--- title: "List all Sources" method: GET path: "/system/inputs" tags: ["sources"] --- # List all Sources `GET /system/inputs` Get a list of all Sources. ## Query parameters - `type` string[] - `offset` integer - `limit` integer ## Response `200` List of Source objects. - PaginatedInputResponse - `items` InputResponse[], required — The pre-limited items in the list of results - union - object — Source configuration with optional Notifications and runtime status. - `id` string — Unique ID for this input - `type` 'collection', required — Connector type identifier. - `disabled` boolean — If true, the Source is disabled and will not collect data. - `pipeline` string — Pipeline to process results - `sendToRoutes` boolean — Send events to normal routing and event processing. Disable to select a specific Pipeline/Destination combination. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `pqEnabled` boolean — Use a disk queue to minimize data loss when connected services block. See [Cribl Docs](https://docs.cribl.io/stream/persistent-queues) for PQ defaults (Cribl-managed Cloud Workers) and configuration options (on-prem and hybrid Workers). - `streamtags` string[] — Metadata tags used for categorization and filtering. - `criblSourceProvenance` InputCollectionOriginDataSourceDiscoveryWithDestinationArnConstraint — Read-only metadata that records how the Source was created. Preserved on update when omitted from the request body. Cannot be set on create. - `origin` 'data_source_discovery' — Feature that created the Source. - `destinationArn` string — ARN of the S3 bucket or Firehose delivery stream configured as the Source. - `sourceArn` string — ARN of the AWS resource that produces the logs. - `connections` ConnectionConfInputCollection[] — Direct connections to Destinations, and optionally via a Pipeline or a Pack - `pipeline` string — Pipeline or Pack to process data before sending to the Destination. - `output` string — Destination to send data to when not using Routes. - `pq` PqType - `mode` 'smart' | 'always' — With Smart mode (deprecated), PQ will write events to the filesystem only when it detects backpressure from the processing engine. Smart mode will have no new development starting July 2026, followed by End of Support and feature removal (auto-migrating to Always On) in January 2027. We recommend using Always On mode instead. With Always On mode, PQ will always write events directly to the queue before forwarding them to the processing engine. - `maxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `maxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use maxBufferSizeBytes instead. - `commitFrequency` number — The number of events to send downstream before committing that Stream has read them - `maxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing. Enter a numeral with units of KB, MB, etc. - `maxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `path` string — The location for the persistent queue files. To this field's value, the system will append: //inputs/ - `compress` 'none' | 'gzip' — Codec to use to compress the persisted data - `onBackpressure` 'block' | 'drop' — Whether to block or drop events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqControls` object — Management controls for the persistent queue. - `breakerRulesets` string[] — A list of event-breaking rulesets that will be applied, in order, to the input data stream - `staleChannelFlushMs` number — How long (in milliseconds) the Event Breaker will wait for new data to be sent to a specific channel before flushing the data stream out, as is, to the Pipelines - `preprocess` PreprocessType - `disabled` boolean, required — Disabled - `command` string — Command to feed the data through (via stdin) and process its output (stdout) - `args` string[] — Arguments to be added to the custom command - `throttleRatePerSec` string — Rate (in bytes per second) to throttle while writing to an output. Accepts values with multiple-byte units, such as KB, MB, and GB. (Example: 42 MB) Default value of 0 specifies no throttling. - `metadata` MetadataConfInputCollection[] — Fields to add to events from this input - `name` string, required — Name of the metadata field. - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.) - `output` string — Destination to send results to - `__template_environment` string — Binds 'environment' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'environment' at runtime. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `notifications` Notification[] — Notifications attached to the Source. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Source configuration with optional Notifications and runtime status. - `id` string — Unique ID for this input - `type` 'kafka', required — Connector type identifier. - `disabled` boolean — If true, the Source is disabled and will not collect data. - `pipeline` string — Pipeline to process data from this Source before sending it through the Routes - `sendToRoutes` boolean — Select whether to send data to Routes, or directly to Destinations. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `pqEnabled` boolean — Use a disk queue to minimize data loss when connected services block. See [Cribl Docs](https://docs.cribl.io/stream/persistent-queues) for PQ defaults (Cribl-managed Cloud Workers) and configuration options (on-prem and hybrid Workers). - `streamtags` string[] — Metadata tags used for categorization and filtering. - `criblSourceProvenance` InputCollectionOriginDataSourceDiscoveryWithDestinationArnConstraint — Read-only metadata that records how the Source was created. Preserved on update when omitted from the request body. Cannot be set on create. - `origin` 'data_source_discovery' — Feature that created the Source. - `destinationArn` string — ARN of the S3 bucket or Firehose delivery stream configured as the Source. - `sourceArn` string — ARN of the AWS resource that produces the logs. - `connections` ConnectionConfInputCollection[] — Direct connections to Destinations, and optionally via a Pipeline or a Pack - `pipeline` string — Pipeline or Pack to process data before sending to the Destination. - `output` string — Destination to send data to when not using Routes. - `pq` PqType - `mode` 'smart' | 'always' — With Smart mode (deprecated), PQ will write events to the filesystem only when it detects backpressure from the processing engine. Smart mode will have no new development starting July 2026, followed by End of Support and feature removal (auto-migrating to Always On) in January 2027. We recommend using Always On mode instead. With Always On mode, PQ will always write events directly to the queue before forwarding them to the processing engine. - `maxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `maxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use maxBufferSizeBytes instead. - `commitFrequency` number — The number of events to send downstream before committing that Stream has read them - `maxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing. Enter a numeral with units of KB, MB, etc. - `maxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `path` string — The location for the persistent queue files. To this field's value, the system will append: //inputs/ - `compress` 'none' | 'gzip' — Codec to use to compress the persisted data - `onBackpressure` 'block' | 'drop' — Whether to block or drop events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqControls` object — Management controls for the persistent queue. - `brokers` string[], required — Enter each Kafka bootstrap server you want to use. Specify the hostname and port (such as mykafkabroker:9092) or just the hostname (in which case @{product} will assign port 9092). - `topics` string[], required — Topic to subscribe to. Warning: To optimize performance, Cribl suggests subscribing each Kafka Source to a single topic only. - `groupId` string — The consumer group to which this instance belongs. Defaults to 'Cribl'. - `fromBeginning` boolean — Leave enabled if you want the Source, upon first subscribing to a topic, to read starting with the earliest available message - `kafkaSchemaRegistry` KafkaSchemaRegistryAuthenticationType — Kafka Schema Registry Authentication - `disabled` boolean, required — Disabled - `schemaRegistryURL` string — URL for accessing the Confluent Schema Registry. Example: http://localhost:8081. To connect over TLS, use https instead of http. - `connectionTimeout` number — Maximum time to wait for a Schema Registry connection to complete successfully - `requestTimeout` number — Maximum time to wait for the Schema Registry to respond to a request - `maxRetries` number — Maximum number of times to try fetching schemas from the Schema Registry - `auth` AuthType — Credentials to use when authenticating with the schema registry - `disabled` boolean, required — Disabled - `oauthEnabled` boolean — Authenticate with the schema registry using OAuth instead of basic HTTP authentication - `tokenUrl` string — URL of the token endpoint to use for OAuth authentication - `clientId` string — Client ID to use for OAuth authentication - `oauthSecretType` string - `clientTextSecret` string — Select or create a stored text secret - `oauthParams` OauthParamConfInputKafka[] — Additional fields to send to the token endpoint, such as scope or audience - … - `identityPoolId` string — Confluent Cloud identity pool ID. Sent as the `Confluent-Identity-Pool-Id` header on requests to the schema registry. - `logicalCluster` string — Confluent Cloud Schema Registry logical cluster ID. Sent as the `target-sr-cluster` header on requests to the schema registry. - `credentialsSecret` string — Select or create a secret that references your credentials - `__template_tokenUrl` string — Binds 'tokenUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenUrl' at runtime. - `__template_clientId` string — Binds 'clientId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientId' at runtime. - `__template_identityPoolId` string — Binds 'identityPoolId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'identityPoolId' at runtime. - `__template_logicalCluster` string — Binds 'logicalCluster' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'logicalCluster' at runtime. - `tls` TlsSettingsClientSideTypeCaPathCertPath — TLS settings (client side) - `disabled` boolean — Disabled - `rejectUnauthorized` boolean — Reject certificates that are not authorized by a CA in the CA certificate path, or by another trusted CA (such as the system's). Defaults to Enabled. Overrides the toggle from Advanced Settings, when also present. - `servername` string — Server name for the SNI (Server Name Indication) TLS extension. It must be a host name, and not an IP address. - `certificateName` string — The name of the predefined certificate - `caPath` string — Path on client in which to find CA certificates to verify the server's cert. PEM format. Can reference $ENV_VARS. - `privKeyPath` string — Path on client in which to find the private key to use. PEM format. Can reference $ENV_VARS. - `certPath` string — Path on client in which to find certificates to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `__template_schemaRegistryURL` string — Binds 'schemaRegistryURL' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'schemaRegistryURL' at runtime. - `connectionTimeout` number — Maximum time to wait for a connection to complete successfully - `requestTimeout` number — Maximum time to wait for Kafka to respond to a request - `maxRetries` number — If messages are failing, you can set the maximum number of retries as high as 100 to prevent loss of data - `maxBackOff` number — The maximum wait time for a retry, in milliseconds. Default (and minimum) is 30,000 ms (30 seconds); maximum is 180,000 ms (180 seconds). - `initialBackoff` number — Initial value used to calculate the retry, in milliseconds. Maximum is 600,000 ms (10 minutes). - `backoffRate` number — Set the backoff multiplier (2-20) to control the retry frequency for failed messages. For faster retries, use a lower multiplier. For slower retries with more delay between attempts, use a higher multiplier. The multiplier is used in an exponential backoff formula; see the Kafka [documentation](https://kafka.js.org/docs/retry-detailed) for details. - `authenticationTimeout` number — Maximum time to wait for Kafka to respond to an authentication request - `reauthenticationThreshold` number — Specifies a time window during which @{product} can reauthenticate if needed. Creates the window measuring backward from the moment when credentials are set to expire. - `sasl` AuthenticationType — Authentication parameters to use when connecting to brokers. Using TLS is highly recommended. - `disabled` boolean, required — Disabled - `username` string — Username - `password` string — Password - `authType` 'manual' | 'secret' — Enter credentials directly, or select a stored secret - `credentialsSecret` string — Select or create a secret that references your credentials - `mechanism` 'plain' | 'scram-sha-256' | 'scram-sha-512' | 'kerberos' — SASL mechanism - `keytabLocation` string — Location of keytab file for authentication principal - `principal` string — Authentication principal, such as `kafka_user@example.com` - `brokerServiceClass` string — Kerberos service class for Kafka brokers, such as `kafka` - `oauthEnabled` boolean — Enable OAuth authentication - `tokenUrl` string — URL of the token endpoint to use for OAuth authentication - `clientId` string — Client ID to use for OAuth authentication - `oauthSecretType` string - `clientTextSecret` string — Select or create a stored text secret - `oauthParams` OauthParamConfInputKafka[] — Additional fields to send to the token endpoint, such as scope or audience - `name` string, required — Parameter Name - `value` string, required — Parameter Value - `saslExtensions` SaslExtensionConfInputKafka[] — Additional SASL extension fields, such as Confluent's logicalCluster or identityPoolId - `name` string, required — Field Name - `value` string, required — Field Value - `__template_mechanism` string — Binds 'mechanism' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'mechanism' at runtime. - `__template_keytabLocation` string — Binds 'keytabLocation' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'keytabLocation' at runtime. - `__template_principal` string — Binds 'principal' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'principal' at runtime. - `__template_brokerServiceClass` string — Binds 'brokerServiceClass' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'brokerServiceClass' at runtime. - `__template_tokenUrl` string — Binds 'tokenUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenUrl' at runtime. - `__template_clientId` string — Binds 'clientId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientId' at runtime. - `tls` TlsSettingsClientSideTypeCaPathCertPath — TLS settings (client side) - `disabled` boolean — Disabled - `rejectUnauthorized` boolean — Reject certificates that are not authorized by a CA in the CA certificate path, or by another trusted CA (such as the system's). Defaults to Enabled. Overrides the toggle from Advanced Settings, when also present. - `servername` string — Server name for the SNI (Server Name Indication) TLS extension. It must be a host name, and not an IP address. - `certificateName` string — The name of the predefined certificate - `caPath` string — Path on client in which to find CA certificates to verify the server's cert. PEM format. Can reference $ENV_VARS. - `privKeyPath` string — Path on client in which to find the private key to use. PEM format. Can reference $ENV_VARS. - `certPath` string — Path on client in which to find certificates to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `sessionTimeout` number — Timeout used to detect client failures when using Kafka's group-management facilities. If the client sends no heartbeats to the broker before the timeout expires, the broker will remove the client from the group and initiate a rebalance. Value must be between the broker's configured group.min.session.timeout.ms and group.max.session.timeout.ms. See [Kafka's documentation](https://kafka.apache.org/documentation/#consumerconfigs_session.timeout.ms) for details. - `rebalanceTimeout` number — Maximum allowed time for each worker to join the group after a rebalance begins. If the timeout is exceeded, the coordinator broker will remove the worker from the group. See [Kafka's documentation](https://kafka.apache.org/documentation/#connectconfigs_rebalance.timeout.ms) for details. - `heartbeatInterval` number — Expected time between heartbeats to the consumer coordinator when using Kafka's group-management facilities. Value must be lower than sessionTimeout and typically should not exceed 1/3 of the sessionTimeout value. See [Kafka's documentation](https://kafka.apache.org/documentation/#consumerconfigs_heartbeat.interval.ms) for details. - `autoCommitInterval` number — How often to commit offsets. If both this and Offset commit threshold are set, @{product} commits offsets when either condition is met. If both are empty, @{product} commits offsets after each batch. - `autoCommitThreshold` number — How many events are needed to trigger an offset commit. If both this and Offset commit interval are set, @{product} commits offsets when either condition is met. If both are empty, @{product} commits offsets after each batch. - `maxBytesPerPartition` number — Maximum amount of data that Kafka will return per partition, per fetch request. Must equal or exceed the maximum message size (maxBytesPerPartition) that Kafka is configured to allow. Otherwise, @{product} can get stuck trying to retrieve messages. Defaults to 1048576 (1 MB). - `maxBytes` number — Maximum number of bytes that Kafka will return per fetch request. Defaults to 10485760 (10 MB). - `maxSocketErrors` number — Maximum number of network errors before the consumer re-creates a socket - `metadata` MetadataConfInputCollection[] — Fields to add to events from this input - `name` string, required — Name of the metadata field. - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.) - `description` string — Optional description for this configuration. - `__template_environment` string — Binds 'environment' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'environment' at runtime. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_brokers` string — Binds 'brokers' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'brokers' at runtime. - `__template_topics` string — Binds 'topics' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'topics' at runtime. - `__template_groupId` string — Binds 'groupId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'groupId' at runtime. - `notifications` Notification[] — Notifications attached to the Source. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Source configuration with optional Notifications and runtime status. - `id` string — Unique ID for this input - `type` 'msk', required — Connector type identifier. - `disabled` boolean — If true, the Source is disabled and will not collect data. - `pipeline` string — Pipeline to process data from this Source before sending it through the Routes - `sendToRoutes` boolean — Select whether to send data to Routes, or directly to Destinations. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `pqEnabled` boolean — Use a disk queue to minimize data loss when connected services block. See [Cribl Docs](https://docs.cribl.io/stream/persistent-queues) for PQ defaults (Cribl-managed Cloud Workers) and configuration options (on-prem and hybrid Workers). - `streamtags` string[] — Metadata tags used for categorization and filtering. - `criblSourceProvenance` InputCollectionOriginDataSourceDiscoveryWithDestinationArnConstraint — Read-only metadata that records how the Source was created. Preserved on update when omitted from the request body. Cannot be set on create. - `origin` 'data_source_discovery' — Feature that created the Source. - `destinationArn` string — ARN of the S3 bucket or Firehose delivery stream configured as the Source. - `sourceArn` string — ARN of the AWS resource that produces the logs. - `connections` ConnectionConfInputCollection[] — Direct connections to Destinations, and optionally via a Pipeline or a Pack - `pipeline` string — Pipeline or Pack to process data before sending to the Destination. - `output` string — Destination to send data to when not using Routes. - `pq` PqType - `mode` 'smart' | 'always' — With Smart mode (deprecated), PQ will write events to the filesystem only when it detects backpressure from the processing engine. Smart mode will have no new development starting July 2026, followed by End of Support and feature removal (auto-migrating to Always On) in January 2027. We recommend using Always On mode instead. With Always On mode, PQ will always write events directly to the queue before forwarding them to the processing engine. - `maxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `maxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use maxBufferSizeBytes instead. - `commitFrequency` number — The number of events to send downstream before committing that Stream has read them - `maxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing. Enter a numeral with units of KB, MB, etc. - `maxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `path` string — The location for the persistent queue files. To this field's value, the system will append: //inputs/ - `compress` 'none' | 'gzip' — Codec to use to compress the persisted data - `onBackpressure` 'block' | 'drop' — Whether to block or drop events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqControls` object — Management controls for the persistent queue. - `brokers` string[], required — Enter each Kafka bootstrap server you want to use. Specify the hostname and port (such as mykafkabroker:9092) or just the hostname (in which case @{product} will assign port 9092). - `topics` string[], required — Topic to subscribe to. Warning: To optimize performance, Cribl suggests subscribing each Kafka Source to a single topic only. - `groupId` string — The consumer group to which this instance belongs. Defaults to 'Cribl'. - `fromBeginning` boolean — Leave enabled if you want the Source, upon first subscribing