How can I see what data is going through the Default route?

Valeriu Sarghe

As we know, we have the default route where there goes any data that was not taken by previous routes.
Since that route has a filter true how can I find what data is going to that route? Capture is not helping of course because it has filtered true
Any other method except for negating all filters from previous routes?

Original Question: https://cribl-community.slack.com/archives/CPYBPK65V/p1688625589301539

Brendan Dalpe

A little trick here is to use the fact that we set a field called cribl_route on events processed. Any event that is processed by the default route won't have this field set.In your capture, set the filter to !cribl_route , then set the capture location to #4 - Before the Destination. This will show you all the events that used the default route.

et voilà!

Brendan Dalpe

A little trick here is to use the fact that we set a field called cribl_route on events processed. Any event that is processed by the default route won't have this field set.In your capture, set the filter to !cribl_route , then set the capture location to #4 - Before the Destination. This will show you all the events that used the default route.

et voilà!