Data Routing & Processing Flashcards

In Cribl Stream, which component is responsible for determining which pipeline processes an event?

Answer: Route

Routes evaluate filter expressions against incoming events to determine which pipeline should process each event.

What happens to an event in Cribl Stream when no route's filter expression matches it?

Answer: It passes through to the default route

Events that match no other route fall through to the default route, which typically passes events unchanged.

Which Cribl Stream function allows you to send a copy of an event to an alternate pipeline without removing it from the current flow?

Answer: Clone

The Clone function duplicates an event so one copy continues through the current pipeline while another is sent elsewhere.

What is the purpose of the 'Final' flag on a Cribl Stream route?

Answer: It stops further route evaluation once the route matches

When a route is marked Final, no subsequent routes are evaluated if that route's filter matches the event.

In a Cribl Stream pipeline, the Suppress function is used to:

Answer: Deduplicate or throttle repetitive events

Suppress reduces noise by dropping duplicate or high-frequency events based on configurable key fields and time windows.

Which Cribl Stream destination type is best suited for long-term cold storage at the lowest cost?

Answer: S3-Compatible Object Store

S3-compatible object stores like AWS S3 offer the lowest cost per GB for long-term archival of observability data.

What does the 'Passthru' pipeline in Cribl Stream do?

Answer: Forwards events without any transformation

The Passthru pipeline applies no functions to events, forwarding them to their destination exactly as received.