to a topic, to read starting with the earliest available message - `sessionTimeout` number — Timeout used to detect client failures when using Kafka's group-management facilities. If the client sends no heartbeats to the broker before the timeout expires, the broker will remove the client from the group and initiate a rebalance. Value must be between the broker's configured group.min.session.timeout.ms and group.max.session.timeout.ms. See [Kafka's documentation](https://kafka.apache.org/documentation/#consumerconfigs_session.timeout.ms) for details. - `rebalanceTimeout` number — Maximum allowed time for each worker to join the group after a rebalance begins. If the timeout is exceeded, the coordinator broker will remove the worker from the group. See [Kafka's documentation](https://kafka.apache.org/documentation/#connectconfigs_rebalance.timeout.ms) for details. - `heartbeatInterval` number — Expected time between heartbeats to the consumer coordinator when using Kafka's group-management facilities. Value must be lower than sessionTimeout and typically should not exceed 1/3 of the sessionTimeout value. See [Kafka's documentation](https://kafka.apache.org/documentation/#consumerconfigs_heartbeat.interval.ms) for details. - `metadata` MetadataConfInputCollection[] — Fields to add to events from this input - `name` string, required — Name of the metadata field. - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.) - `kafkaSchemaRegistry` KafkaSchemaRegistryAuthenticationType — Kafka Schema Registry Authentication - `disabled` boolean, required — Disabled - `schemaRegistryURL` string — URL for accessing the Confluent Schema Registry. Example: http://localhost:8081. To connect over TLS, use https instead of http. - `connectionTimeout` number — Maximum time to wait for a Schema Registry connection to complete successfully - `requestTimeout` number — Maximum time to wait for the Schema Registry to respond to a request - `maxRetries` number — Maximum number of times to try fetching schemas from the Schema Registry - `auth` AuthType — Credentials to use when authenticating with the schema registry - `disabled` boolean, required — Disabled - `oauthEnabled` boolean — Authenticate with the schema registry using OAuth instead of basic HTTP authentication - `tokenUrl` string — URL of the token endpoint to use for OAuth authentication - `clientId` string — Client ID to use for OAuth authentication - `oauthSecretType` string - `clientTextSecret` string — Select or create a stored text secret - `oauthParams` OauthParamConfInputKafka[] — Additional fields to send to the token endpoint, such as scope or audience - … - `identityPoolId` string — Confluent Cloud identity pool ID. Sent as the `Confluent-Identity-Pool-Id` header on requests to the schema registry. - `logicalCluster` string — Confluent Cloud Schema Registry logical cluster ID. Sent as the `target-sr-cluster` header on requests to the schema registry. - `credentialsSecret` string — Select or create a secret that references your credentials - `__template_tokenUrl` string — Binds 'tokenUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenUrl' at runtime. - `__template_clientId` string — Binds 'clientId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientId' at runtime. - `__template_identityPoolId` string — Binds 'identityPoolId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'identityPoolId' at runtime. - `__template_logicalCluster` string — Binds 'logicalCluster' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'logicalCluster' at runtime. - `tls` TlsSettingsClientSideTypeCaPathCertPath — TLS settings (client side) - `disabled` boolean — Disabled - `rejectUnauthorized` boolean — Reject certificates that are not authorized by a CA in the CA certificate path, or by another trusted CA (such as the system's). Defaults to Enabled. Overrides the toggle from Advanced Settings, when also present. - `servername` string — Server name for the SNI (Server Name Indication) TLS extension. It must be a host name, and not an IP address. - `certificateName` string — The name of the predefined certificate - `caPath` string — Path on client in which to find CA certificates to verify the server's cert. PEM format. Can reference $ENV_VARS. - `privKeyPath` string — Path on client in which to find the private key to use. PEM format. Can reference $ENV_VARS. - `certPath` string — Path on client in which to find certificates to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `__template_schemaRegistryURL` string — Binds 'schemaRegistryURL' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'schemaRegistryURL' at runtime. - `connectionTimeout` number — Maximum time to wait for a connection to complete successfully - `requestTimeout` number — Maximum time to wait for Kafka to respond to a request - `maxRetries` number — If messages are failing, you can set the maximum number of retries as high as 100 to prevent loss of data - `maxBackOff` number — The maximum wait time for a retry, in milliseconds. Default (and minimum) is 30,000 ms (30 seconds); maximum is 180,000 ms (180 seconds). - `initialBackoff` number — Initial value used to calculate the retry, in milliseconds. Maximum is 600,000 ms (10 minutes). - `backoffRate` number — Set the backoff multiplier (2-20) to control the retry frequency for failed messages. For faster retries, use a lower multiplier. For slower retries with more delay between attempts, use a higher multiplier. The multiplier is used in an exponential backoff formula; see the Kafka [documentation](https://kafka.js.org/docs/retry-detailed) for details. - `authenticationTimeout` number — Maximum time to wait for Kafka to respond to an authentication request - `reauthenticationThreshold` number — Specifies a time window during which @{product} can reauthenticate if needed. Creates the window measuring backward from the moment when credentials are set to expire. - `awsAuthenticationMethod` 'auto' | 'manual' | 'secret', required — AWS authentication method. Choose Auto to use IAM roles. - `awsSecretKey` string — Secret key - `region` string, required — Region where the MSK cluster is located - `endpoint` string — MSK cluster service endpoint. If empty, defaults to the AWS Region-specific endpoint. Otherwise, it must point to MSK cluster-compatible endpoint. - `reuseConnections` boolean — Reuse connections between requests, which can improve performance - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA, such as self-signed certificates - `enableAssumeRole` boolean — Use Assume Role credentials to access MSK - `assumeRoleArn` string — Amazon Resource Name (ARN) of the role to assume - `assumeRoleExternalId` string — External ID to use when assuming role - `durationSeconds` number — Duration of the assumed role's session, in seconds. Minimum is 900 (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12 hours). - `tls` TlsSettingsClientSideTypeCaPathCertPath — TLS settings (client side) - `disabled` boolean — Disabled - `rejectUnauthorized` boolean — Reject certificates that are not authorized by a CA in the CA certificate path, or by another trusted CA (such as the system's). Defaults to Enabled. Overrides the toggle from Advanced Settings, when also present. - `servername` string — Server name for the SNI (Server Name Indication) TLS extension. It must be a host name, and not an IP address. - `certificateName` string — The name of the predefined certificate - `caPath` string — Path on client in which to find CA certificates to verify the server's cert. PEM format. Can reference $ENV_VARS. - `privKeyPath` string — Path on client in which to find the private key to use. PEM format. Can reference $ENV_VARS. - `certPath` string — Path on client in which to find certificates to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `autoCommitInterval` number — How often to commit offsets. If both this and Offset commit threshold are set, @{product} commits offsets when either condition is met. If both are empty, @{product} commits offsets after each batch. - `autoCommitThreshold` number — How many events are needed to trigger an offset commit. If both this and Offset commit interval are set, @{product} commits offsets when either condition is met. If both are empty, @{product} commits offsets after each batch. - `maxBytesPerPartition` number — Maximum amount of data that Kafka will return per partition, per fetch request. Must equal or exceed the maximum message size (maxBytesPerPartition) that Kafka is configured to allow. Otherwise, @{product} can get stuck trying to retrieve messages. Defaults to 1048576 (1 MB). - `maxBytes` number — Maximum number of bytes that Kafka will return per fetch request. Defaults to 10485760 (10 MB). - `maxSocketErrors` number — Maximum number of network errors before the consumer re-creates a socket - `description` string — Optional description for this configuration. - `awsApiKey` string — Access key - `awsSecret` string — Select or create a stored secret that references your access key and secret key - `__template_environment` string — Binds 'environment' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'environment' at runtime. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_brokers` string — Binds 'brokers' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'brokers' at runtime. - `__template_topics` string — Binds 'topics' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'topics' at runtime. - `__template_groupId` string — Binds 'groupId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'groupId' at runtime. - `__template_awsSecretKey` string — Binds 'awsSecretKey' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'awsSecretKey' at runtime. - `__template_region` string — Binds 'region' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'region' at runtime. - `__template_endpoint` string — Binds 'endpoint' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'endpoint' at runtime. - `__template_assumeRoleArn` string — Binds 'assumeRoleArn' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'assumeRoleArn' at runtime. - `__template_assumeRoleExternalId` string — Binds 'assumeRoleExternalId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'assumeRoleExternalId' at runtime. - `__template_awsApiKey` string — Binds 'awsApiKey' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'awsApiKey' at runtime. - `notifications` Notification[] — Notifications attached to the Source. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Source configuration with optional Notifications and runtime status. - `id` string — Unique ID for this input - `type` 'http', required — Source type identifier. - `disabled` boolean — If true, the Source is disabled and will not collect data. - `pipeline` string — Pipeline to process data from this Source before sending it through the Routes - `sendToRoutes` boolean — Select whether to send data to Routes, or directly to Destinations. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `pqEnabled` boolean — Use a disk queue to minimize data loss when connected services block. See [Cribl Docs](https://docs.cribl.io/stream/persistent-queues) for PQ defaults (Cribl-managed Cloud Workers) and configuration options (on-prem and hybrid Workers). - `streamtags` string[] — Metadata tags used for categorization and filtering. - `criblSourceProvenance` InputCollectionOriginDataSourceDiscoveryWithDestinationArnConstraint — Read-only metadata that records how the Source was created. Preserved on update when omitted from the request body. Cannot be set on create. - `origin` 'data_source_discovery' — Feature that created the Source. - `destinationArn` string — ARN of the S3 bucket or Firehose delivery stream configured as the Source. - `sourceArn` string — ARN of the AWS resource that produces the logs. - `connections` ConnectionConfInputCollection[] — Direct connections to Destinations, and optionally via a Pipeline or a Pack - `pipeline` string — Pipeline or Pack to process data before sending to the Destination. - `output` string — Destination to send data to when not using Routes. - `pq` PqType - `mode` 'smart' | 'always' — With Smart mode (deprecated), PQ will write events to the filesystem only when it detects backpressure from the processing engine. Smart mode will have no new development starting July 2026, followed by End of Support and feature removal (auto-migrating to Always On) in January 2027. We recommend using Always On mode instead. With Always On mode, PQ will always write events directly to the queue before forwarding them to the processing engine. - `maxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `maxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use maxBufferSizeBytes instead. - `commitFrequency` number — The number of events to send downstream before committing that Stream has read them - `maxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing. Enter a numeral with units of KB, MB, etc. - `maxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `path` string — The location for the persistent queue files. To this field's value, the system will append: //inputs/ - `compress` 'none' | 'gzip' — Codec to use to compress the persisted data - `onBackpressure` 'block' | 'drop' — Whether to block or drop events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqControls` object — Management controls for the persistent queue. - `host` string, required — Address to bind on. Defaults to 0.0.0.0 (all addresses). - `port` number, required — Port to listen on - `authTokens` string[] — Shared secrets to be provided by any client (Authorization: ). If empty, unauthorized access is permitted. - `tls` TlsSettingsServerSideType — TLS settings (server side) - `disabled` boolean — If true, TLS is disabled on this connection. - `requestCert` boolean — Require clients to present their certificates. Used to perform client authentication using SSL certs. - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's) - `commonNameRegex` string — Regex matching allowable common names in peer certificates' subject attribute - `certificateName` string — The name of the predefined certificate - `privKeyPath` string — Path on server containing the private key to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `certPath` string — Path on server containing certificates to use. PEM format. Can reference $ENV_VARS. - `caPath` string — Path on server containing CA certificates to use. PEM format. Can reference $ENV_VARS. - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `maxActiveReq` number — Maximum number of active requests allowed per Worker Process. Set to 0 for unlimited. Caution: Increasing the limit above the default value, or setting it to unlimited, may degrade performance and reduce throughput. - `maxRequestsPerSocket` integer — Maximum number of requests per socket before @{product} instructs the client to close the