten using field __topicOut. - `ack` 1 | 0 | -1 — Control the number of required acknowledgments - `format` 'json' | 'raw' — Format to use to serialize events before writing to the Event Hubs Kafka brokers - `maxRecordSizeKB` number — Maximum size of each record batch before compression. Setting should be < message.max.bytes settings in Event Hubs brokers. - `flushEventCount` number — Maximum number of events in a batch before forcing a flush - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Max record size. - `connectionTimeout` number — Maximum time to wait for a connection to complete successfully - `requestTimeout` number — Maximum time to wait for Kafka to respond to a request - `maxRetries` number — If messages are failing, you can set the maximum number of retries as high as 100 to prevent loss of data - `maxBackOff` number — The maximum wait time for a retry, in milliseconds. Default (and minimum) is 30,000 ms (30 seconds); maximum is 180,000 ms (180 seconds). - `initialBackoff` number — Initial value used to calculate the retry, in milliseconds. Maximum is 600,000 ms (10 minutes). - `backoffRate` number — Set the backoff multiplier (2-20) to control the retry frequency for failed messages. For faster retries, use a lower multiplier. For slower retries with more delay between attempts, use a higher multiplier. The multiplier is used in an exponential backoff formula; see the Kafka [documentation](https://kafka.js.org/docs/retry-detailed) for details. - `authenticationTimeout` number — Maximum time to wait for Kafka to respond to an authentication request - `reauthenticationThreshold` number — Specifies a time window during which @{product} can reauthenticate if needed. Creates the window measuring backward from the moment when credentials are set to expire. - `sasl` AuthenticationTypeUse — Authentication parameters to use when connecting to brokers. Using TLS is highly recommended. - `disabled` boolean, required — Disabled - `authType` 'manual' | 'secret' — Enter password directly, or select a stored secret - `password` string — Connection-string primary key, or connection-string secondary key, from the Event Hubs workspace - `textSecret` string — Select or create a stored text secret - `mechanism` 'plain' | 'oauthbearer' — SASL mechanism - `username` string — The username for authentication. For Event Hubs, this should always be $ConnectionString. - `clientSecretAuthType` 'manual' | 'secret' | 'certificate' — Authentication method - `clientSecret` string — client_secret to pass in the OAuth request parameter - `clientTextSecret` string — Select or create a stored text secret - `certificateName` string — Select or create a stored certificate - `certPath` string - `privKeyPath` string - `passphrase` string - `oauthEndpoint` 'https://login.microsoftonline.com' | 'https://login.microsoftonline.us' | 'https://login.partner.microsoftonline.cn' — Endpoint used to acquire authentication tokens from Azure - `clientId` string — client_id to pass in the OAuth request parameter - `tenantId` string — Directory ID (tenant identifier) in Azure Active Directory - `scope` string — Scope to pass in the OAuth request parameter - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime. - `__template_mechanism` string — Binds 'mechanism' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'mechanism' at runtime. - `__template_oauthEndpoint` string — Binds 'oauthEndpoint' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'oauthEndpoint' at runtime. - `__template_clientId` string — Binds 'clientId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientId' at runtime. - `__template_tenantId` string — Binds 'tenantId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tenantId' at runtime. - `__template_scope` string — Binds 'scope' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'scope' at runtime. - `tls` TlsSettingsClientSideType — TLS settings (client side) - `disabled` boolean, required — Disabled - `rejectUnauthorized` boolean — Reject certificates that are not authorized by a CA in the CA certificate path, or by another trusted CA (such as the system's) - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `description` string — Optional description for this configuration. - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_brokers` string — Binds 'brokers' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'brokers' at runtime. - `__template_topic` string — Binds 'topic' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'topic' at runtime. - `__template_format` string — Binds 'format' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'format' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - OutputGoogleBigquery - `id` string — Unique ID for this output - `type` 'google_bigquery', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `projectId` string, required — Google Cloud project ID that contains the BigQuery dataset - `datasetId` string, required — BigQuery dataset ID - `tableId` string, required — BigQuery table ID - `timestampColumn` string — Column name to write event time (`_time`) as a BigQuery TIMESTAMP. Used for time partitioning - `googleAuthMethod` 'auto' | 'secret', required — Choose Auto to use Google Application Default Credentials (ADC), or Secret to select or create a stored secret that references Google service account credentials - `secret` string — Select or create a stored text secret - `flushPeriod` number — Maximum time to wait before sending a batch (when batch size limit is not reached) - `maxQueueSize` number — Maximum number of queued batches before blocking - `maxRecordSizeKB` number — Maximum size (KB) of a single append request. BigQuery limit is 10 MB - `maxInProgress` number — The maximum number of in-progress API requests before backpressure is applied - `maxSendRetries` number — Maximum retries per batch for retryable failures (transient, rate-limit, unknown) before dropping. 0 (default) retries indefinitely. - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `description` string — Optional description for this configuration. - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_projectId` string — Binds 'projectId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'projectId' at runtime. - `__template_datasetId` string — Binds 'datasetId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'datasetId' at runtime. - `__template_tableId` string — Binds 'tableId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tableId' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - OutputGoogleChronicle - `id` string — Unique ID for this output - `type` 'google_chronicle', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `apiVersion` 'v1' | 'v2' — API version - `authenticationMethod` 'manual' | 'secret' | 'serviceAccount' | 'serviceAccountSecret' — Authentication method - `responseRetrySettings` ResponseRetrySettingConfOutputWebhook[] — Automatically retry after unsuccessful response status codes, such as 429 (Too Many Requests) or 503 (Service Unavailable) - `httpStatus` number, required — The HTTP response status code that will trigger retries - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `timeoutRetrySettings` TimeoutRetrySettingsType - `timeoutRetry` boolean, required — Retry timed-out HTTP requests - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `responseHonorRetryAfterHeader` boolean — Honor any Retry-After header that specifies a delay (in seconds) no longer than 180 seconds after the retry request. @{product} limits the delay to 180 seconds, even if the Retry-After header specifies a longer delay. When enabled, takes precedence over user-configured retry options. When disabled, all Retry-After headers are ignored. - `logFormatType` 'unstructured' | 'udm', required — Send events as - `region` string — Regional endpoint to send events to - `concurrency` number — Maximum number of ongoing requests before blocking - `maxPayloadSizeKB` number — Maximum size, in KB, of the request body - `maxPayloadEvents` number — Maximum number of events to include in the request body. Default is 0 (unlimited). - `compress` boolean — Compress the payload body before sending - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's). Enabled by default. When this setting is also present in TLS Settings (Client Side), that value will take precedence. - `timeoutSec` number — Amount of time, in seconds, to wait for a request to complete before canceling it - `maxConnectionReuseSec` number — How long, in seconds, to reuse a keep-alive connection after its first use before forcing it closed. Set to 0 to disable the time-based close and reuse connections for as long as the destination server permits. - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Body size limit. - `extraHttpHeaders` ExtraHttpHeaderConfInputElastic[] — Headers to add to all events - `name` string — Field Name - `value` string, required — Field Value - `failedRequestLoggingMode` 'payload' | 'payloadAndHeaders' | 'none' — Data to log when a request fails. All headers are redacted by default, unless listed as safe headers below. - `safeHeaders` string[] — List of headers that are safe to log in plain text - `useRoundRobinDns` boolean — Enable round-robin DNS lookup. When a DNS server returns multiple addresses, @{product} will cycle through them in the order returned. - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `totalMemoryLimitKB` number — Maximum total size of the batches waiting to be sent. If left blank, defaults to 5 times the max body size (if set). If 0, no limit is enforced. - `description` string — Optional description for this configuration. - `extraLogTypes` object[] — Custom log types. If the value "Custom" is selected in the setting "Default log type" above, the first custom log type in this table will be automatically selected as default log type. - `logType` string, required — Log Type - `description` string — Description - `logType` string — Default log type value to send to SecOps. Can be overwritten by event field __logType. - `logTextField` string — Name of the event field that contains the log text to send. If not specified, Stream sends a JSON representation of the whole event. - `customerId` string — A unique identifier (UUID) for your Google SecOps instance. This is provided by your Google representative and is required for API V2 authentication. - `namespace` string — User-configured environment namespace to identify the data domain the logs originated from. Use namespace as a tag to identify the appropriate data domain for indexing and enrichment functionality. Can be overwritten by event field __namespace. - `customLabels` KeyValueMetadataConfOutputFilesystem[] — Custom labels to be added to every batch - `key` string, required — Key - `value` string, required — Value - `udmType` 'entities' | 'logs' — Defines the specific format for UDM events sent to Google SecOps. This must match the type of UDM data being sent. - `apiKey` string — Organization's API key in Google SecOps - `apiKeySecret` string — Select or create a stored text secret - `serviceAccountCredentials` string — Contents of service account credentials (JSON keys) file downloaded from Google Cloud. To upload a file, click the upload button at this field's upper right. - `serviceAccountCredentialsSecret` string — Select or create a stored text secret - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_apiVersion` string — Binds 'apiVersion' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'apiVersion' at runtime. - `__template_region` string — Binds 'region' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'region' at runtime. - `__template_failedRequestLoggingMode` string — Binds 'failedRequestLoggingMode' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'failedRequestLoggingMode' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_customerId` string — Binds 'customerId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'customerId' at runtime. - OutputGoogleCloudStorage - `id` string — Unique ID for this output - `type` 'google_cloud_storage', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `bucket` string, required — Name of the destination bucket. This value can be a constant or a JavaScript expression that can only be evaluated at init time. Example of referencing a Global Variable: `myBucket-${C.vars.myVar}`. - `region` string, required — Region where the bucket is located - `endpoint` string, required — Google Cloud Storage service endpoint - `awsAuthenticationMethod` 'auto' | 'manual' | 'secret' — Authentication method - `stagePath` string, required — Filesystem location in which to buffer files, before compressing and moving to final destination. Use performant and stable storage. - `destPath` string — Prefix to prepend to files before uploading. Must be a JavaScript expression (which can evaluate to a constant value), enclosed in quotes or backticks. Can be evaluated only at init time. Example referencing a Global Variable: `myKeyPrefix-${C.vars.myVar}` - `verifyPermissions` boolean — Disable if you can access files within the bucket but not the bucket itself - `objectACL` 'private' | 'bucket-owner-read' | 'bucket-owner-full-control' | 'project-private' | 'authenticated-read' | 'public-read' — Object ACL to assign to uploaded objects - `storageClass` 'STANDARD' | 'NEARLINE' | 'COLDLINE' | 'ARCHIVE' — Storage class to select for uploaded objects - `reuseConnections` boolean — Reuse connections between requests, which can improve performance - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA, such as self-signed certificates - `addIdToStagePath` boolean — Add the Output ID value to staging location - `removeEmptyDirs` boolean — Remove empty staging directories after moving files - `partitionExpr` string — JavaScript expression defining how files are partitioned and organized. Default is date-based. If blank, Stream will fall back to the event's __partition field value – if present – otherwise to each location's root directory. - `format` 'json' | 'raw' | 'parquet' — Format of the output data - `baseFileName` string — JavaScript expression to define the output filename prefix (can be constant) - `fileNameSuffix` string — JavaScript expression to define the output filename suffix (can be constant). The `__format` variable refers to the value of the `Data format` field (`json` or `raw`). The `__compression` field refers to the kind of compression being used (`none` or `gzip`). - `maxFileSizeMB` number — Maximum uncompressed output file size. Files of this size will be closed and moved to final output location. - `maxFileOpenTimeSec` number — Maximum amount of time to write to a file. Files open for longer than this will be closed and moved to final output location. - `maxFileIdleTimeSec` number — Maximum amount of time to keep inactive files open. Files open for longer than this will be closed and moved to final output location. - `maxOpenFiles` number — Maximum number of files to keep open concurrently. When exceeded, @{product} will close the oldest open files and move them to the final output location. - `headerLine` string — If set, this line will be written to the beginning of each output file - `writeHighWaterMark` number — Buffer size used to write to a file - `onBackpressure` 'block' | 'drop' — How to handle events when all receivers are exerting backpressure - `deadletterEnabled` boolean — If a file fails to move to its final destination after the maximum number of retries, move it to a designated directory to prevent further errors - `onDiskFullBackpressure` 'block' | 'drop' — How to handle events when disk space is below the global 'Min free disk space' limit - `forceCloseOnShutdown` boolean — Force all staged files to close during an orderly Node shutdown. This triggers immediate upload of in-progress data — regardless of idle time, file age, or size thresholds — to minimize data loss. - `retrySettings` RetrySettingsType - `enabled` boolean — Apply exponential backoff with jitter when file uploads fail repeatedly. - `initialBackoffMs` number — Initial delay before first retry attempt. Valid range: 1s-5min (1000-300000ms). Values outside this range will be clamped to the nearest valid value. - `backoffMultiplier` number — Multiplier applied to backoff delay after each retry. Valid range: 1-10. Values outside this range will be clamped to the nearest valid value. - `maxBackoffMs` number — Maximum delay between retry attempts. Valid range: 1s-10min (1000-600000ms). Values outside this range will be clamped to the nearest valid value. - `jitterPercent` number — Random jitter percentage added to backoff delay to prevent thundering herd. Valid range: 0-100. Values outside this range will be clamped to the nearest valid value. - `orphans` OrphanFileRecoveryType — Orphan file recovery - `disabled` boolean — Periodically scan the staging directory for files not tracked by any Worker manifest to recover them - `periodMin` number — Minimum interval between reconciliation runs - `description` string — Optional description for this configuration. - `compress` 'none' | 'gzip' — Data compression format to apply to HTTP content before it is delivered - `compressionLevel` 'best_speed' | 'normal' | 'best_compression' — Compression level to apply before moving files to final destination - `automaticSchema` boolean — Automatically calculate the schema based on the events of each Parquet file generated - `parquetSchema` string — To add a new schema, navigate to Processing > Knowledge > Parquet Schemas - `parquetVersion` 'PARQUET_1_0' | 'PARQUET_2_4' | 'PARQUET_2_6' — Determines which data types are supported and how they are represented - `parquetDataPageVersion` 'DATA_PAGE_V1' | 'DATA_PAGE_V2' — Serialization format of data pages. Note that some reader implementations use Data page V2's attributes to work more efficiently, while others ignore it. - `parquetRowGroupLength` number — The number of rows that every group will contain. The final group can contain a smaller number of rows. - `parquetPageSize` string — Target memory size for page segments, such as 1MB or 128MB. Generally, lower values improve reading speed, while higher values improve compression. - `shouldLogInvalidRows` boolean — Log up to 3 rows that @{product} skips due to data mismatch - `keyValueMetadata` KeyValueMetadataConfOutputFilesystem[] — The metadata of files the Destination writes will include the properties you add here as key-value pairs. Useful for tagging. Examples: "key":"OCSF Event Class", "value":"9001" - `key` string, required — Key - `value` string, required — Value - `enableStatistics` boolean — Statistics profile an entire file in terms of minimum/maximum values within data, numbers of nulls, etc. You can use Parquet tools to view statistics. - `enableWritePageIndex` boolean — One page index contains statistics for one data page. Parquet readers use statistics to enable page skipping. - `enablePageChecksum` boolean — Parquet tools can use the checksum of a Parquet page to verify data integrity - `emptyDirCleanupSec` number — How frequently, in seconds, to clean up empty directories - `directoryBatchSize` number — Number of directories to process in each batch during cleanup of empty directories. Minimum is 10, maximum is 10000. Higher values may require more memory. - `deadletterPath` string — Storage location for files that fail to reach their final destination