We have updated our Terms of Service, Code of Conduct, and Addendum.

Proper URL for sending to Cribl via Webhook

If I want to send events to Cribl via Webhook, where do I find the proper URL to use to send those events to Cribl?

Answers

  • Check out the raw HTTP input configuration.

  • LovetheBeach
    LovetheBeach Posts: 54 ✭✭

    <@U012ZP93EER&gt; I don't see information in Raw HTTP/s that tells me where to find/devise the proper URL that a 3rd party can send logs to Cribl.

  • You define it yourself in the `Allowed URL paths` field under the Advanced Settings section of the input config.

  • By default it's set to `*` which means it takes whatever path they want to specify or none at all, which means the minimum would be the IP and port required to basic connectivity.

  • LovetheBeach
    LovetheBeach Posts: 54 ✭✭

    I'm sorry for being dense, but it does not provide something like: https://hostname.domain.com:port#/path

  • LovetheBeach
    LovetheBeach Posts: 54 ✭✭

    That's what I'm seeking ^

  • It's fully customizable to allow any path you want to specify for the client to use. That's why you aren't seeing it already set. You can make it whatever you want.

  • Jon Rust
    Jon Rust Posts: 426 mod

    Are you running Cribl self-hosted or in the cloud? self-hosted: i hope you know your own IPs and hostnames :slightly_smiling_face: Cloud: The cloud landing page has all the connection info

  • Once the path is defined you'll tell the client what your FQDN and port is along with the path you configured for them to use and they'll combine that to form the endpoint string to specify in their client app.

  • Are you needing the FQDN and port or the path part?

  • we don't provide a field that contains all that pre-concatenated together that you can simply copy to your clipboard.

  • LovetheBeach
    LovetheBeach Posts: 54 ✭✭

    We're mixed (Cribl Cloud and on-prem). We are trying to send to Cribl's Cloud. We need the FQDN and Port to send to Cribl's Cloud..

  • Your Ingress Address is at the etop of your Cribl Cloud portal interface where your Org ID, and other info is located

  • Jon Rust
    Jon Rust Posts: 426 mod

    there is an http source set-up by default, listed in the Network Settings area

  • Jon Rust
    Jon Rust Posts: 426 mod

    (probably confusing with 2 of us here. I'll bow out.)

  • There isn't a raw http source already in mine. I created one with a port in the custom port range. There is an http input (10080) but it's not the raw so it has specific paths to use which probably isn't what you want if you're looking for a generic webhook.

  • Sending to Cribl Cloud was the critical piece of info it seems.

  • LovetheBeach
    LovetheBeach Posts: 54 ✭✭

    Unfortunately, I don't know how to get to either of the places you're referring me to. Can we start with Home, Manage, Monitoring, or Settings, and provide the path to where you want me to look?

  • It's not within Stream that we're directing you to now but rather your Cribl Cloud tenant interface. I can do a zoom with you for a few minutes if you like.

  • Raanan Dagan
    Raanan Dagan Posts: 101 mod

    Would any of these examples help? https://docs.cribl.io/stream/sources-https#examples

  • LovetheBeach
    LovetheBeach Posts: 54 ✭✭

    That helped ("Cribl Cloud"). Now I see it. Thanks!

  • LovetheBeach
    LovetheBeach Posts: 54 ✭✭

    and yes, Raanan, your link is going to help as well.