connection. Default is 0 (unlimited). - `enableProxyHeader` boolean — Extract the client IP and port from PROXY protocol v1/v2. When enabled, the X-Forwarded-For header is ignored. Disable to use the X-Forwarded-For header for client IP extraction. - `captureHeaders` boolean — Add request headers to events, in the __headers field - `activityLogSampleRate` number — How often request activity is logged at the `info` level. A value of 1 would log every request, 10 every 10th request, etc. - `requestTimeout` number — How long to wait for an incoming request to complete before aborting it. Use 0 to disable. - `socketTimeout` number — How long @{product} should wait before assuming that an inactive socket has timed out. To wait forever, set to 0. - `keepAliveTimeout` number — After the last response is sent, @{product} will wait this long for additional data before closing the socket connection. Minimum 1 second, maximum 600 seconds (10 minutes). - `enableHealthCheck` boolean — Expose the /cribl_health endpoint, which returns 200 OK when this Source is healthy - `ipAllowlistRegex` string — Messages from matched IP addresses will be processed, unless also matched by the denylist - `ipDenylistRegex` string — Messages from matched IP addresses will be ignored. This takes precedence over the allowlist. - `criblAPI` string — Absolute path on which to listen for the Cribl HTTP API requests. Only _bulk (default /cribl/_bulk) is available. Use empty string to disable. - `elasticAPI` string — Absolute path on which to listen for the Elasticsearch API requests. Only _bulk (default /elastic/_bulk) is available. Use empty string to disable. - `splunkHecAPI` string — Absolute path on which listen for the Splunk HTTP Event Collector API requests. Use empty string to disable. - `splunkHecAcks` boolean — Enable Splunk HEC acknowledgements - `metadata` MetadataConfInputCollection[] — Fields to add to events from this input - `name` string, required — Name of the metadata field. - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.) - `authTokensExt` AuthTokensExtConfInputHttp[] — Shared secrets to be provided by any client (Authorization: ). If empty, unauthorized access is permitted. - `token` string, required — Shared secret to be provided by any client (Authorization: ) - `description` string — Description - `metadata` MetadataConfInputCollection[] — Fields to add to events referencing this token - `name` string, required — Name of the metadata field. - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.) - `description` string — Optional description for this configuration. - `__template_environment` string — Binds 'environment' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'environment' at runtime. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_host` string — Binds 'host' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'host' at runtime. - `__template_port` string — Binds 'port' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'port' at runtime. - `__template_authTokens` string — Binds 'authTokens' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'authTokens' at runtime. - `__template_criblAPI` string — Binds 'criblAPI' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'criblAPI' at runtime. - `__template_elasticAPI` string — Binds 'elasticAPI' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'elasticAPI' at runtime. - `__template_splunkHecAPI` string — Binds 'splunkHecAPI' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'splunkHecAPI' at runtime. - `notifications` Notification[] — Notifications attached to the Source. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Source configuration with optional Notifications and runtime status. - `id` string — Unique ID for this input - `type` 'splunk', required — Connector type identifier. - `disabled` boolean — If true, the Source is disabled and will not collect data. - `pipeline` string — Pipeline to process data from this Source before sending it through the Routes - `sendToRoutes` boolean — Select whether to send data to Routes, or directly to Destinations. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `pqEnabled` boolean — Use a disk queue to minimize data loss when connected services block. See [Cribl Docs](https://docs.cribl.io/stream/persistent-queues) for PQ defaults (Cribl-managed Cloud Workers) and configuration options (on-prem and hybrid Workers). - `streamtags` string[] — Metadata tags used for categorization and filtering. - `criblSourceProvenance` InputCollectionOriginDataSourceDiscoveryWithDestinationArnConstraint — Read-only metadata that records how the Source was created. Preserved on update when omitted from the request body. Cannot be set on create. - `origin` 'data_source_discovery' — Feature that created the Source. - `destinationArn` string — ARN of the S3 bucket or Firehose delivery stream configured as the Source. - `sourceArn` string — ARN of the AWS resource that produces the logs. - `connections` ConnectionConfInputCollection[] — Direct connections to Destinations, and optionally via a Pipeline or a Pack - `pipeline` string — Pipeline or Pack to process data before sending to the Destination. - `output` string — Destination to send data to when not using Routes. - `pq` PqType - `mode` 'smart' | 'always' — With Smart mode (deprecated), PQ will write events to the filesystem only when it detects backpressure from the processing engine. Smart mode will have no new development starting July 2026, followed by End of Support and feature removal (auto-migrating to Always On) in January 2027. We recommend using Always On mode instead. With Always On mode, PQ will always write events directly to the queue before forwarding them to the processing engine. - `maxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `maxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use maxBufferSizeBytes instead. - `commitFrequency` number — The number of events to send downstream before committing that Stream has read them - `maxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing. Enter a numeral with units of KB, MB, etc. - `maxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `path` string — The location for the persistent queue files. To this field's value, the system will append: //inputs/ - `compress` 'none' | 'gzip' — Codec to use to compress the persisted data - `onBackpressure` 'block' | 'drop' — Whether to block or drop events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqControls` object — Management controls for the persistent queue. - `host` string, required — Address to bind on. Defaults to 0.0.0.0 (all addresses). - `port` number, required — Port to listen on - `tls` TlsSettingsServerSideType — TLS settings (server side) - `disabled` boolean — If true, TLS is disabled on this connection. - `requestCert` boolean — Require clients to present their certificates. Used to perform client authentication using SSL certs. - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's) - `commonNameRegex` string — Regex matching allowable common names in peer certificates' subject attribute - `certificateName` string — The name of the predefined certificate - `privKeyPath` string — Path on server containing the private key to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `certPath` string — Path on server containing certificates to use. PEM format. Can reference $ENV_VARS. - `caPath` string — Path on server containing CA certificates to