after maximum retries are exceeded - `maxRetryNum` number — The maximum number of times a file will attempt to move to its final destination before being dead-lettered - `awsApiKey` string — HMAC access key. This value can be a constant or a JavaScript expression, such as `${C.env.GCS_ACCESS_KEY}`. - `awsSecretKey` string — HMAC secret. This value can be a constant or a JavaScript expression, such as `${C.env.GCS_SECRET}`. - `awsSecret` string — Select or create a stored secret that references your access key and secret key - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_bucket` string — Binds 'bucket' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'bucket' at runtime. - `__template_region` string — Binds 'region' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'region' at runtime. - `__template_endpoint` string — Binds 'endpoint' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'endpoint' at runtime. - `__template_destPath` string — Binds 'destPath' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'destPath' at runtime. - `__template_objectACL` string — Binds 'objectACL' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'objectACL' at runtime. - `__template_storageClass` string — Binds 'storageClass' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'storageClass' at runtime. - `__template_partitionExpr` string — Binds 'partitionExpr' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'partitionExpr' at runtime. - `__template_format` string — Binds 'format' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'format' at runtime. - `__template_baseFileName` string — Binds 'baseFileName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'baseFileName' at runtime. - `__template_fileNameSuffix` string — Binds 'fileNameSuffix' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'fileNameSuffix' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_compress` string — Binds 'compress' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'compress' at runtime. - `__template_parquetSchema` string — Binds 'parquetSchema' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'parquetSchema' at runtime. - `__template_awsApiKey` string — Binds 'awsApiKey' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'awsApiKey' at runtime. - `__template_awsSecretKey` string — Binds 'awsSecretKey' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'awsSecretKey' at runtime. - OutputGoogleCloudLogging - `id` string — Unique ID for this output - `type` 'google_cloud_logging', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `logLocationType` 'project' | 'organization' | 'billingAccount' | 'folder', required — Log location type - `logNameExpression` string, required — JavaScript expression to compute the value of the log name. If Validate and correct log name is enabled, invalid characters (characters other than alphanumerics, forward-slashes, underscores, hyphens, and periods) will be replaced with an underscore. - `sanitizeLogNames` boolean — Validate and correct log name - `payloadFormat` 'text' | 'json' — Format to use when sending payload. Defaults to Text. - `logLabels` LogLabelConfOutputGoogleCloudLogging[] — Labels to apply to the log entry - `label` string, required — Label name - `valueExpression` string, required — JavaScript expression to compute the label's value. - `resourceTypeExpression` string — JavaScript expression to compute the value of the managed resource type field. Must evaluate to one of the valid values [here](https://cloud.google.com/logging/docs/api/v2/resource-list#resource-types). Defaults to "global". - `resourceTypeLabels` LogLabelConfOutputGoogleCloudLogging[] — Labels to apply to the managed resource. These must correspond to the valid labels for the specified resource type (see [here](https://cloud.google.com/logging/docs/api/v2/resource-list#resource-types)). Otherwise, they will be dropped by Google Cloud Logging. - `label` string, required — Label name - `valueExpression` string, required — JavaScript expression to compute the label's value. - `severityExpression` string — JavaScript expression to compute the value of the severity field. Must evaluate to one of the severity values supported by Google Cloud Logging [here](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#logseverity) (case insensitive). Defaults to "DEFAULT". - `insertIdExpression` string — JavaScript expression to compute the value of the insert ID field. - `googleAuthMethod` 'auto' | 'manual' | 'secret' — Choose Auto to use Google Application Default Credentials (ADC), Manual to enter Google service account credentials directly, or Secret to select or create a stored secret that references Google service account credentials. - `serviceAccountCredentials` string — Contents of service account credentials (JSON keys) file downloaded from Google Cloud. To upload a file, click the upload button at this field's upper right. - `secret` string — Select or create a stored text secret - `maxPayloadSizeKB` number — Maximum size, in KB, of the request body. - `maxPayloadEvents` number — Max number of events to include in the request body. Default is 0 (unlimited). - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Max record size. - `concurrency` number — Maximum number of ongoing requests before blocking. - `connectionTimeout` number — Amount of time (milliseconds) to wait for the connection to establish before retrying - `timeoutSec` number — Amount of time, in seconds, to wait for a request to complete before canceling it. - `throttleRateReqPerSec` integer — Maximum number of requests to limit to per second. - `requestMethodExpression` string — A JavaScript expression that evaluates to the HTTP request method as a string. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest) for details. - `requestUrlExpression` string — A JavaScript expression that evaluates to the HTTP request URL as a string. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest) for details. - `requestSizeExpression` string — A JavaScript expression that evaluates to the HTTP request size as a string, in int64 format. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest) for details. - `statusExpression` string — A JavaScript expression that evaluates to the HTTP request method as a number. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest) for details. - `responseSizeExpression` string — A JavaScript expression that evaluates to the HTTP response size as a string, in int64 format. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest) for details. - `userAgentExpression` string — A JavaScript expression that evaluates to the HTTP request user agent as a string. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest) for details. - `remoteIpExpression` string — A JavaScript expression that evaluates to the HTTP request remote IP as a string. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest) for details. - `serverIpExpression` string — A JavaScript expression that evaluates to the HTTP request server IP as a string. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest) for details. - `refererExpression` string — A JavaScript expression that evaluates to the HTTP request referer as a string. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest) for details. - `latencyExpression` string — A JavaScript expression that evaluates to the HTTP request latency, formatted as .s (for example, 1.23s). See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest) for details. - `cacheLookupExpression` string — A JavaScript expression that evaluates to the HTTP request cache lookup as a boolean. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest) for details. - `cacheHitExpression` string — A JavaScript expression that evaluates to the HTTP request cache hit as a boolean. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest) for details. - `cacheValidatedExpression` string — A JavaScript expression that evaluates to the HTTP request cache validated with origin server as a boolean. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest) for details. - `cacheFillBytesExpression` string — A JavaScript expression that evaluates to the HTTP request cache fill bytes as a string, in int64 format. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest) for details. - `protocolExpression` string — A JavaScript expression that evaluates to the HTTP request protocol as a string. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest) for details. - `idExpression` string — A JavaScript expression that evaluates to the log entry operation ID as a string. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#logentryoperation) for details. - `producerExpression` string — A JavaScript expression that evaluates to the log entry operation producer as a string. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#logentryoperation) for details. - `firstExpression` string — A JavaScript expression that evaluates to the log entry operation first flag as a boolean. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#logentryoperation) for details. - `lastExpression` string — A JavaScript expression that evaluates to the log entry operation last flag as a boolean. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#logentryoperation) for details. - `fileExpression` string — A JavaScript expression that evaluates to the log entry source location file as a string. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#logentrysourcelocation) for details. - `lineExpression` string — A JavaScript expression that evaluates to the log entry source location line as a string, in int64 format. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#logentrysourcelocation) for details. - `functionExpression` string — A JavaScript expression that evaluates to the log entry source location function as a string. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#logentrysourcelocation) for details. - `uidExpression` string — A JavaScript expression that evaluates to the log entry log split UID as a string. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#logsplit) for details. - `indexExpression` string — A JavaScript expression that evaluates to the log entry log split index as a number. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#logsplit) for details. - `totalSplitsExpression` string — A JavaScript expression that evaluates to the log entry log split total splits as a number. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#logsplit) for details. - `traceExpression` string — A JavaScript expression that evaluates to the REST resource name of the trace being written as a string. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry) for details. - `spanIdExpression` string — A JavaScript expression that evaluates to the ID of the cloud trace span associated with the current operation in which the log is being written as a string. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry) for details. - `traceSampledExpression` string — A JavaScript expression that evaluates to the the sampling decision of the span associated with the log entry. See the [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry) for details. - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `totalMemoryLimitKB` number — Maximum total size of the batches waiting to be sent. If left blank, defaults to 5 times the max body size (if set). If 0, no limit is enforced. - `description` string — Optional description for this configuration. - `logLocationExpression` string, required — JavaScript expression to compute the value of the folder ID with which log entries should be associated. If Validate and correct log name is enabled, invalid characters (characters other than alphanumerics, forward-slashes, underscores, hyphens, and periods) will be replaced with an underscore. - `payloadExpression` string — JavaScript expression to compute the value of the payload. Must evaluate to a JavaScript object value. If an invalid value is encountered it will result in the default value instead. Defaults to the entire event. - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_logLocationType` string — Binds 'logLocationType' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'logLocationType' at runtime. - `__template_logNameExpression` string — Binds 'logNameExpression' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'logNameExpression' at runtime. - `__template_payloadFormat` string — Binds 'payloadFormat' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'payloadFormat' at runtime. - `__template_resourceTypeExpression` string — Binds 'resourceTypeExpression' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'resourceTypeExpression' at runtime. - `__template_severityExpression` string — Binds 'severityExpression' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'severityExpression' at runtime. - `__template_insertIdExpression` string — Binds 'insertIdExpression' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'insertIdExpression' at runtime. - `__template_traceExpression` string — Binds 'traceExpression' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'traceExpression' at runtime. - `__template_spanIdExpression` string — Binds 'spanIdExpression' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'spanIdExpression' at runtime. - `__template_traceSampledExpression` string — Binds 'traceSampledExpression' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'traceSampledExpression' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_logLocationExpression` string — Binds 'logLocationExpression' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'logLocationExpression' at runtime. - `__template_payloadExpression` string — Binds 'payloadExpression' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'payloadExpression' at runtime. - OutputGoogleCloudObservability - `id` string — Unique ID for this output - `type` 'google_cloud_observability', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `protocol` 'grpc' — Discriminator value. - `otlpVersion` '1.3.1' — Discriminator value. - `endpoint` 'telemetry.googleapis.com:443' — Fixed Google Cloud Observability gRPC endpoint. All three signals share this transport; the OTLP service path determines whether the call lands on traces, metrics, or logs. - `googleAuthMethod` 'auto' | 'secret', required — Choose Auto to use Google Application Default Credentials (ADC). Choose Secret to select or create a stored secret that references Google service account credentials. - `preserveNativeAnyValue` boolean — Values already in OTLP AnyValue form (e.g. {string_value: "..."}) are serialized directly instead of being wrapped as key-value maps - `metadata` KeyValueMetadataConfOutputFilesystem[] — List of key-value pairs to send with each gRPC request. Value supports JavaScript expressions that are evaluated just once, when the destination gets started. To pass credentials as metadata, use 'C.Secret'. - `key` string, required — Key - `value` string, required — Value - `dynamicHeadersEnabled` boolean — Batch event data upon dynamic metadata (whether presented or not) - `dynamicHeadersField` string — When presented, this field which contains metadata, will be injected into the Destination metadata and used to batch events. - `concurrency` number — Maximum number of ongoing requests before blocking - `maxPayloadSizeKB` number — Maximum size, in KB, of the request body sent to Google Cloud Observability - `timeoutSec` number — Amount of time, in seconds, to wait for a request to complete before canceling it - `maxConnectionReuseSec` number — How long, in seconds, to reuse a keep-alive connection after its first use before forcing it closed. Set to 0 to disable the time-based close and reuse connections for as long as the destination server permits. - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Body size limit. - `failedRequestLoggingMode` 'payload' | 'payloadAndHeaders' | 'none' — Data to log when a request fails. All headers are redacted by default, unless listed as safe headers below. - `connectionTimeout` number — Amount of time (milliseconds) to wait for the connection to establish before retrying - `keepAliveTime` number — How often the sender should ping the peer to keep the connection open - `tls` TlsSettingsClientSideTypeExtended — TLS settings (client side) - `disabled` boolean — Disabled - `rejectUnauthorized` boolean — Reject certificates that are not authorized by a CA in the CA certificate path, or by another trusted CA (such as the system's). Defaults to Enabled. Overrides the toggle from Advanced Settings, when also present. - `certificateName` string — The name of the predefined certificate - `caPath` string — Path on client in which to find CA certificates to verify the server's cert. PEM format. Can reference $ENV_VARS. - `privKeyPath` string — Path on client in which to find the private key to use. PEM format. Can reference $ENV_VARS. - `certPath` string — Path on client in which to find certificates to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `maxPayloadEvents` number — Max number of events to include in the request body. Default is 0 (unlimited). Use to keep outgoing data points within GCO request limits. For metrics, combine with the OTLP Metrics function batchSize. - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `description` string — Optional description for this configuration. - `secret` string — Select or create a stored text secret - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_failedRequestLoggingMode` string — Binds 'failedRequestLoggingMode' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'failedRequestLoggingMode' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - … truncated; see the full OpenAPI document linked below ## Response `200` The updated Destination object in a single-item list. - CountedOutputResponse - `count` integer, required — number of items present in the items array - `items` OutputResponse[], required — List of items in this response. - union - object — Destination configuration with optional Notifications and runtime status. - `id` string — Unique ID for this output - `type` 'default', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `defaultId` string, nullable, required — ID of the default output. This will be used whenever a nonexistent/deleted output is referenced. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `notifications` Notification[] — Notifications attached to the Destination. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - union - unknown - unknown - object — Destination configuration with optional Notifications and runtime status. - `id` string — Unique ID for this output - `type` 'sentinel', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `keepAlive` boolean — Disable to close the connection immediately after sending the outgoing request - `concurrency` number — Maximum number of ongoing requests before blocking - `maxPayloadSizeKB` number — Maximum size (KB) of the request body (defaults to the API's maximum limit of 1000 KB) - `maxPayloadEvents` number — Maximum number of events to include in the request body. Default is 0 (unlimited). - `compress` boolean — Compress the payload body before sending - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's). Enabled by default. When this setting is also present in TLS Settings (Client Side), that value will take precedence. - `timeoutSec` number — Amount of time, in seconds, to wait for a request to complete before canceling it - `maxConnectionReuseSec` number — How long, in seconds, to reuse a keep-alive connection after its first use before forcing it closed. Set to 0 to disable the time-based close and reuse connections for as long as the destination server permits. - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Body size limit. - `extraHttpHeaders` ExtraHttpHeaderConfInputElastic[] — Headers to add to all events. You can also add headers dynamically on a per-event basis in the __headers field, as explained in [Cribl Docs](https://docs.cribl.io/stream/destinations-webhook/#internal-fields). - `name` string — Field Name - `value` string, required — Field Value - `useRoundRobinDns` boolean — Enable round-robin DNS lookup. When a DNS server returns multiple addresses, @{product} will cycle through them in the order returned. For optimal performance, consider enabling this setting for non-load balanced destinations. - `failedRequestLoggingMode` 'payload' | 'payloadAndHeaders' | 'none' — Data to log when a request fails. All headers are redacted by default, unless listed as safe headers below. - `safeHeaders` string[] — List of headers that are safe to log in plain text - `responseRetrySettings` ResponseRetrySettingConfOutputWebhook[] — Automatically retry after unsuccessful response status codes, such as 429 (Too Many Requests) or 503 (Service Unavailable) - `httpStatus` number, required — The HTTP response status code that will trigger retries - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `timeoutRetrySettings` TimeoutRetrySettingsType - `timeoutRetry` boolean, required — Retry timed-out HTTP requests - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `responseHonorRetryAfterHeader` boolean — Honor any Retry-After header that specifies a delay (in seconds) no longer than 180 seconds after the retry request. @{product} limits the delay to 180 seconds, even if the Retry-After header specifies a longer delay. When enabled, takes precedence over user-configured retry options. When disabled, all Retry-After headers are ignored. - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `authType` 'oauth' — Discriminator value. - `loginUrl` string, required — URL for OAuth - `secret` string, required — Secret parameter value to pass in request body - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, @{product} will use the refresh token to obtain new access tokens without re-sending credentials. - `rotateRefreshToken` boolean — @{product} will update the stored value on each successful refresh. Enable if the server issues a new refresh token on every use. - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL. - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauthSecret[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, @{product} sends only grant_type, refresh_token, and client_secret. - `name` string, required — Name - `value` string, required — Value - `client_id` string, required — JavaScript expression to compute the Client ID for the Azure application. Can be a constant. - `scope` string — Scope to pass in the OAuth request - `endpointURLConfiguration` 'url' | 'ID', required — Enter the data collection endpoint URL or the individual ID - `totalMemoryLimitKB` number — Maximum total size of the batches waiting to be sent. If left blank, defaults to 5 times the max body size (if set). If 0, no limit is enforced. - `description` string — Optional description for this configuration. - `format` 'ndjson' | 'json_array' | 'custom' | 'advanced' - `customSourceExpression` string — Expression to evaluate on events to generate output. Example: `raw=${_raw}`. See [Cribl Docs](https://docs.cribl.io/stream/destinations-webhook#custom-format) for other examples. If empty, the full event is sent as stringified JSON. - `customDropWhenNull` boolean — Whether to drop events when the source expression evaluates to null - `customEventDelimiter` string — Delimiter string to insert between individual events. Defaults to newline character. - `customContentType` string — Content type to use for request. Defaults to application/x-ndjson. Any content types set in Advanced Settings > Extra HTTP headers will override this entry. - `customPayloadExpression` string — Expression specifying how to format the payload for each batch. To reference the events to send, use the `${events}` variable. Example expression: `{ "items" : [${events}] }` would send the batch inside a JSON object. - `advancedContentType` string — HTTP content-type header value - `formatEventCode` string — Custom JavaScript code to format incoming event data accessible through the __e variable. The formatted content is added to (__e['__eventOut']) if available. Otherwise, the original event is serialized as JSON. Caution: This function is evaluated in an unprotected context, allowing you to execute almost any JavaScript code. - `formatPayloadCode` string — Optional JavaScript code to format the payload sent to the Destination. The payload, containing a batch of formatted events, is accessible through the __e['payload'] variable. The formatted payload is returned in the __e['__payloadOut'] variable. Caution: This function is evaluated in an unprotected context, allowing you to execute almost any JavaScript code. - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `url` string — URL to send events to. Can be overwritten by an event's __url field. - `dcrID` string — Immutable ID for the Data Collection Rule (DCR) - `dceEndpoint` string — Data collection endpoint (DCE) URL. In the format: `https://-..ingest.monitor.azure.com` - `streamName` string — The name of the stream (Sentinel table) in which to store the events - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_failedRequestLoggingMode` string — Binds 'failedRequestLoggingMode' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'failedRequestLoggingMode' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime. - `__template_secret` string — Binds 'secret' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'secret' at runtime. - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime. - `__template_client_id` string — Binds 'client_id' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'client_id' at runtime. - `__template_scope` string — Binds 'scope' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'scope' at runtime. - `__template_url` string — Binds 'url' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'url' at runtime. - `__template_dcrID` string — Binds 'dcrID' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'dcrID' at runtime. - `__template_dceEndpoint` string — Binds 'dceEndpoint' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'dceEndpoint' at runtime. - `__template_streamName` string — Binds 'streamName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamName' at runtime. - `notifications` Notification[] — Notifications attached to the Destination. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Destination configuration with optional Notifications and runtime status. - `id` string — Unique ID for this output - `type` 'devnull', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `notifications` Notification[] — Notifications attached to the Destination. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Destination configuration with optional Notifications and runtime status. - `id` string — Unique ID for this output - `type` 'syslog', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `protocol` 'tcp' | 'udp' — The network protocol to use for sending out syslog messages - `facility` 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 — Default value for message facility. Will be overwritten by value of __facility if set. Defaults to user. - `severity` 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 — Default value for message severity. Will be overwritten by value of __severity if set. Defaults to notice. - `appName` string — Default name for device or application that originated the message. Defaults to Cribl, but will be overwritten by value of __appname if set. - `messageFormat` 'rfc3164' | 'rfc5424' — The syslog message format depending on the receiver's support - `timestampFormat` 'syslog' | 'iso8601' — Timestamp format to use when serializing event's time field - `throttleRatePerSec` string — Rate (in bytes per second) to throttle while writing to an output. Accepts values with multiple-byte units, such as KB, MB, and GB. (Example: 42 MB) Default value of 0 specifies no throttling. - `octetCountFraming` boolean — Prefix messages with the byte count of the message. If disabled, no prefix will be set, and the message will be appended with a \n. - `logFailedRequests` boolean — Use to troubleshoot issues with sending data - `description` string — Optional description for this configuration. - `loadBalanced` boolean — For optimal performance, enable load balancing even if you have one hostname, as it can expand to multiple IPs. If this setting is disabled, consider enabling round-robin DNS. - `host` string — The hostname of the receiver - `port` number — The port to connect to on the provided host - `excludeSelf` boolean — Exclude all IPs of the current host from the list of any resolved hostnames - `hosts` HostConfOutputSyslog[] — Set of hosts to load-balance data to - `host` string, required — The hostname of the receiver - `port` number, required — The port to connect to on the provided host - `tls` 'inherit' | 'off' — Whether to inherit TLS configs from group setting or disable TLS - `servername` string — Servername to use if establishing a TLS connection. If not specified, defaults to connection host (if not an IP); otherwise, uses the global TLS settings. - `weight` number — Assign a weight (>0) to each endpoint to indicate its traffic-handling capability - `__template_host` string — Binds 'host' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'host' at runtime. - `__template_port` string — Binds 'port' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'port' at runtime. - `dnsResolvePeriodSec` number — The interval in which to re-resolve any hostnames and pick up destinations from A records - `loadBalanceStatsPeriodSec` number — How far back in time to keep traffic stats for load balancing purposes - `maxConcurrentSenders` number — Maximum number of concurrent connections (per Worker Process). A random set of IPs will be picked on every DNS resolution period. Use 0 for unlimited. - `connectionTimeout` number — Amount of time (milliseconds) to wait for the connection to establish before retrying - `writeTimeout` number — Amount of time (milliseconds) to wait for a write to complete before assuming connection is dead - `tls` TlsSettingsClientSideTypeCaPathCertPath — TLS settings (client side) - `disabled` boolean — Disabled - `rejectUnauthorized` boolean — Reject certificates that are not authorized by a CA in the CA certificate path, or by another trusted CA (such as the system's). Defaults to Enabled. Overrides the toggle from Advanced Settings, when also present. - `servername` string — Server name for the SNI (Server Name Indication) TLS extension. It must be a host name, and not an IP address. - `certificateName` string — The name of the predefined certificate - `caPath` string — Path on client in which to find CA certificates to verify the server's cert. PEM format. Can reference $ENV_VARS. - `privKeyPath` string — Path on client in which to find the private key to use. PEM format. Can reference $ENV_VARS. - `certPath` string — Path on client in which to find certificates to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `maxRecordSize` number — Maximum size of syslog messages. Make sure this value is less than or equal to the MTU to avoid UDP packet fragmentation. - `udpDnsResolvePeriodSec` number — How often to resolve the destination hostname to an IP address. Ignored if the destination is an IP address. A value of 0 means every message sent will incur a DNS lookup. - `enableIpSpoofing` boolean — Send Syslog traffic using the original event's Source IP and port. To enable this, you must install the external `udp-sender` helper binary at `/usr/bin/udp-sender` on all Worker Nodes and grant it the `CAP_NET_RAW` capability. - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_host` string — Binds 'host' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'host' at runtime. - `__template_port` string — Binds 'port' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'port' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `notifications` Notification[] — Notifications attached to the Destination. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Destination configuration with optional Notifications and runtime status. - `id` string — Unique ID for this output - `type` 'splunk', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `host` string, required — The hostname of the receiver - `port` number, required — The port to connect to on the provided host - `nestedFields` 'json' | 'none' — How to serialize nested fields into index-time fields - `throttleRatePerSec` string — Rate (in bytes per second) to throttle while writing to an output. Accepts values with multiple-byte units, such as KB, MB, and GB. (Example: 42 MB) Default value of 0 specifies no throttling. - `connectionTimeout` number — Amount of time (milliseconds) to wait for the connection to establish before retrying - `writeTimeout` number — Amount of time (milliseconds) to wait for a write to complete before assuming connection is dead - `tls` TlsSettingsClientSideTypeCaPathCertPath — TLS settings (client side) - `disabled` boolean — Disabled - `rejectUnauthorized` boolean — Reject certificates that are not authorized by a CA in the CA certificate path, or by another trusted CA (such as the system's). Defaults to Enabled. Overrides the toggle from Advanced Settings, when also present. - `servername` string — Server name for the SNI (Server Name Indication) TLS extension. It must be a host name, and not an IP address. - `certificateName` string — The name of the predefined certificate - `caPath` string — Path on client in which to find CA certificates to verify the server's cert. PEM format. Can reference $ENV_VARS. - `privKeyPath` string — Path on client in which to find the private key to use. PEM format. Can reference $ENV_VARS. - `certPath` string — Path on client in which to find certificates to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `enableMultiMetrics` boolean — Output metrics in multiple-metric format in a single event. Supported in Splunk 8.0 and above. - `enableACK` boolean — Check if indexer is shutting down and stop sending data. This helps minimize data loss during shutdown. - `logFailedRequests` boolean — Use to troubleshoot issues with sending data - `maxS2Sversion` 'v3' | 'v4' — The highest S2S protocol version to advertise during handshake - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `authType` 'manual' | 'secret' — Select Manual to enter an auth token directly, or select Secret to use a text secret to authenticate - `description` string — Optional description for this configuration. - `maxFailedHealthChecks` number — Maximum number of times healthcheck can fail before we close connection. If set to 0 (disabled), and the connection to Splunk is forcibly closed, some data loss might occur. - `compress` 'disabled' | 'auto' | 'always' — Controls whether the sender should send compressed data to the server. Select 'Disabled' to reject compressed connections or 'Always' to ignore server's configuration and send compressed data. - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `authToken` string — Shared secret token to use when establishing a connection to a Splunk indexer. - `textSecret` string — Select or create a stored text secret - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_host` string — Binds 'host' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'host' at runtime. - `__template_port` string — Binds 'port' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'port' at runtime. - `__template_nestedFields` string — Binds 'nestedFields' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'nestedFields' at runtime. - `__template_maxS2Sversion` string — Binds 'maxS2Sversion' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'maxS2Sversion' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_compress` string — Binds 'compress' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'compress' at runtime. - `notifications` Notification[] — Notifications attached to the Destination. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Destination configuration with optional Notifications and runtime status. - `id` string — Unique ID for this output - `type` 'splunk_lb', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `dnsResolvePeriodSec` number — The interval in which to re-resolve any hostnames and pick up destinations from A records - `loadBalanceStatsPeriodSec` number — How far back in time to keep traffic stats for load balancing purposes - `maxConcurrentSenders` number — Maximum number of concurrent connections (per Worker Process). A random set of IPs will be picked on every DNS resolution period. Use 0 for unlimited. - `nestedFields` 'json' | 'none' — How to serialize nested fields into index-time fields - `throttleRatePerSec` string — Rate (in bytes per second) to throttle while writing to an output. Accepts values with multiple-byte units, such as KB, MB, and GB. (Example: 42 MB) Default value of 0 specifies no throttling. - `connectionTimeout` number — Amount of time (milliseconds) to wait for the connection to establish before retrying - `writeTimeout` number — Amount of time (milliseconds) to wait for a write to complete before assuming connection is dead - `tls` TlsSettingsClientSideTypeCaPathCertPath — TLS settings (client side) - `disabled` boolean — Disabled - `rejectUnauthorized` boolean — Reject certificates that are not authorized by a CA in the CA certificate path, or by another trusted CA (such as the system's). Defaults to Enabled. Overrides the toggle from Advanced Settings, when also present. - `servername` string — Server name for the SNI (Server Name Indication) TLS extension. It must be a host name, and not an IP address. - `certificateName` string — The name of the predefined certificate - `caPath` string — Path on client in which to find CA certificates to verify the server's cert. PEM format. Can reference $ENV_VARS. - `privKeyPath` string — Path on client in which to find the private key to use. PEM format. Can reference $ENV_VARS. - `certPath` string — Path on client in which to find certificates to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `enableMultiMetrics` boolean — Output metrics in multiple-metric format in a single event. Supported in Splunk 8.0 and above. - `enableACK` boolean — Check if indexer is shutting down and stop sending data. This helps minimize data loss during shutdown. - `logFailedRequests` boolean — Use to troubleshoot issues with sending data - `maxS2Sversion` 'v3' | 'v4' — The highest S2S protocol version to advertise during handshake - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `indexerDiscovery` boolean — Automatically discover indexers in indexer clustering environment. - `senderUnhealthyTimeAllowance` number — How long (in milliseconds) each LB endpoint can report blocked before the Destination reports unhealthy, blocking the sender. (Grace period for fluctuations.) Use 0 to disable; max 1 minute. - `authType` 'manual' | 'secret' — Select Manual to enter an auth token directly, or select Secret to use a text secret to authenticate - `description` string — Optional description for this configuration. - `maxFailedHealthChecks` number — Maximum number of times healthcheck can fail before we close connection. If set to 0 (disabled), and the connection to Splunk is forcibly closed, some data loss might occur. - `compress` 'disabled' | 'auto' | 'always' — Controls whether the sender should send compressed data to the server. Select 'Disabled' to reject compressed connections or 'Always' to ignore server's configuration and send compressed data. - `indexerDiscoveryConfigs` object — List of configurations to set up indexer discovery in Splunk Indexer clustering environment. - `site` string, required — Clustering site of the indexers from where indexers need to be discovered. In case of single site cluster, it defaults to 'default' site. - `masterUri` string, required — Full URI of Splunk cluster manager (scheme://host:port). Example: https://managerAddress:8089 - `refreshIntervalSec` number, required — Time interval, in seconds, between two consecutive indexer list fetches from cluster manager - `rejectUnauthorized` boolean — During indexer discovery, reject cluster manager certificates that are not authorized by the system's CA. Disable to allow untrusted (for example, self-signed) certificates. - `authTokens` object[] — Tokens required to authenticate to cluster manager for indexer discovery - `authType` 'manual' | 'secret' — Select Manual to enter an auth token directly, or select Secret to use a text secret to authenticate - `authToken` string — Shared secret to be provided by any client (in authToken header field). If empty, unauthorized access is permitted. - `textSecret` string — Select or create a stored text secret - `authType` 'manual' | 'secret' — Select Manual to enter an auth token directly, or select Secret to use a text secret to authenticate - `authToken` string — Shared secret to be provided by any client (in authToken header field). If empty, unauthorized access is permitted. - `textSecret` string — Select or create a stored text secret - `excludeSelf` boolean — Exclude all IPs of the current host from the list of any resolved hostnames - `hosts` HostConfOutputSyslog[], required — Set of Splunk indexers to load-balance data to. - `host` string, required — The hostname of the receiver - `port` number, required — The port to connect to on the provided host - `tls` 'inherit' | 'off' — Whether to inherit TLS configs from group setting or disable TLS - `servername` string — Servername to use if establishing a TLS connection. If not specified, defaults to connection host (if not an IP); otherwise, uses the global TLS settings. - `weight` number — Assign a weight (>0) to each endpoint to indicate its traffic-handling capability - `__template_host` string — Binds 'host' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'host' at runtime. - `__template_port` string — Binds 'port' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'port' at runtime. - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `authToken` string — Shared secret token to use when establishing a connection to a Splunk indexer. - `textSecret` string — Select or create a stored text secret - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_nestedFields` string — Binds 'nestedFields' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'nestedFields' at runtime. - `__template_maxS2Sversion` string — Binds 'maxS2Sversion' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'maxS2Sversion' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_compress` string — Binds 'compress' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'compress' at runtime. - `notifications` Notification[] — Notifications attached to the Destination. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Destination configuration with optional Notifications and runtime status. - `id` string — Unique ID for this output - `type` 'splunk_hec', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `loadBalanced` boolean — Enable for optimal performance. Even if you have one hostname, it can expand to multiple IPs. If disabled, consider enabling round-robin DNS. - `tls` TlsSettingsClientSideTypeCaPathCertPathExtended — TLS settings (client side) - `disabled` boolean — Disabled - `servername` string — Server name for the SNI (Server Name Indication) TLS extension. It must be a host name, and not an IP address. - `certificateName` string — The name of the predefined certificate - `caPath` string — Path on client in which to find CA certificates to verify the server's cert. PEM format. Can reference $ENV_VARS. - `privKeyPath` string — Path on client in which to find the private key to use. PEM format. Can reference $ENV_VARS. - `certPath` string — Path on client in which to find certificates to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `concurrency` number — Maximum number of ongoing requests before blocking - `maxPayloadSizeKB` number — Maximum size, in KB, of the request body - `maxPayloadEvents` number — Maximum number of events to include in the request body. Default is 0 (unlimited). - `compress` boolean — Compress the payload body before sending - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's). Enabled by default. When this setting is also present in TLS Settings (Client Side), that value will take precedence. - `timeoutSec` number — Amount of time, in seconds, to wait for a request to complete before canceling it - `maxConnectionReuseSec` number — How long, in seconds, to reuse a keep-alive connection after its first use before forcing it closed. Set to 0 to disable the time-based close and reuse connections for as long as the destination server permits. - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Body size limit. - `extraHttpHeaders` ExtraHttpHeaderConfInputElastic[] — Headers to add to all events - `name` string — Field Name - `value` string, required — Field Value - `failedRequestLoggingMode` 'payload' | 'payloadAndHeaders' | 'none' — Data to log when a request fails. All headers are redacted by default, unless listed as safe headers below. - `safeHeaders` string[] — List of headers that are safe to log in plain text - `enableMultiMetrics` boolean — Output metrics in multiple-metric format, supported in Splunk 8.0 and above to allow multiple metrics in a single event. - `authType` 'manual' | 'secret' — Select Manual to enter an auth token directly, or select Secret to use a text secret to authenticate - `responseRetrySettings` ResponseRetrySettingConfOutputWebhook[] — Automatically retry after unsuccessful response status codes, such as 429 (Too Many Requests) or 503 (Service Unavailable) - `httpStatus` number, required — The HTTP response status code that will trigger retries - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `timeoutRetrySettings` TimeoutRetrySettingsType - `timeoutRetry` boolean, required — Retry timed-out HTTP requests - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `responseHonorRetryAfterHeader` boolean — Honor any Retry-After header that specifies a delay (in seconds) no longer than 180 seconds after the retry request. @{product} limits the delay to 180 seconds, even if the Retry-After header specifies a longer delay. When enabled, takes precedence over user-configured retry options. When disabled, all Retry-After headers are ignored. - `nextQueue` string — In the Splunk app, define which Splunk processing queue to send the events after HEC processing. - `tcpRouting` string — In the Splunk app, set the value of _TCP_ROUTING for events that do not have _ctrl._TCP_ROUTING set. - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `description` string — Optional description for this configuration. - `url` string — URL to a Splunk HEC endpoint to send events to, e.g., http://localhost:8088/services/collector/event - `useRoundRobinDns` boolean — Enable round-robin DNS lookup. When a DNS server returns multiple addresses, @{product} will cycle through them in the order returned. For optimal performance, consider enabling this setting for non-load balanced destinations. - `excludeSelf` boolean — Exclude all IPs of the current host from the list of any resolved hostnames - `urls` object[] — Splunk HEC Endpoints - `url` string, required — URL to a Splunk HEC endpoint to send events to, e.g., http://localhost:8088/services/collector/event - `weight` number — Assign a weight (>0) to each endpoint to indicate its traffic-handling capability - `__template_url` string — Binds 'url' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'url' at runtime. - `dnsResolvePeriodSec` number — The interval in which to re-resolve any hostnames and pick up destinations from A records - `loadBalanceStatsPeriodSec` number — How far back in time to keep traffic stats for load balancing purposes - `token` string — Splunk HEC authentication token - `textSecret` string — Select or create a stored text secret - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_failedRequestLoggingMode` string — Binds 'failedRequestLoggingMode' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'failedRequestLoggingMode' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_url` string — Binds 'url' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'url' at runtime. - `notifications` Notification[] — Notifications attached to the Destination. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Destination configuration with optional Notifications and runtime status. - `id` string — Unique ID for this output - `type` 'wiz_hec', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `tls` TlsSettingsClientSideTypeCaPathCertPathExtended — TLS settings (client side) - `disabled` boolean — Disabled - `servername` string — Server name for the SNI (Server Name Indication) TLS extension. It must be a host name, and not an IP address. - `certificateName` string — The name of the predefined certificate - `caPath` string — Path on client in which to find CA certificates to verify the server's cert. PEM format. Can reference $ENV_VARS. - `privKeyPath` string — Path on client in which to find the private key to use. PEM format. Can reference $ENV_VARS. - `certPath` string — Path on client in which to find certificates to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `concurrency` number — Maximum number of ongoing requests before blocking - `maxPayloadSizeKB` number — Maximum size, in KB, of the request body - `maxPayloadEvents` number — Maximum number of events to include in the request body. Default is 0 (unlimited). - `compress` boolean — Compress the payload body before sending - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's). Enabled by default. When this setting is also present in TLS Settings (Client Side), that value will take precedence. - `timeoutSec` number — Amount of time, in seconds, to wait for a request to complete before canceling it - `maxConnectionReuseSec` number — How long, in seconds, to reuse a keep-alive connection after its first use before forcing it closed. Set to 0 to disable the time-based close and reuse connections for as long as the destination server permits. - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Body size limit. - `extraHttpHeaders` ExtraHttpHeaderConfInputElastic[] — Headers to add to all events - `name` string — Field Name - `value` string, required — Field Value - `failedRequestLoggingMode` 'payload' | 'payloadAndHeaders' | 'none' — Data to log when a request fails. All headers are redacted by default, unless listed as safe headers below. - `safeHeaders` string[] — List of headers that are safe to log in plain text - `authType` 'manual' | 'secret' — Select Manual to enter an auth token directly, or select Secret to use a text secret to authenticate - `responseRetrySettings` ResponseRetrySettingConfOutputWebhook[] — Automatically retry after unsuccessful response status codes, such as 429 (Too Many Requests) or 503 (Service Unavailable) - `httpStatus` number, required — The HTTP response status code that will trigger retries - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `timeoutRetrySettings` TimeoutRetrySettingsType - `timeoutRetry` boolean, required — Retry timed-out HTTP requests - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `responseHonorRetryAfterHeader` boolean — Honor any Retry-After header that specifies a delay (in seconds) no longer than 180 seconds after the retry request. @{product} limits the delay to 180 seconds, even if the Retry-After header specifies a longer delay. When enabled, takes precedence over user-configured retry options. When disabled, all Retry-After headers are ignored. - `wiz_connector_id` string, required — The unique identifier for the specific Cribl connector defined in your Wiz Settings. This is used to cross-validate the bearer token and ensure traffic is originating from the authorized integration. - `wiz_environment` string, required — Your Wiz deployment environment - `data_center` string, required — Your Wiz deployment data center (such as us1, us8, or eu1). From Tenant Info → Data Center and Regions → Tenant Data Center in your Wiz console. - `wiz_sourcetype` string, required — Wiz Defend Source type - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `description` string — Optional description for this configuration. - `token` string — Wiz Defend Auth token - `textSecret` string — Select or create a stored text secret - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_failedRequestLoggingMode` string — Binds 'failedRequestLoggingMode' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'failedRequestLoggingMode' at runtime. - `__template_wiz_environment` string — Binds 'wiz_environment' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'wiz_environment' at runtime. - `__template_data_center` string — Binds 'data_center' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'data_center' at runtime. - `__template_wiz_sourcetype` string — Binds 'wiz_sourcetype' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'wiz_sourcetype' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `notifications` Notification[] — Notifications attached to the Destination. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Destination configuration with optional Notifications and runtime status. - `id` string — Unique ID for this output - `type` 'tcpjson', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `loadBalanced` boolean — Use load-balanced destinations - `compression` 'none' | 'gzip' — Codec to use to compress the data before sending - `logFailedRequests` boolean — Use to troubleshoot issues with sending data - `throttleRatePerSec` string — Rate (in bytes per second) to throttle while writing to an output. Accepts values with multiple-byte units, such as KB, MB, and GB. (Example: 42 MB) Default value of 0 specifies no throttling. - `tls` TlsSettingsClientSideTypeCaPathCertPath — TLS settings (client side) - `disabled` boolean — Disabled - `rejectUnauthorized` boolean — Reject certificates that are not authorized by a CA in the CA certificate path, or by another trusted CA (such as the system's). Defaults to Enabled. Overrides the toggle from Advanced Settings, when also present. - `servername` string — Server name for the SNI (Server Name Indication) TLS extension. It must be a host name, and not an IP address. - `certificateName` string — The name of the predefined certificate - `caPath` string — Path on client in which to find CA certificates to verify the server's cert. PEM format. Can reference $ENV_VARS. - `privKeyPath` string — Path on client in which to find the private key to use. PEM format. Can reference $ENV_VARS. - `certPath` string — Path on client in which to find certificates to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `connectionTimeout` number — Amount of time (milliseconds) to wait for the connection to establish before retrying - `writeTimeout` number — Amount of time (milliseconds) to wait for a write to complete before assuming connection is dead - `tokenTTLMinutes` number — The number of minutes before the internally generated authentication token expires, valid values between 1 and 60 - `sendHeader` boolean — Upon connection, send a header-like record containing the auth token and other metadata.This record will not contain an actual event – only subsequent records will. - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `authType` 'manual' | 'secret' — Select Manual to enter an auth token directly, or select Secret to use a text secret to authenticate - `description` string — Optional description for this configuration. - `host` string — The hostname of the receiver - `port` number — The port to connect to on the provided host - `excludeSelf` boolean — Exclude all IPs of the current host from the list of any resolved hostnames - `hosts` HostConfOutputSyslog[] — Set of hosts to load-balance data to - `host` string, required — The hostname of the receiver - `port` number, required — The port to connect to on the provided host - `tls` 'inherit' | 'off' — Whether to inherit TLS configs from group setting or disable TLS - `servername` string — Servername to use if establishing a TLS connection. If not specified, defaults to connection host (if not an IP); otherwise, uses the global TLS settings. - `weight` number — Assign a weight (>0) to each endpoint to indicate its traffic-handling capability - `__template_host` string — Binds 'host' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'host' at runtime. - `__template_port` string — Binds 'port' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'port' at runtime. - `dnsResolvePeriodSec` number — The interval in which to re-resolve any hostnames and pick up destinations from A records - `loadBalanceStatsPeriodSec` number — How far back in time to keep traffic stats for load balancing purposes - `maxConcurrentSenders` number — Maximum number of concurrent connections (per Worker Process). A random set of IPs will be picked on every DNS resolution period. Use 0 for unlimited. - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `authToken` string — Optional authentication token to include as part of the connection header - `textSecret` string — Select or create a stored text secret - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_host` string — Binds 'host' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'host' at runtime. - `__template_port` string — Binds 'port' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'port' at runtime. - `notifications` Notification[] — Notifications attached to the Destination. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Destination configuration with optional Notifications and runtime status. - `id` string — Unique ID for this output - `type` 'wavefront', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `authType` 'manual' | 'secret' — Select Manual to enter an auth token directly, or select Secret to use a text secret to authenticate - `domain` string, required — WaveFront domain name, e.g. "longboard" - `concurrency` number — Maximum number of ongoing requests before blocking - `maxPayloadSizeKB` number — Maximum size, in KB, of the request body - `maxPayloadEvents` number — Maximum number of events to include in the request body. Default is 0 (unlimited). - `compress` boolean — Compress the payload body before sending - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's). Enabled by default. When this setting is also present in TLS Settings (Client Side), that value will take precedence. - `timeoutSec` number — Amount of time, in seconds, to wait for a request to complete before canceling it - `maxConnectionReuseSec` number — How long, in seconds, to reuse a keep-alive connection after its first use before forcing it closed. Set to 0 to disable the time-based close and reuse connections for as long as the destination server permits. - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Body size limit. - `extraHttpHeaders` ExtraHttpHeaderConfInputElastic[] — Headers to add to all events - `name` string — Field Name - `value` string, required — Field Value - `useRoundRobinDns` boolean — Enable round-robin DNS lookup. When a DNS server returns multiple addresses, @{product} will cycle through them in the order returned. For optimal performance, consider enabling this setting for non-load balanced destinations. - `failedRequestLoggingMode` 'payload' | 'payloadAndHeaders' | 'none' — Data to log when a request fails. All headers are redacted by default, unless listed as safe headers below. - `safeHeaders` string[] — List of headers that are safe to log in plain text - `responseRetrySettings` ResponseRetrySettingConfOutputWebhook[] — Automatically retry after unsuccessful response status codes, such as 429 (Too Many Requests) or 503 (Service Unavailable) - `httpStatus` number, required — The HTTP response status code that will trigger retries - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `timeoutRetrySettings` TimeoutRetrySettingsType - `timeoutRetry` boolean, required — Retry timed-out HTTP requests - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `responseHonorRetryAfterHeader` boolean — Honor any Retry-After header that specifies a delay (in seconds) no longer than 180 seconds after the retry request. @{product} limits the delay to 180 seconds, even if the Retry-After header specifies a longer delay. When enabled, takes precedence over user-configured retry options. When disabled, all Retry-After headers are ignored. - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `description` string — Optional description for this configuration. - `token` string — WaveFront API authentication token (see [here](https://docs.wavefront.com/wavefront_api.html#generating-an-api-token)) - `textSecret` string — Select or create a stored text secret - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_failedRequestLoggingMode` string — Binds 'failedRequestLoggingMode' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'failedRequestLoggingMode' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `notifications` Notification[] — Notifications attached to the Destination. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Destination configuration with optional Notifications and runtime status. - `id` string — Unique ID for this output - `type` 'signalfx', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `authType` 'manual' | 'secret' — Select Manual to enter an auth token directly, or select Secret to use a text secret to authenticate - `realm` string, required — SignalFx realm name, e.g. "us0". For a complete list of available SignalFx realm names, please check [here](https://docs.splunk.com/observability/en/get-started/service-description.html#sd-regions). - `concurrency` number — Maximum number of ongoing requests before blocking - `maxPayloadSizeKB` number — Maximum size, in KB, of the request body - `maxPayloadEvents` number — Maximum number of events to include in the request body. Default is 0 (unlimited). - `compress` boolean — Compress the payload body before sending - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's). Enabled by default. When this setting is also present in TLS Settings (Client Side), that value will take precedence. - `timeoutSec` number — Amount of time, in seconds, to wait for a request to complete before canceling it - `maxConnectionReuseSec` number — How long, in seconds, to reuse a keep-alive connection after its first use before forcing it closed. Set to 0 to disable the time-based close and reuse connections for as long as the destination server permits. - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Body size limit. - `extraHttpHeaders` ExtraHttpHeaderConfInputElastic[] — Headers to add to all events - `name` string — Field Name - `value` string, required — Field Value - `useRoundRobinDns` boolean — Enable round-robin DNS lookup. When a DNS server returns multiple addresses, @{product} will cycle through them in the order returned. For optimal performance, consider enabling this setting for non-load balanced destinations. - `failedRequestLoggingMode` 'payload' | 'payloadAndHeaders' | 'none' — Data to log when a request fails. All headers are redacted by default, unless listed as safe headers below. - `safeHeaders` string[] — List of headers that are safe to log in plain text - `responseRetrySettings` ResponseRetrySettingConfOutputWebhook[] — Automatically retry after unsuccessful response status codes, such as 429 (Too Many Requests) or 503 (Service Unavailable) - `httpStatus` number, required — The HTTP response status code that will trigger retries - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `timeoutRetrySettings` TimeoutRetrySettingsType - `timeoutRetry` boolean, required — Retry timed-out HTTP requests - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `responseHonorRetryAfterHeader` boolean — Honor any Retry-After header that specifies a delay (in seconds) no longer than 180 seconds after the retry request. @{product} limits the delay to 180 seconds, even if the Retry-After header specifies a longer delay. When enabled, takes precedence over user-configured retry options. When disabled, all Retry-After headers are ignored. - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `description` string — Optional description for this configuration. - `token` string — SignalFx API access token (see [here](https://docs.signalfx.com/en/latest/admin-guide/tokens.html#working-with-access-tokens)) - `textSecret` string — Select or create a stored text secret - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_failedRequestLoggingMode` string — Binds 'failedRequestLoggingMode' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'failedRequestLoggingMode' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `notifications` Notification[] — Notifications attached to the Destination. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Destination configuration with optional Notifications and runtime status. - `id` string — Unique ID for this output - `type` 'filesystem', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `destPath` string, required — Final destination for the output files - `stagePath` string — Filesystem location in which to buffer files, before compressing and moving to final destination. Use performant and stable storage. - `addIdToStagePath` boolean — Add the Output ID value to staging location - `removeEmptyDirs` boolean — Remove empty staging directories after moving files - `partitionExpr` string — JavaScript expression defining how files are partitioned and organized. Default is date-based. If blank, Stream will fall back to the event's __partition field value – if present – otherwise to each location's root directory. - `format` 'json' | 'raw' | 'parquet' — Format of the output data - `baseFileName` string — JavaScript expression to define the output filename prefix (can be constant) - `fileNameSuffix` string — JavaScript expression to define the output filename suffix (can be constant). The `__format` variable refers to the value of the `Data format` field (`json` or `raw`). The `__compression` field refers to the kind of compression being used (`none` or `gzip`). - `maxFileSizeMB` number — Maximum uncompressed output file size. Files of this size will be closed and moved to final output location. - `maxFileOpenTimeSec` number — Maximum amount of time to write to a file. Files open for longer than this will be closed and moved to final output location. - `maxFileIdleTimeSec` number — Maximum amount of time to keep inactive files open. Files open for longer than this will be closed and moved to final output location. - `maxOpenFiles` number — Maximum number of files to keep open concurrently. When exceeded, @{product} will close the oldest open files and move them to the final output location. - `headerLine` string — If set, this line will be written to the beginning of each output file - `writeHighWaterMark` number — Buffer size used to write to a file - `onBackpressure` 'block' | 'drop' — How to handle events when all receivers are exerting backpressure - `deadletterEnabled` boolean — If a file fails to move to its final destination after the maximum number of retries, move it to a designated directory to prevent further errors - `onDiskFullBackpressure` 'block' | 'drop' — How to handle events when disk space is below the global 'Min free disk space' limit - `forceCloseOnShutdown` boolean — Force all staged files to close during an orderly Node shutdown. This triggers immediate upload of in-progress data — regardless of idle time, file age, or size thresholds — to minimize data loss. - `retrySettings` RetrySettingsType - `enabled` boolean — Apply exponential backoff with jitter when file uploads fail repeatedly. - `initialBackoffMs` number — Initial delay before first retry attempt. Valid range: 1s-5min (1000-300000ms). Values outside this range will be clamped to the nearest valid value. - `backoffMultiplier` number — Multiplier applied to backoff delay after each retry. Valid range: 1-10. Values outside this range will be clamped to the nearest valid value. - `maxBackoffMs` number — Maximum delay between retry attempts. Valid range: 1s-10min (1000-600000ms). Values outside this range will be clamped to the nearest valid value. - `jitterPercent` number — Random jitter percentage added to backoff delay to prevent thundering herd. Valid range: 0-100. Values outside this range will be clamped to the nearest valid value. - `orphans` OrphanFileRecoveryType — Orphan file recovery - `disabled` boolean — Periodically scan the staging directory for files not tracked by any Worker manifest to recover them - `periodMin` number — Minimum interval between reconciliation runs - `description` string — Optional description for this configuration. - `compress` 'none' | 'gzip' — Data compression format to apply to HTTP content before it is delivered - `compressionLevel` 'best_speed' | 'normal' | 'best_compression' — Compression level to apply before moving files to final destination - `automaticSchema` boolean — Automatically calculate the schema based on the events of each Parquet file generated - `parquetSchema` string — To add a new schema, navigate to Processing > Knowledge > Parquet Schemas - `parquetVersion` 'PARQUET_1_0' | 'PARQUET_2_4' | 'PARQUET_2_6' — Determines which data types are supported and how they are represented - `parquetDataPageVersion` 'DATA_PAGE_V1' | 'DATA_PAGE_V2' — Serialization format of data pages. Note that some reader implementations use Data page V2's attributes to work more efficiently, while others ignore it. - `parquetRowGroupLength` number — The number of rows that every group will contain. The final group can contain a smaller number of rows. - `parquetPageSize` string — Target memory size for page segments, such as 1MB or 128MB. Generally, lower values improve reading speed, while higher values improve compression. - `shouldLogInvalidRows` boolean — Log up to 3 rows that @{product} skips due to data mismatch - `keyValueMetadata` KeyValueMetadataConfOutputFilesystem[] — The metadata of files the Destination writes will include the properties you add here as key-value pairs. Useful for tagging. Examples: "key":"OCSF Event Class", "value":"9001" - `key` string, required — Key - `value` string, required — Value - `enableStatistics` boolean — Statistics profile an entire file in terms of minimum/maximum values within data, numbers of nulls, etc. You can use Parquet tools to view statistics. - `enableWritePageIndex` boolean — One page index contains statistics for one data page. Parquet readers use statistics to enable page skipping. - `enablePageChecksum` boolean — Parquet tools can use the checksum of a Parquet page to verify data integrity - `emptyDirCleanupSec` number — How frequently, in seconds, to clean up empty directories - `directoryBatchSize` number — Number of directories to process in each batch during cleanup of empty directories. Minimum is 10, maximum is 10000. Higher values may require more memory. - `deadletterPath` string — Storage location for files that fail to reach their final destination after maximum retries are exceeded - `maxRetryNum` number — The maximum number of times a file will attempt to move to its final destination before being dead-lettered - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_partitionExpr` string — Binds 'partitionExpr' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'partitionExpr' at runtime. - `__template_format` string — Binds 'format' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'format' at runtime. - `__template_baseFileName` string — Binds 'baseFileName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'baseFileName' at runtime. - `__template_fileNameSuffix` string — Binds 'fileNameSuffix' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'fileNameSuffix' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_compress` string — Binds 'compress' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'compress' at runtime. - `__template_parquetSchema` string — Binds 'parquetSchema' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'parquetSchema' at runtime. - `notifications` Notification[] — Notifications attached to the Destination. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Destination configuration with optional Notifications and runtime status. - `id` string — Unique ID for this output - `type` 's3', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `endpoint` string — S3 service endpoint. If empty, defaults to the AWS Region-specific endpoint. Otherwise, it must point to S3-compatible endpoint. - `enableAssumeRole` boolean — Use Assume Role credentials to access S3 - `assumeRoleArn` string — Amazon Resource Name (ARN) of the role to assume - `assumeRoleExternalId` string — External ID to use when assuming role - `durationSeconds` number — Duration of the assumed role's session, in seconds. Minimum is 900 (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12 hours). - `awsAuthenticationMethod` 'auto' | 'manual' | 'secret' — AWS authentication method. Choose Auto to use IAM roles. - `reuseConnections` boolean — Reuse connections between requests, which can improve performance - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA, such as self-signed certificates - `bucket` string, required — Name of the destination S3 bucket. Must be a JavaScript expression (which can evaluate to a constant value), enclosed in quotes or backticks. Can be evaluated only at initialization time. Example referencing a Global Variable: `myBucket-${C.vars.myVar}` - `region` string — Region where the S3 bucket is located - `destPath` string — Prefix to prepend to files before uploading. Must be a JavaScript expression (which can evaluate to a constant value), enclosed in quotes or backticks. Can be evaluated only at init time. Example referencing a Global Variable: `myKeyPrefix-${C.vars.myVar}` - `maxConcurrentFileParts` number — Maximum number of parts to upload in parallel per file. Minimum part size is 5MB. - `verifyPermissions` boolean — Disable if you can access files within the bucket but not the bucket itself - `maxClosingFilesToBackpressure` number — Maximum number of files that can be waiting for upload before backpressure is applied - `stagePath` string, required — Filesystem location in which to buffer files, before compressing and moving to final destination. Use performant and stable storage. - `addIdToStagePath` boolean — Add the Output ID value to staging location - `removeEmptyDirs` boolean — Remove empty staging directories after moving files - `partitionExpr` string — JavaScript expression defining how files are partitioned and organized. Default is date-based. If blank, Stream will fall back to the event's __partition field value – if present – otherwise to each location's root directory. - `format` 'json' | 'raw' | 'parquet' — Format of the output data - `baseFileName` string — JavaScript expression to define the output filename prefix (can be constant) - `fileNameSuffix` string — JavaScript expression to define the output filename suffix (can be constant). The `__format` variable refers to the value of the `Data format` field (`json` or `raw`). The `__compression` field refers to the kind of compression being used (`none` or `gzip`). - `maxFileSizeMB` number — Maximum uncompressed output file size. Files of this size will be closed and moved to final output location. - `maxFileOpenTimeSec` number — Maximum amount of time to write to a file. Files open for longer than this will be closed and moved to final output location. - `maxFileIdleTimeSec` number — Maximum amount of time to keep inactive files open. Files open for longer than this will be closed and moved to final output location. - `maxOpenFiles` number — Maximum number of files to keep open concurrently. When exceeded, @{product} will close the oldest open files and move them to the final output location. - `headerLine` string — If set, this line will be written to the beginning of each output file - `writeHighWaterMark` number — Buffer size used to write to a file - `onBackpressure` 'block' | 'drop' — How to handle events when all receivers are exerting backpressure - `deadletterEnabled` boolean — If a file fails to move to its final destination after the maximum number of retries, move it to a designated directory to prevent further errors - `onDiskFullBackpressure` 'block' | 'drop' — How to handle events when disk space is below the global 'Min free disk space' limit - `forceCloseOnShutdown` boolean — Force all staged files to close during an orderly Node shutdown. This triggers immediate upload of in-progress data — regardless of idle time, file age, or size thresholds — to minimize data loss. - `retrySettings` RetrySettingsType - `enabled` boolean — Apply exponential backoff with jitter when file uploads fail repeatedly. - `initialBackoffMs` number — Initial delay before first retry attempt. Valid range: 1s-5min (1000-300000ms). Values outside this range will be clamped to the nearest valid value. - `backoffMultiplier` number — Multiplier applied to backoff delay after each retry. Valid range: 1-10. Values outside this range will be clamped to the nearest valid value. - `maxBackoffMs` number — Maximum delay between retry attempts. Valid range: 1s-10min (1000-600000ms). Values outside this range will be clamped to the nearest valid value. - `jitterPercent` number — Random