We have updated our Terms of Service, Code of Conduct, and Addendum.

Cribl not processing simple TCP syslog data

criblstarter Posts: 1


I have a very basic setup which has:

Cribl stream leader node, 2 cribl workers, 1 admin node

source: syslog tcp port 1514


route filter:__inputId.startsWith('syslog:')

route pipeline: main

route output: filesystem

pipeline: main and CriblSyslog routes attached

I have a test machine that has it's rsyslog sending to remote location (a worker node) and also a script that randomly generates syslog data and sends to the same worker node every 1 second.

I can see the data come in using tcpdump, I can see the received messages coming into the worker in the Sources → Syslog → Status menu but nothing is being processed. Outside of the status menu, none of the metrics show the incoming messages and no files are being written to the filesystem. I've confirmed the connection between the test host and worker node is open with telnet and netcat.

Tried tailing Cribl log files, system log files, anything to find why it's showing as receiving the messages but not processing in the pipeline. It's a very basic syslog setup but I'm lost as to what I'm missing!

Appreciate any tips for troubleshooting!