use. PEM format. Can reference $ENV_VARS. - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `ipWhitelistRegex` string — Regex matching IP addresses that are allowed to establish a connection - `maxActiveCxn` number — Maximum number of active connections allowed per Worker Process. Use 0 for unlimited. - `socketIdleTimeout` number — How long @{product} should wait before assuming that an inactive socket has timed out. After this time, the connection will be closed. Leave at 0 for no inactive socket monitoring. - `socketEndingMaxWait` number — How long the server will wait after initiating a closure for a client to close its end of the connection. If the client doesn't close the connection within this time, the server will forcefully terminate the socket to prevent resource leaks and ensure efficient connection cleanup and system stability. Leave at 0 for no inactive socket monitoring. - `socketMaxLifespan` number — The maximum duration a socket can remain open, even if active. This helps manage resources and mitigate issues caused by TCP pinning. Set to 0 to disable. - `enableProxyHeader` boolean — Enable if the connection is proxied by a device that supports proxy protocol v1 or v2 - `metadata` MetadataConfInputCollection[] — Fields to add to events from this input - `name` string, required — Name of the metadata field. - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.) - `breakerRulesets` string[] — A list of event-breaking rulesets that will be applied, in order, to the input data stream - `staleChannelFlushMs` number — How long (in milliseconds) the Event Breaker will wait for new data to be sent to a specific channel before flushing the data stream out, as is, to the Pipelines - `authTokens` object[] — Shared secrets to be provided by any Splunk forwarder. If empty, unauthorized access is permitted. - `token` string, required — Shared secrets to be provided by any Splunk forwarder. If empty, unauthorized access is permitted. - `description` string — Description - `maxS2Sversion` 'v3' | 'v4' — The highest S2S protocol version to advertise during handshake - `description` string — Optional description for this configuration. - `useFwdTimezone` boolean — Event Breakers will determine events' time zone from UF-provided metadata, when TZ can't be inferred from the raw event - `dropControlFields` boolean — Drop Splunk control fields such as `crcSalt` and `_savedPort`. If disabled, control fields are stored in the internal field `__ctrlFields`. - `extractMetrics` boolean — Extract and process Splunk-generated metrics as Cribl metrics - `compress` 'disabled' | 'auto' | 'always' — Controls whether to support reading compressed data from a forwarder. Select 'Automatic' to match the forwarder's configuration, or 'Disabled' to reject compressed connections. - `__template_environment` string — Binds 'environment' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'environment' at runtime. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_host` string — Binds 'host' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'host' at runtime. - `__template_port` string — Binds 'port' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'port' at runtime. - `__template_maxS2Sversion` string — Binds 'maxS2Sversion' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'maxS2Sversion' at runtime. - `__template_compress` string — Binds 'compress' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'compress' at runtime. - `notifications` Notification[] — Notifications attached to the Source. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Source configuration with optional Notifications and runtime status. - `id` string — Unique ID for this input - `type` 'splunk_search', required — Connector type identifier. - `disabled` boolean — If true, the Source is disabled and will not collect data. - `pipeline` string — Pipeline to process data from this Source before sending it through the Routes - `sendToRoutes` boolean — Select whether to send data to Routes, or directly to Destinations. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `pqEnabled` boolean — Use a disk queue to minimize data loss when connected services block. See [Cribl Docs](https://docs.cribl.io/stream/persistent-queues) for PQ defaults (Cribl-managed Cloud Workers) and configuration options (on-prem and hybrid Workers). - `streamtags` string[] — Metadata tags used for categorization and filtering. - `criblSourceProvenance` InputCollectionOriginDataSourceDiscoveryWithDestinationArnConstraint — Read-only metadata that records how the Source was created. Preserved on update when omitted from the request body. Cannot be set on create. - `origin` 'data_source_discovery' — Feature that created the Source. - `destinationArn` string — ARN of the S3 bucket or Firehose delivery stream configured as the Source. - `sourceArn` string — ARN of the AWS resource that produces the logs. - `connections` ConnectionConfInputCollection[] — Direct connections to Destinations, and optionally via a Pipeline or a Pack - `pipeline` string — Pipeline or Pack to process data before sending to the Destination. - `output` string — Destination to send data to when not using Routes. - `pq` PqType - `mode` 'smart' | 'always' — With Smart mode (deprecated), PQ will write events to the filesystem only when it detects backpressure from the processing engine. Smart mode will have no new development starting July 2026, followed by End of Support and feature removal (auto-migrating to Always On) in January 2027. We recommend using Always On mode instead. With Always On mode, PQ will always write events directly to the queue before forwarding them to the processing engine. - `maxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `maxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use maxBufferSizeBytes instead. - `commitFrequency` number — The number of events to send downstream before committing that Stream has read them - `maxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing. Enter a numeral with units of KB, MB, etc. - `maxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `path` string — The location for the persistent queue files. To this field's value, the system will append: //inputs/ - `compress` 'none' | 'gzip' — Codec to use to compress the persisted data - `onBackpressure` 'block' | 'drop' — Whether to block or drop events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqControls` object — Management controls for the persistent queue. - `searchHead` string, required — Search head base URL. Can be an expression. Default is https://localhost:8089. - `search` string, required — Enter Splunk search here. Examples: 'index=myAppLogs level=error channel=myApp' OR '| mstats avg(myStat) as myStat WHERE index=myStatsIndex.' - `earliest` string — The earliest time boundary for the search. Can be an exact or relative time. Examples: '2022-01-14T12:00:00Z' or '-16m@m' - `latest` string — The latest time boundary for the search. Can be an exact or relative time. Examples: '2022-01-14T12:00:00Z' or '-1m@m' - `cronSchedule` string, required — A cron schedule on which to run this job - `endpoint` string, required — REST API used to create a search - `outputMode` 'csv' | 'json', required — Format of the returned output - `endpointParams` object[] — Optional request parameters to send to the endpoint - `name` string, required — Parameter Name - `value` string, required — JavaScript expression to compute