Source & Destination Configuration Flashcards

What is the primary purpose of enabling a Persistent Queue (PQ) on a Cribl destination?

Answer: Store events on disk when the destination is unavailable

Persistent Queue stores events to disk so they can be delivered later if the destination is temporarily unavailable, preventing data loss.

In which scenario would you configure a pre-processing pipeline directly on a Cribl source?

Answer: To apply transformations before events enter the main routing table

A pre-processing pipeline on a source applies transformations or filtering to events before they are passed to the main routing and pipeline system.

What controls when the Cribl S3 destination creates a new object (file) in the target bucket?

Answer: The max file size and flush period settings

The max file size and flush period settings together determine when Cribl closes the current object and starts a new one in S3.

What is the default behavior when a Cribl destination's Persistent Queue reaches its configured maximum disk size?

Answer: New incoming events are blocked or dropped based on the backpressure behavior setting

When the PQ is full, Cribl applies backpressure to block or drop new events depending on the configured backpressure behavior setting.

Which setting in a Cribl HTTP destination controls how many events are grouped together in a single outbound HTTP request?

Answer: Batch size

The batch size setting determines how many events Cribl groups into a single payload before sending one HTTP request to the destination.

When configuring the Elasticsearch destination in Cribl, which default authentication method is used to connect?

Answer: Username and password (Basic auth)

The Elasticsearch destination defaults to Basic authentication using a username and password to connect to the Elasticsearch cluster.

What metadata field does Cribl automatically attach to events from a TCP source to record the sender's network address and port?

Answer: __srcIpPort

Cribl populates the __srcIpPort field with the IP address and port of the client that sent the event over the TCP connection.