jitter percentage added to backoff delay to prevent thundering herd. Valid range: 0-100. Values outside this range will be clamped to the nearest valid value. - `orphans` OrphanFileRecoveryType — Orphan file recovery - `disabled` boolean — Periodically scan the staging directory for files not tracked by any Worker manifest to recover them - `periodMin` number — Minimum interval between reconciliation runs - `awsSecretKey` string — Secret key. This value can be a constant or a JavaScript expression. Example: `${C.env.SOME_SECRET}`) - `objectACL` 'private' | 'public-read' | 'public-read-write' | 'authenticated-read' | 'aws-exec-read' | 'bucket-owner-read' | 'bucket-owner-full-control' — Object ACL to assign to uploaded objects - `storageClass` 'STANDARD' | 'REDUCED_REDUNDANCY' | 'STANDARD_IA' | 'ONEZONE_IA' | 'INTELLIGENT_TIERING' | 'GLACIER' | 'GLACIER_IR' | 'DEEP_ARCHIVE' — Storage class to select for uploaded objects - `serverSideEncryption` 'AES256' | 'aws:kms' — Server-side encryption to use for uploaded objects - `kmsKeyId` string — ID or ARN of the KMS customer-managed key to use for encryption - `description` string — Optional description for this configuration. - `awsApiKey` string — This value can be a constant or a JavaScript expression (`${C.env.SOME_ACCESS_KEY}`) - `awsSecret` string — Select or create a stored secret that references your access key and secret key - `compress` 'none' | 'gzip' — Data compression format to apply to HTTP content before it is delivered - `compressionLevel` 'best_speed' | 'normal' | 'best_compression' — Compression level to apply before moving files to final destination - `automaticSchema` boolean — Automatically calculate the schema based on the events of each Parquet file generated - `parquetSchema` string — To add a new schema, navigate to Processing > Knowledge > Parquet Schemas - `parquetVersion` 'PARQUET_1_0' | 'PARQUET_2_4' | 'PARQUET_2_6' — Determines which data types are supported and how they are represented - `parquetDataPageVersion` 'DATA_PAGE_V1' | 'DATA_PAGE_V2' — Serialization format of data pages. Note that some reader implementations use Data page V2's attributes to work more efficiently, while others ignore it. - `parquetRowGroupLength` number — The number of rows that every group will contain. The final group can contain a smaller number of rows. - `parquetPageSize` string — Target memory size for page segments, such as 1MB or 128MB. Generally, lower values improve reading speed, while higher values improve compression. - `shouldLogInvalidRows` boolean — Log up to 3 rows that @{product} skips due to data mismatch - `keyValueMetadata` KeyValueMetadataConfOutputFilesystem[] — The metadata of files the Destination writes will include the properties you add here as key-value pairs. Useful for tagging. Examples: "key":"OCSF Event Class", "value":"9001" - `key` string, required — Key - `value` string, required — Value - `enableStatistics` boolean — Statistics profile an entire file in terms of minimum/maximum values within data, numbers of nulls, etc. You can use Parquet tools to view statistics. - `enableWritePageIndex` boolean — One page index contains statistics for one data page. Parquet readers use statistics to enable page skipping. - `enablePageChecksum` boolean — Parquet tools can use the checksum of a Parquet page to verify data integrity - `emptyDirCleanupSec` number — How frequently, in seconds, to clean up empty directories - `directoryBatchSize` number — Number of directories to process in each batch during cleanup of empty directories. Minimum is 10, maximum is 10000. Higher values may require more memory. - `deadletterPath` string — Storage location for files that fail to reach their final destination after maximum retries are exceeded - `maxRetryNum` number — The maximum number of times a file will attempt to move to its final destination before being dead-lettered - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_endpoint` string — Binds 'endpoint' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'endpoint' at runtime. - `__template_assumeRoleArn` string — Binds 'assumeRoleArn' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'assumeRoleArn' at runtime. - `__template_assumeRoleExternalId` string — Binds 'assumeRoleExternalId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'assumeRoleExternalId' at runtime. - `__template_bucket` string — Binds 'bucket' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'bucket' at runtime. - `__template_region` string — Binds 'region' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'region' at runtime. - `__template_destPath` string — Binds 'destPath' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'destPath' at runtime. - `__template_partitionExpr` string — Binds 'partitionExpr' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'partitionExpr' at runtime. - `__template_format` string — Binds 'format' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'format' at runtime. - `__template_baseFileName` string — Binds 'baseFileName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'baseFileName' at runtime. - `__template_fileNameSuffix` string — Binds 'fileNameSuffix' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'fileNameSuffix' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_awsSecretKey` string — Binds 'awsSecretKey' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'awsSecretKey' at runtime. - `__template_objectACL` string — Binds 'objectACL' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'objectACL' at runtime. - `__template_storageClass` string — Binds 'storageClass' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'storageClass' at runtime. - `__template_serverSideEncryption` string — Binds 'serverSideEncryption' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'serverSideEncryption' at runtime. - `__template_kmsKeyId` string — Binds 'kmsKeyId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'kmsKeyId' at runtime. - `__template_awsApiKey` string — Binds 'awsApiKey' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'awsApiKey' at runtime. - `__template_compress` string — Binds 'compress' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'compress' at runtime. - `__template_parquetSchema` string — Binds 'parquetSchema' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'parquetSchema' at runtime. - `notifications` Notification[] — Notifications attached to the Destination. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Destination configuration with optional Notifications and runtime status. - `id` string — Unique ID for this output - `type` 'azure_blob', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `containerName` string, required — The Azure Blob Storage container name. Name can include only lowercase letters, numbers, and hyphens. For dynamic container names, enter a JavaScript expression within quotes or backticks, to be evaluated at initialization. The expression can evaluate to a constant value and can reference Global Variables, such as `myContainer-${C.env["CRIBL_WORKER_ID"]}`. - `createContainer` boolean — Create the configured container in Azure Blob Storage if it does not already exist - `destPath` string — Root directory prepended to path before uploading. Value can be a JavaScript expression enclosed in quotes or backticks, to be evaluated at initialization. The expression can evaluate to a constant value and can reference Global Variables, such as `myBlobPrefix-${C.env["CRIBL_WORKER_ID"]}`. - `stagePath` string, required — Filesystem location in which to buffer files before compressing and moving to final destination. Use performant and stable storage. - `addIdToStagePath` boolean — Add the Output ID value to staging location - `maxConcurrentFileParts` number — Maximum number of parts to upload in parallel per file - `removeEmptyDirs` boolean — Remove empty staging directories after moving files - `partitionExpr` string — JavaScript expression defining how files are partitioned and organized. Default is date-based. If blank, Stream will fall back to the event's __partition field value – if present – otherwise to each location's root directory. - `format` 'json' | 'raw' | 'parquet' — Format of the output data - `baseFileName` string — JavaScript expression to define the output filename prefix (can be constant) - `fileNameSuffix` string — JavaScript expression to define the output filename suffix (can be constant). The `__format` variable refers to the value of the `Data format` field (`json` or `raw`). The `__compression` field refers to the kind of compression being used (`none` or `gzip`). - `maxFileSizeMB` number — Maximum uncompressed output file size. Files of this size will be closed and moved to final output location. - `maxFileOpenTimeSec` number — Maximum amount of time to write to a file. Files open for longer than this will be closed and moved to final output location. - `maxFileIdleTimeSec` number — Maximum amount of time to keep inactive files open. Files open for longer than this will be closed and moved to final output location. - `maxOpenFiles` number — Maximum number of files to keep open concurrently. When exceeded, @{product} will close the oldest open files and move them to the final output location. - `headerLine` string — If set, this line will be written to the beginning of each output file - `writeHighWaterMark` number — Buffer size used to write to a file - `onBackpressure` 'block' | 'drop' — How to handle events when all receivers are exerting backpressure - `deadletterEnabled` boolean — If a file fails to move to its final destination after the maximum number of retries, move it to a designated directory to prevent further errors - `onDiskFullBackpressure` 'block' | 'drop' — How to handle events when disk space is below the global 'Min free disk space' limit - `forceCloseOnShutdown` boolean — Force all staged files to close during an orderly Node shutdown. This triggers immediate upload of in-progress data — regardless of idle time, file age, or size thresholds — to minimize data loss. - `retrySettings` RetrySettingsType - `enabled` boolean — Apply exponential backoff with jitter when file uploads fail repeatedly. - `initialBackoffMs` number — Initial delay before first retry attempt. Valid range: 1s-5min (1000-300000ms). Values outside this range will be clamped to the nearest valid value. - `backoffMultiplier` number — Multiplier applied to backoff delay after each retry. Valid range: 1-10. Values outside this range will be clamped to the nearest valid value. - `maxBackoffMs` number — Maximum delay between retry attempts. Valid range: 1s-10min (1000-600000ms). Values outside this range will be clamped to the nearest valid value. - `jitterPercent` number — Random jitter percentage added to backoff delay to prevent thundering herd. Valid range: 0-100. Values outside this range will be clamped to the nearest valid value. - `orphans` OrphanFileRecoveryType — Orphan file recovery - `disabled` boolean — Periodically scan the staging directory for files not tracked by any Worker manifest to recover them - `periodMin` number — Minimum interval between reconciliation runs - `authType` 'manual' | 'secret' | 'clientSecret' | 'clientCert' | 'clientAssertion' | 'clientAssertion_rpc' — Authentication method - `storageClass` 'Inferred' | 'Hot' | 'Cool' | 'Cold' | 'Archive' — Blob access tier - `description` string — Optional description for this configuration. - `compress` 'none' | 'gzip' — Data compression format to apply to HTTP content before it is delivered - `compressionLevel` 'best_speed' | 'normal' | 'best_compression' — Compression level to apply before moving files to final destination - `automaticSchema` boolean — Automatically calculate the schema based on the events of each Parquet file generated - `parquetSchema` string — To add a new schema, navigate to Processing > Knowledge > Parquet Schemas - `parquetVersion` 'PARQUET_1_0' | 'PARQUET_2_4' | 'PARQUET_2_6' — Determines which data types are supported and how they are represented - `parquetDataPageVersion` 'DATA_PAGE_V1' | 'DATA_PAGE_V2' — Serialization format of data pages. Note that some reader implementations use Data page V2's attributes to work more efficiently, while others ignore it. - `parquetRowGroupLength` number — The number of rows that every group will contain. The final group can contain a smaller number of rows. - `parquetPageSize` string — Target memory size for page segments, such as 1MB or 128MB. Generally, lower values improve reading speed, while higher values improve compression. - `shouldLogInvalidRows` boolean — Log up to 3 rows that @{product} skips due to data mismatch - `keyValueMetadata` KeyValueMetadataConfOutputFilesystem[] — The metadata of files the Destination writes will include the properties you add here as key-value pairs. Useful for tagging. Examples: "key":"OCSF Event Class", "value":"9001" - `key` string, required — Key - `value` string, required — Value - `enableStatistics` boolean — Statistics profile an entire file in terms of minimum/maximum values within data, numbers of nulls, etc. You can use Parquet tools to view statistics. - `enableWritePageIndex` boolean — One page index contains statistics for one data page. Parquet readers use statistics to enable page skipping. - `enablePageChecksum` boolean — Parquet tools can use the checksum of a Parquet page to verify data integrity - `emptyDirCleanupSec` number — How frequently, in seconds, to clean up empty directories - `directoryBatchSize` number — Number of directories to process in each batch during cleanup of empty directories. Minimum is 10, maximum is 10000. Higher values may require more memory. - `deadletterPath` string — Storage location for files that fail to reach their final destination after maximum retries are exceeded - `maxRetryNum` number — The maximum number of times a file will attempt to move to its final destination before being dead-lettered - `connectionString` string — Enter your Azure Storage account connection string. If left blank, Stream will fall back to env.AZURE_STORAGE_CONNECTION_STRING. - `textSecret` string — Select or create a stored text secret - `storageAccountName` string — The name of your Azure storage account - `tenantId` string — The service principal's tenant ID - `clientId` string — The service principal's client ID - `azureCloud` string — The Azure cloud to use. Defaults to Azure Public Cloud. - `endpointSuffix` string — Endpoint suffix for the service URL. Takes precedence over the Azure Cloud setting. Defaults to core.windows.net. - `clientTextSecret` string — Select or create a stored text secret - `certificate` CertificateType - `certificateName` string, required — The certificate you registered as credentials for your app in the Azure portal - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_containerName` string — Binds 'containerName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'containerName' at runtime. - `__template_destPath` string — Binds 'destPath' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'destPath' at runtime. - `__template_partitionExpr` string — Binds 'partitionExpr' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'partitionExpr' at runtime. - `__template_format` string — Binds 'format' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'format' at runtime. - `__template_baseFileName` string — Binds 'baseFileName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'baseFileName' at runtime. - `__template_fileNameSuffix` string — Binds 'fileNameSuffix' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'fileNameSuffix' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_compress` string — Binds 'compress' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'compress' at runtime. - `__template_parquetSchema` string — Binds 'parquetSchema' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'parquetSchema' at runtime. - `__template_connectionString` string — Binds 'connectionString' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'connectionString' at runtime. - `__template_storageAccountName` string — Binds 'storageAccountName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'storageAccountName' at runtime. - `__template_tenantId` string — Binds 'tenantId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tenantId' at runtime. - `__template_clientId` string — Binds 'clientId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientId' at runtime. - `__template_azureCloud` string — Binds 'azureCloud' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'azureCloud' at runtime. - `notifications` Notification[] — Notifications attached to the Destination. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Destination configuration with optional Notifications and runtime status. - `id` string — Unique ID for this output - `type` 'azure_data_explorer', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `clusterUrl` string, required — The base URI for your cluster. Typically, `https://..kusto.windows.net`. - `database` string, required — Name of the database containing the table where data will be ingested - `table` string, required — Name of the table to ingest data into - `validateDatabaseSettings` boolean — When saving or starting the Destination, validate the database name and credentials; also validate table name, except when creating a new table. Disable if your Azure app does not have both the Database Viewer and the Table Viewer role. - `ingestMode` 'batching' | 'streaming' — Ingestion mode - `oauthEndpoint` 'https://login.microsoftonline.com' | 'https://login.microsoftonline.us' | 'https://login.partner.microsoftonline.cn', required — Endpoint used to acquire authentication tokens from Azure - `tenantId` string, required — Directory ID (tenant identifier) in Azure Active Directory - `clientId` string, required — client_id to pass in the OAuth request parameter - `scope` string, required — Scope to pass in the OAuth request parameter - `oauthType` 'clientSecret' | 'clientTextSecret' | 'certificate', required — The type of OAuth 2.0 client credentials grant flow to use - `description` string — Optional description for this configuration. - `clientSecret` string — The client secret that you generated for your app in the Azure portal - `textSecret` string — Select or create a stored text secret - `certificate` object - `certificateName` string — The certificate you registered as credentials for your app in the Azure portal - `format` 'json' | 'raw' | 'parquet' — Format of the output data - `compress` 'none' | 'gzip', required — Data compression format to apply to HTTP content before it is delivered - `compressionLevel` 'best_speed' | 'normal' | 'best_compression' — Compression level to apply before moving files to final destination - `automaticSchema` boolean — Automatically calculate the schema based on the events of each Parquet file generated - `parquetSchema` string — To add a new schema, navigate to Processing > Knowledge > Parquet Schemas - `parquetVersion` 'PARQUET_1_0' | 'PARQUET_2_4' | 'PARQUET_2_6' — Determines which data types are supported and how they are represented - `parquetDataPageVersion` 'DATA_PAGE_V1' | 'DATA_PAGE_V2' — Serialization format of data pages. Note that some reader implementations use Data page V2's attributes to work more efficiently, while others ignore it. - `parquetRowGroupLength` number — The number of rows that every group will contain. The final group can contain a smaller number of rows. - `parquetPageSize` string — Target memory size for page segments, such as 1MB or 128MB. Generally, lower values improve reading speed, while higher values improve compression. - `shouldLogInvalidRows` boolean — Log up to 3 rows that @{product} skips due to data mismatch - `keyValueMetadata` KeyValueMetadataConfOutputFilesystem[] — The metadata of files the Destination writes will include the properties you add here as key-value pairs. Useful for tagging. Examples: "key":"OCSF Event Class", "value":"9001" - `key` string, required — Key - `value` string, required — Value - `enableStatistics` boolean — Statistics profile an entire file in terms of minimum/maximum values within data, numbers of nulls, etc. You can use Parquet tools to view statistics. - `enableWritePageIndex` boolean — One page index contains statistics for one data page. Parquet readers use statistics to enable page skipping. - `enablePageChecksum` boolean — Parquet tools can use the checksum of a Parquet page to verify data integrity - `removeEmptyDirs` boolean — Remove empty staging directories after moving files - `emptyDirCleanupSec` number — How frequently, in seconds, to clean up empty directories - `directoryBatchSize` number — Number of directories to process in each batch during cleanup of empty directories. Minimum is 10, maximum is 10000. Higher values may require more memory. - `deadletterEnabled` boolean — If a file fails to move to its final destination after the maximum number of retries, move it to a designated directory to prevent further errors - `deadletterPath` string — Storage location for files that fail to reach their final destination after maximum retries are exceeded - `maxRetryNum` number — The maximum number of times a file will attempt to move to its final destination before being dead-lettered - `isMappingObj` boolean — Send a JSON mapping object instead of specifying an existing named data mapping - `mappingObj` string — Enter a JSON object that defines your desired data mapping - `mappingRef` string — Enter the name of a data mapping associated with your target table. Or, if incoming event and target table fields match exactly, you can leave the field empty. - `ingestUrl` string — The ingestion service URI for your cluster. Typically, `https://ingest-..kusto.windows.net`. - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `stagePath` string — Filesystem location in which to buffer files before compressing and moving to final destination. Use performant and stable storage. - `fileNameSuffix` string — JavaScript expression to define the output filename suffix (can be constant). The `__format` variable refers to the value of the `Data format` field (`json` or `raw`). The `__compression` field refers to the kind of compression being used (`none` or `gzip`). - `maxFileSizeMB` number — Maximum uncompressed output file size. Files of this size will be closed and moved to final output location. - `maxFileOpenTimeSec` number — Maximum amount of time to write to a file. Files open for longer than this will be closed and moved to final output location. - `maxFileIdleTimeSec` number — Maximum amount of time to keep inactive files open. Files open for longer than this will be closed and moved to final output location. - `maxOpenFiles` number — Maximum number of files to keep open concurrently. When exceeded, @{product} will close the oldest open files and move them to the final output location. - `maxConcurrentFileParts` number — Maximum number of parts to upload in parallel per file - `onDiskFullBackpressure` 'block' | 'drop' — How to handle events when disk space is below the global 'Min free disk space' limit - `addIdToStagePath` boolean — Add the Output ID value to staging location - `retrySettings` RetrySettingsType - `enabled` boolean — Apply exponential backoff with jitter when file uploads fail repeatedly. - `initialBackoffMs` number — Initial delay before first retry attempt. Valid range: 1s-5min (1000-300000ms). Values outside this range will be clamped to the nearest valid value. - `backoffMultiplier` number — Multiplier applied to backoff delay after each retry. Valid range: 1-10. Values outside this range will be clamped to the nearest valid value. - `maxBackoffMs` number — Maximum delay between retry attempts. Valid range: 1s-10min (1000-600000ms). Values outside this range will be clamped to the nearest valid value. - `jitterPercent` number — Random jitter percentage added to backoff delay to prevent thundering herd. Valid range: 0-100. Values outside this range will be clamped to the nearest valid value. - `orphans` OrphanFileRecoveryType — Orphan file recovery - `disabled` boolean — Periodically scan the staging directory for files not tracked by any Worker manifest to recover them - `periodMin` number — Minimum interval between reconciliation runs - `timeoutSec` number — Amount of time, in seconds, to wait for a request to complete before canceling it - `flushImmediately` boolean — Bypass the data management service's aggregation mechanism - `retainBlobOnSuccess` boolean — Prevent blob deletion after ingestion is complete - `extentTags` object[] — Strings or tags associated with the extent (ingested data shard) - `prefix` 'dropBy' | 'ingestBy' — Prefix (optional) - `value` string, required — Value - `ingestIfNotExists` object[] — Prevents duplicate ingestion by verifying whether an extent with the specified ingest-by tag already exists - `value` string, required — Value - `reportLevel` 'failuresOnly' | 'doNotReport' | 'failuresAndSuccesses' — Level of ingestion status reporting. Defaults to FailuresOnly. - `reportMethod` 'queue' | 'table' | 'queueAndTable' — Target of the ingestion status reporting. Defaults to Queue. - `additionalProperties` object[] — Optionally, enter additional configuration properties to send to the ingestion service - `key` string, required — Key - `value` string, required — Value - `responseRetrySettings` ResponseRetrySettingConfOutputWebhook[] — Automatically retry after unsuccessful response status codes, such as 429 (Too Many Requests) or 503 (Service Unavailable) - `httpStatus` number, required — The HTTP response status code that will trigger retries - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `timeoutRetrySettings` TimeoutRetrySettingsType - `timeoutRetry` boolean, required — Retry timed-out HTTP requests - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `responseHonorRetryAfterHeader` boolean — Honor any Retry-After header that specifies a delay (in seconds) no longer than 180 seconds after the retry request. @{product} limits the delay to 180 seconds, even if the Retry-After header specifies a longer delay. When enabled, takes precedence over user-configured retry options. When disabled, all Retry-After headers are ignored. - `concurrency` number — Maximum number of ongoing requests before blocking - `maxPayloadSizeKB` number — Maximum size, in KB, of the request body - `maxPayloadEvents` number — Maximum number of events to include in the request body. Default is 0 (unlimited). - `maxConnectionReuseSec` number — How long, in seconds, to reuse a keep-alive connection after its first use before forcing it closed. Set to 0 to disable the time-based close and reuse connections for as long as the destination server permits. - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Body size limit. - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's). Enabled by default. When this setting is also present in TLS Settings (Client Side), that value will take precedence. - `useRoundRobinDns` boolean — Enable round-robin DNS lookup. When a DNS server returns multiple addresses, @{product} will cycle through them in the order returned. For optimal performance, consider enabling this setting for non-load balanced destinations. - `keepAlive` boolean — Disable to close the connection immediately after sending the outgoing request - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_clusterUrl` string — Binds 'clusterUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clusterUrl' at runtime. - `__template_database` string — Binds 'database' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'database' at runtime. - `__template_table` string — Binds 'table' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'table' at runtime. - `__template_oauthEndpoint` string — Binds 'oauthEndpoint' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'oauthEndpoint' at runtime. - `__template_tenantId` string — Binds 'tenantId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tenantId' at runtime. - `__template_clientId` string — Binds 'clientId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientId' at runtime. - `__template_scope` string — Binds 'scope' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'scope' at runtime. - `__template_clientSecret` string — Binds 'clientSecret' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientSecret' at runtime. - `__template_format` string — Binds 'format' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'format' at runtime. - `__template_compress` string — Binds 'compress' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'compress' at runtime. - `__template_parquetSchema` string — Binds 'parquetSchema' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'parquetSchema' at runtime. - `__template_mappingRef` string — Binds 'mappingRef' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'mappingRef' at runtime. - `__template_ingestUrl` string — Binds 'ingestUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'ingestUrl' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_fileNameSuffix` string — Binds 'fileNameSuffix' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'fileNameSuffix' at runtime. - `notifications` Notification[] — Notifications attached to the Destination. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Destination configuration with optional Notifications and runtime status. - `id` string — Unique ID for this output - `type` 'azure_logs', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `logType` string, required — The Log Type of events sent to this LogAnalytics workspace. Defaults to `Cribl`. Use only letters, numbers, and `_` characters, and can't exceed 100 characters. Can be overwritten by event field __logType. - `resourceId` string — Optional Resource ID of the Azure resource to associate the data with. Can be overridden by the __resourceId event field. This ID populates the _ResourceId property, allowing the data to be included in resource-centric queries. If the ID is neither specified nor overridden, resource-centric queries will omit the data. - `concurrency` number — Maximum number of ongoing requests before blocking - `maxPayloadSizeKB` number — Maximum size, in KB, of the request body - `maxPayloadEvents` number — Maximum number of events to include in the request body. Default is 0 (unlimited). - `compress` boolean - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's). Enabled by default. When this setting is also present in TLS Settings (Client Side), that value will take precedence. - `timeoutSec` number — Amount of time, in seconds, to wait for a request to complete before canceling it - `maxConnectionReuseSec` number — How long, in seconds, to reuse a keep-alive connection after its first use before forcing it closed. Set to 0 to disable the time-based close and reuse connections for as long as the destination server permits. - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Body size limit. - `extraHttpHeaders` ExtraHttpHeaderConfInputElastic[] — Headers to add to all events - `name` string — Field Name - `value` string, required — Field Value - `useRoundRobinDns` boolean — Enable round-robin DNS lookup. When a DNS server returns multiple addresses, @{product} will cycle through them in the order returned. For optimal performance, consider enabling this setting for non-load balanced destinations. - `failedRequestLoggingMode` 'payload' | 'payloadAndHeaders' | 'none' — Data to log when a request fails. All headers are redacted by default, unless listed as safe headers below. - `safeHeaders` string[] — List of headers that are safe to log in plain text - `apiUrl` string — The DNS name of the Log API endpoint that sends log data to a Log Analytics workspace in Azure Monitor. Defaults to .ods.opinsights.azure.com. @{product} will add a prefix and suffix to construct a URI in this format: /api/logs?api-version=. - `responseRetrySettings` ResponseRetrySettingConfOutputWebhook[] — Automatically retry after unsuccessful response status codes, such as 429 (Too Many Requests) or 503 (Service Unavailable) - `httpStatus` number, required — The HTTP response status code that will trigger retries - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `timeoutRetrySettings` TimeoutRetrySettingsType - `timeoutRetry` boolean, required — Retry timed-out HTTP requests - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `responseHonorRetryAfterHeader` boolean — Honor any Retry-After header that specifies a delay (in seconds) no longer than 180 seconds after the retry request. @{product} limits the delay to 180 seconds, even if the Retry-After header specifies a longer delay. When enabled, takes precedence over user-configured retry options. When disabled, all Retry-After headers are ignored. - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `authType` 'manual' | 'secret' — Enter workspace ID and workspace key directly, or select a stored secret - `description` string — Optional description for this configuration. - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `workspaceId` string — Azure Log Analytics Workspace ID. See Azure Dashboard Workspace > Advanced settings. - `workspaceKey` string — Azure Log Analytics Workspace Primary or Secondary Shared Key. See Azure Dashboard Workspace > Advanced settings. - `keypairSecret` string — Select or create a stored secret that references your access key and secret key - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_failedRequestLoggingMode` string — Binds 'failedRequestLoggingMode' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'failedRequestLoggingMode' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_workspaceId` string — Binds 'workspaceId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'workspaceId' at runtime. - `__template_workspaceKey` string — Binds 'workspaceKey' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'workspaceKey' at runtime. - `notifications` Notification[] — Notifications attached to the Destination. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Destination configuration with optional Notifications and runtime status. - `id` string — Unique ID for this output - `type` 'kinesis', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `streamName` string, required — Kinesis stream name to send events to. - `awsAuthenticationMethod` 'auto' | 'manual' | 'secret' — AWS authentication method. Choose Auto to use IAM roles. - `awsSecretKey` string — Secret key - `region` string, required — Region where the Kinesis stream is located - `endpoint` string — Kinesis stream service endpoint. If empty, defaults to the AWS Region-specific endpoint. Otherwise, it must point to Kinesis stream-compatible endpoint. - `reuseConnections` boolean — Reuse connections between requests, which can improve performance - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA, such as self-signed certificates - `enableAssumeRole` boolean — Use Assume Role credentials to access Kinesis stream - `assumeRoleArn` string — Amazon Resource Name (ARN) of the role to assume - `assumeRoleExternalId` string — External ID to use when assuming role - `durationSeconds` number — Duration of the assumed role's session, in seconds. Minimum is 900 (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12 hours). - `concurrency` number — Maximum number of ongoing put requests before blocking. - `maxRecordSizeKB` number — Maximum size (KB) of each individual record before compression. For uncompressed or non-compressible data 1MB is the max recommended size - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Max record size. - `compression` 'none' | 'gzip' — Compression type to use for records - `useListShards` boolean — Provides higher stream rate limits, improving delivery speed and reliability by minimizing throttling. See the [ListShards API](https://docs.aws.amazon.com/kinesis/latest/APIReference/API_ListShards.html) documentation for details. - `asNdjson` boolean — Batch events into a single record as NDJSON - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `description` string — Optional description for this configuration. - `awsApiKey` string — Access key - `awsSecret` string — Select or create a stored secret that references your access key and secret key - `maxEventsPerFlush` number — Maximum number of records to send in a single request - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_streamName` string — Binds 'streamName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamName' at runtime. - `__template_awsSecretKey` string — Binds 'awsSecretKey' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'awsSecretKey' at runtime. - `__template_region` string — Binds 'region' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'region' at runtime. - `__template_endpoint` string — Binds 'endpoint' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'endpoint' at runtime. - `__template_assumeRoleArn` string — Binds 'assumeRoleArn' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'assumeRoleArn' at runtime. - `__template_assumeRoleExternalId` string — Binds 'assumeRoleExternalId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'assumeRoleExternalId' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_awsApiKey` string — Binds 'awsApiKey' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'awsApiKey' at runtime. - `notifications` Notification[] — Notifications attached to the Destination. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Destination configuration with optional Notifications and runtime status. - `id` string — Unique ID for this output - `type` 'honeycomb', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `dataset` string, required — Name of the dataset to send events to – e.g., observability - `concurrency` number — Maximum number of ongoing requests before blocking - `maxPayloadSizeKB` number — Maximum size, in KB, of the request body - `maxPayloadEvents` number — Maximum number of events to include in the request body. Default is 0 (unlimited). - `compress` boolean — Compress the payload body before sending - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's). Enabled by default. When this setting is also present in TLS Settings (Client Side), that value will take precedence. - `timeoutSec` number — Amount of time, in seconds, to wait for a request to complete before canceling it - `maxConnectionReuseSec` number — How long, in seconds, to reuse a keep-alive connection after its first use before forcing it closed. Set to 0 to disable the time-based close and reuse connections for as long as the destination server permits. - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Body size limit. - `extraHttpHeaders` ExtraHttpHeaderConfInputElastic[] — Headers to add to all events - `name` string — Field Name - `value` string, required — Field Value - `useRoundRobinDns` boolean — Enable round-robin DNS lookup. When a DNS server returns multiple addresses, @{product} will cycle through them in the order returned. For optimal performance, consider enabling this setting for non-load balanced destinations. - `failedRequestLoggingMode` 'payload' | 'payloadAndHeaders' | 'none' — Data to log when a request fails. All headers are redacted by default, unless listed as safe headers below. - `safeHeaders` string[] — List of headers that are safe to log in plain text - `responseRetrySettings` ResponseRetrySettingConfOutputWebhook[] — Automatically retry after unsuccessful response status codes, such as 429 (Too Many Requests) or 503 (Service Unavailable) - `httpStatus` number, required — The HTTP response status code that will trigger retries - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `timeoutRetrySettings` TimeoutRetrySettingsType - `timeoutRetry` boolean, required — Retry timed-out HTTP requests - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `responseHonorRetryAfterHeader` boolean — Honor any Retry-After header that specifies a delay (in seconds) no longer than 180 seconds after the retry request. @{product} limits the delay to 180 seconds, even if the Retry-After header specifies a longer delay. When enabled, takes precedence over user-configured retry options. When disabled, all Retry-After headers are ignored. - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `authType` 'manual' | 'secret' — Enter API key directly, or select a stored secret - `description` string — Optional description for this configuration. - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `team` string — Team API key where the dataset belongs - `textSecret` string — Select or create a stored text secret - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_failedRequestLoggingMode` string — Binds 'failedRequestLoggingMode' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'failedRequestLoggingMode' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `notifications` Notification[] — Notifications attached to the Destination. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Destination configuration with optional Notifications and runtime status. - `id` string — Unique ID for this output - `type` 'azure_eventhub', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `brokers` string[], required — List of Event Hubs Kafka brokers to connect to, eg. yourdomain.servicebus.windows.net:9093. The hostname can be found in the host portion of the primary or secondary connection string in Shared Access Policies. - `topic` string, required — The name of the Event Hub (Kafka Topic) to publish events. Can be overwritten using field __topicOut. - `ack` 1 | 0 | -1 — Control the number of required acknowledgments - `format` 'json' | 'raw' — Format to use to serialize events before writing to the Event Hubs Kafka brokers - `maxRecordSizeKB` number — Maximum size of each record batch before compression. Setting should be < message.max.bytes settings in Event Hubs brokers. - `flushEventCount` number — Maximum number of events in a batch before forcing a flush - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Max record size. - `connectionTimeout` number — Maximum time to wait for a connection to complete successfully - `requestTimeout` number — Maximum time to wait for Kafka to respond to a request - `maxRetries` number — If messages are failing, you can set the maximum number of retries as high as 100 to prevent loss of data - `maxBackOff` number — The maximum wait time for a retry, in milliseconds. Default (and minimum) is 30,000 ms (30 seconds); maximum is 180,000 ms (180 seconds). - `initialBackoff` number — Initial value used to calculate the retry, in milliseconds. Maximum is 600,000 ms (10 minutes). - `backoffRate` number — Set the backoff multiplier (2-20) to control the retry frequency for failed messages. For faster retries, use a lower multiplier. For slower retries with more delay between attempts, use a higher multiplier. The multiplier is used in an exponential backoff formula; see the Kafka [documentation](https://kafka.js.org/docs/retry-detailed) for details. - `authenticationTimeout` number — Maximum time to wait for Kafka to respond to an authentication request - `reauthenticationThreshold` number — Specifies a time window during which @{product} can reauthenticate if needed. Creates the window measuring backward from the moment when credentials are set to expire. - `sasl` AuthenticationTypeUse — Authentication parameters to use when connecting to brokers. Using TLS is highly recommended. - `disabled` boolean, required — Disabled - `authType` 'manual' | 'secret' — Enter password directly, or select a stored secret - `password` string — Connection-string primary key, or connection-string secondary key, from the Event Hubs workspace - `textSecret` string — Select or create a stored text secret - `mechanism` 'plain' | 'oauthbearer' — SASL mechanism - `username` string — The username for authentication. For Event Hubs, this should always be $ConnectionString. - `clientSecretAuthType` 'manual' | 'secret' | 'certificate' — Authentication method - `clientSecret` string — client_secret to pass in the OAuth request parameter - `clientTextSecret` string — Select or create a stored text secret - `certificateName` string — Select or create a stored certificate - `certPath` string - `privKeyPath` string - `passphrase` string - `oauthEndpoint` 'https://login.microsoftonline.com' | 'https://login.microsoftonline.us' | 'https://login.partner.microsoftonline.cn' — Endpoint used to acquire authentication tokens from Azure - `clientId` string — client_id to pass in the OAuth request parameter - `tenantId` string — Directory ID (tenant identifier) in Azure Active Directory - `scope` string — Scope to pass in the OAuth request parameter - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime. - `__template_mechanism` string — Binds 'mechanism' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'mechanism' at runtime. - `__template_oauthEndpoint` string — Binds 'oauthEndpoint' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'oauthEndpoint' at runtime. - `__template_clientId` string — Binds 'clientId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientId' at runtime. - `__template_tenantId` string — Binds 'tenantId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tenantId' at runtime. - `__template_scope` string — Binds 'scope' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'scope' at runtime. - `tls` TlsSettingsClientSideType — TLS settings (client side) - `disabled` boolean, required — Disabled - `rejectUnauthorized` boolean — Reject certificates that are not authorized by a CA in the CA certificate path, or by another trusted CA (such as the system's) - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `description` string — Optional description for this configuration. - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_brokers` string — Binds 'brokers' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'brokers' at runtime. - `__template_topic` string — Binds 'topic' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'topic' at runtime. - `__template_format` string — Binds 'format' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'format' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `notifications` Notification[] — Notifications attached to the Destination. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Destination configuration with optional Notifications and runtime status. - `id` string — Unique ID for this output - `type` 'google_bigquery', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `projectId` string, required — Google Cloud project ID that contains the BigQuery dataset - `datasetId` string, required — BigQuery dataset ID - `tableId` string, required — BigQuery table ID - `timestampColumn` string — Column name to write event time (`_time`) as a BigQuery TIMESTAMP. Used for time partitioning - `googleAuthMethod` 'auto' | 'secret', required — Choose Auto to use Google Application Default Credentials (ADC), or Secret to select or create a stored secret that references Google service account credentials - `secret` string — Select or create a stored text secret - `flushPeriod` number — Maximum time to wait before sending a batch (when batch size limit is not reached) - `maxQueueSize` number — Maximum number of queued batches before blocking - `maxRecordSizeKB` number — Maximum size (KB) of a single append request. BigQuery limit is 10 MB - `maxInProgress` number — The maximum number of in-progress API requests before backpressure is applied - `maxSendRetries` number — Maximum retries per batch for retryable failures (transient, rate-limit, unknown) before dropping. 0 (default) retries indefinitely. - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `description` string — Optional description for this configuration. - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_projectId` string — Binds 'projectId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'projectId' at runtime. - `__template_datasetId` string — Binds 'datasetId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'datasetId' at runtime. - `__template_tableId` string — Binds 'tableId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tableId' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `notifications` Notification[] — Notifications attached to the Destination. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Destination configuration with optional Notifications and runtime status. - `id` string — Unique ID for this output - `type` 'google_chronicle', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `apiVersion` 'v1' | 'v2' — API version - `authenticationMethod` 'manual' | 'secret' | 'serviceAccount' | 'serviceAccountSecret' — Authentication method - `responseRetrySettings` ResponseRetrySettingConfOutputWebhook[] — Automatically retry after unsuccessful response status codes, such as 429 (Too Many Requests) or 503 (Service Unavailable) - `httpStatus` number, required — The HTTP response status code that will trigger retries - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `timeoutRetrySettings` TimeoutRetrySettingsType - `timeoutRetry` boolean, required — Retry timed-out HTTP requests - `initialBackoff` number — How long, in milliseconds, Cribl Stream should wait before initiating backoff. Maximum interval is 600,000 ms (10 minutes). - `backoffRate` number — Base for exponential backoff. A value of 2 (default) means Cribl Stream will retry after 2 seconds, then 4 seconds, then 8 seconds, etc. - `maxBackoff` number — The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds). - `responseHonorRetryAfterHeader` boolean — Honor any Retry-After header that specifies a delay (in seconds) no longer than 180 seconds after the retry request. @{product} limits the delay to 180 seconds, even if the Retry-After header specifies a longer delay. When enabled, takes precedence over user-configured retry options. When disabled, all Retry-After headers are ignored. - `logFormatType` 'unstructured' | 'udm', required — Send events as - `region` string — Regional endpoint to send events to - `concurrency` number — Maximum number of ongoing requests before blocking - `maxPayloadSizeKB` number — Maximum size, in KB, of the request body - `maxPayloadEvents` number — Maximum number of events to include in the request body. Default is 0 (unlimited). - `compress` boolean — Compress the payload body before sending - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's). Enabled by default. When this setting is also present in TLS Settings (Client Side), that value will take precedence. - `timeoutSec` number — Amount of time, in seconds, to wait for a request to complete before canceling it - `maxConnectionReuseSec` number — How long, in seconds, to reuse a keep-alive connection after its first use before forcing it closed. Set to 0 to disable the time-based close and reuse connections for as long as the destination server permits. - `flushPeriodSec` number — Maximum time between requests. Small values could cause the payload size to be smaller than the configured Body size limit. - `extraHttpHeaders` ExtraHttpHeaderConfInputElastic[] — Headers to add to all events - `name` string — Field Name - `value` string, required — Field Value - `failedRequestLoggingMode` 'payload' | 'payloadAndHeaders' | 'none' — Data to log when a request fails. All headers are redacted by default, unless listed as safe headers below. - `safeHeaders` string[] — List of headers that are safe to log in plain text - `useRoundRobinDns` boolean — Enable round-robin DNS lookup. When a DNS server returns multiple addresses, @{product} will cycle through them in the order returned. - `onBackpressure` 'block' | 'drop' | 'queue' — How to handle events when all receivers are exerting backpressure - `totalMemoryLimitKB` number — Maximum total size of the batches waiting to be sent. If left blank, defaults to 5 times the max body size (if set). If 0, no limit is enforced. - `description` string — Optional description for this configuration. - `extraLogTypes` object[] — Custom log types. If the value "Custom" is selected in the setting "Default log type" above, the first custom log type in this table will be automatically selected as default log type. - `logType` string, required — Log Type - `description` string — Description - `logType` string — Default log type value to send to SecOps. Can be overwritten by event field __logType. - `logTextField` string — Name of the event field that contains the log text to send. If not specified, Stream sends a JSON representation of the whole event. - `customerId` string — A unique identifier (UUID) for your Google SecOps instance. This is provided by your Google representative and is required for API V2 authentication. - `namespace` string — User-configured environment namespace to identify the data domain the logs originated from. Use namespace as a tag to identify the appropriate data domain for indexing and enrichment functionality. Can be overwritten by event field __namespace. - `customLabels` KeyValueMetadataConfOutputFilesystem[] — Custom labels to be added to every batch - `key` string, required — Key - `value` string, required — Value - `udmType` 'entities' | 'logs' — Defines the specific format for UDM events sent to Google SecOps. This must match the type of UDM data being sent. - `apiKey` string — Organization's API key in Google SecOps - `apiKeySecret` string — Select or create a stored text secret - `serviceAccountCredentials` string — Contents of service account credentials (JSON keys) file downloaded from Google Cloud. To upload a file, click the upload button at this field's upper right. - `serviceAccountCredentialsSecret` string — Select or create a stored text secret - `pqStrictOrdering` boolean — Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed. - `pqRatePerSec` number — Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling. - `pqMode` 'error' | 'always' | 'backpressure' — In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem. - `pqMaxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use pqMaxBufferSizeBytes instead. - `pqMaxBackpressureSec` number — How long (in seconds) to wait for backpressure to resolve before engaging the queue - `pqMaxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.) - `pqMaxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `pqPath` string — The location for the persistent queue files. To this field's value, the system will append: //. - `pqCompress` 'none' | 'gzip' — Codec to use to compress the persisted data - `pqOnBackpressure` 'block' | 'drop' — How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqMaxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `pqControls` object — Persistent queue controls. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_apiVersion` string — Binds 'apiVersion' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'apiVersion' at runtime. - `__template_region` string — Binds 'region' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'region' at runtime. - `__template_failedRequestLoggingMode` string — Binds 'failedRequestLoggingMode' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'failedRequestLoggingMode' at runtime. - `__template_onBackpressure` string — Binds 'onBackpressure' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'onBackpressure' at runtime. - `__template_customerId` string — Binds 'customerId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'customerId' at runtime. - `notifications` Notification[] — Notifications attached to the Destination. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Destination configuration with optional Notifications and runtime status. - `id` string — Unique ID for this output - `type` 'google_cloud_storage', required — Connector type identifier. - `pipeline` string — Pipeline to process data before sending out to this output - `systemFields` string[] — Fields to automatically add to events, such as cribl_pipe. Supports wildcards. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `streamtags` string[] — Metadata tags used for categorization and filtering. - `bucket` string, required — Name of the destination bucket. This value can be a constant or a JavaScript expression that can only be evaluated at init time. Example of referencing a Global Variable: `myBucket-${C.vars.myVar}`. - `region` string, required — Region where the bucket is located - `endpoint` string, required — Google Cloud Storage service endpoint - `awsAuthenticationMethod` 'auto' | 'manual' | 'secret' — Authentication method - `stagePath` string, required — Filesystem location in which to buffer files, before compressing and moving to final destination. Use performant and stable storage. - `destPath` string — Prefix to prepend to files before uploading. Must be a JavaScript expression (which can evaluate to a constant value), enclosed in quotes or backticks. Can be evaluated only at init time. Example referencing a Global Variable: `myKeyPrefix-${C.vars.myVar}` - `verifyPermissions` boolean — Disable if you can access files within the bucket but not the bucket itself - `objectACL` 'private' | 'bucket-owner-read' | 'bucket-owner-full-control' | 'project-private' | 'authenticated-read' | 'public-read' — Object ACL to assign to uploaded objects - `storageClass` 'STANDARD' | 'NEARLINE' | 'COLDLINE' | 'ARCHIVE' — Storage class to select for uploaded objects - `reuseConnections` boolean — Reuse connections between requests, which can improve performance - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA, such as self-signed certificates - `addIdToStagePath` boolean — Add the Output ID value to staging location - … truncated; see the full OpenAPI document linked below ## Other responses - `401` — Authentication failed (missing or invalid credentials or Bearer token). - `404` — The requested resource does not exist — Destination not found. - `500` — Unexpected server error. --- [API](https://skmtc.dev/criblio/apis/cribl-api-reference.md) · [All operations](https://skmtc.dev/criblio/apis/cribl-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/criblio/cribl-api-reference/revisions/56cb25079271/schema)