the parameter's value, normally enclosed in backticks (e.g., `${earliest}`). If a constant, use single quotes (e.g., 'earliest'). Values without delimiters (e.g., earliest) are evaluated as strings. - `endpointHeaders` object[] — Optional request headers to send to the endpoint - `name` string, required — Header Name - `value` string, required — JavaScript expression to compute the header's value, normally enclosed in backticks (e.g., `${earliest}`). If a constant, use single quotes (e.g., 'earliest'). Values without delimiters (e.g., earliest) are evaluated as strings. - `logLevel` 'error' | 'warn' | 'info' | 'debug' — Collector runtime log level (verbosity) - `requestTimeout` number — HTTP request inactivity timeout. Use 0 for no timeout. - `useRoundRobinDns` boolean — When a DNS server returns multiple addresses, @{product} will cycle through them in the order returned - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `encoding` string — Character encoding to use when parsing ingested data. When not set, @{product} will default to UTF-8 but may incorrectly interpret multi-byte characters. - `keepAliveTime` number — How often workers should check in with the scheduler to keep job subscription alive - `jobTimeout` string — Maximum time the job is allowed to run (e.g., 30, 45s or 15m). Units are seconds, if not specified. Enter 0 for unlimited time. - `maxMissedKeepAlives` number — The number of Keep Alive Time periods before an inactive worker will have its job subscription revoked. - `ttl` string — Time to keep the job's artifacts on disk after job completion. This also affects how long a job is listed in the Job Inspector. - `ignoreGroupJobsLimit` boolean — When enabled, this job's artifacts are not counted toward the Worker Group's finished job artifacts limit. Artifacts will be removed only after the Collector's configured time to live. - `metadata` MetadataConfInputCollection[] — Fields to add to events from this input - `name` string, required — Name of the metadata field. - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.) - `retryRules` RetryRulesType - `type` 'none' | 'backoff' | 'static', required — The algorithm to use when performing HTTP retries - `interval` number — Time interval between failed request and first retry (kickoff). Maximum allowed value is 20,000 ms (1/3 minute). - `limit` number — The maximum number of times to retry a failed HTTP request - `multiplier` number — Base for exponential backoff, e.g., base 2 means that retries will occur after 2, then 4, then 8 seconds, and so on - `codes` number[] — List of HTTP codes that trigger a retry. Leave empty to use the default list of 429 and 503. - `enableHeader` boolean — Honor any Retry-After header that specifies a delay (in seconds) or a timestamp after which to retry the request. The delay is limited to 20 seconds, even if the Retry-After header specifies a longer delay. When disabled, all Retry-After headers are ignored. - `retryConnectTimeout` boolean — Make a single retry attempt when a connection timeout (ETIMEDOUT) error occurs - `retryConnectReset` boolean — Retry request when a connection reset (ECONNRESET) error occurs - `breakerRulesets` string[] — A list of event-breaking rulesets that will be applied, in order, to the input data stream - `staleChannelFlushMs` number — How long (in milliseconds) the Event Breaker will wait for new data to be sent to a specific channel before flushing the data stream out, as is, to the Pipelines - `authType` 'none' | 'basic' | 'credentialsSecret' | 'token' | 'textSecret', required — Splunk Search authentication type - `description` string — Optional description for this configuration. - `username` string — Username - `password` string — Password - `token` string — Bearer token to include in the authorization header - `credentialsSecret` string — Select or create a secret that references your credentials - `textSecret` string — Select or create a stored text secret - `__template_environment` string — Binds 'environment' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'environment' at runtime. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_searchHead` string — Binds 'searchHead' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'searchHead' at runtime. - `__template_search` string — Binds 'search' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'search' at runtime. - `__template_earliest` string — Binds 'earliest' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'earliest' at runtime. - `__template_latest` string — Binds 'latest' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'latest' at runtime. - `__template_endpoint` string — Binds 'endpoint' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'endpoint' at runtime. - `__template_logLevel` string — Binds 'logLevel' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'logLevel' at runtime. - `notifications` Notification[] — Notifications attached to the Source. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Source configuration with optional Notifications and runtime status. - `id` string — Unique ID for this input - `type` 'splunk_hec', required — Source type identifier. - `disabled` boolean — If true, the Source is disabled and will not collect data. - `pipeline` string — Pipeline to process data from this Source before sending it through the Routes - `sendToRoutes` boolean — Select whether to send data to Routes, or directly to Destinations. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `pqEnabled` boolean — Use a disk queue to minimize data loss when connected services block. See [Cribl Docs](https://docs.cribl.io/stream/persistent-queues) for PQ defaults (Cribl-managed Cloud Workers) and configuration options (on-prem and hybrid Workers). - `streamtags` string[] — Metadata tags used for categorization and filtering. - `criblSourceProvenance` InputCollectionOriginDataSourceDiscoveryWithDestinationArnConstraint — Read-only metadata that records how the Source was created. Preserved on update when omitted from the request body. Cannot be set on create. - `origin` 'data_source_discovery' — Feature that created the Source. - `destinationArn` string — ARN of the S3 bucket or Firehose delivery stream configured as the Source. - `sourceArn` string — ARN of the AWS resource that produces the logs. - `connections` ConnectionConfInputCollection[] — Direct connections to Destinations, and optionally via a Pipeline or a Pack - `pipeline` string — Pipeline or Pack to process data before sending to the Destination. - `output` string — Destination to send data to when not using Routes. - `pq` PqType - `mode` 'smart' | 'always' — With Smart mode (deprecated), PQ will write events to the filesystem only when it detects backpressure from the processing engine. Smart mode will have no new development starting July 2026, followed by End of Support and feature removal (auto-migrating to Always On) in January 2027. We recommend using Always On mode instead. With Always On mode, PQ will always write events directly to the queue before forwarding them to the processing engine. - `maxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `maxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use maxBufferSizeBytes instead. - `commitFrequency` number — The number of events to send downstream before committing that Stream has read them - `maxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing. Enter a numeral with units of KB, MB, etc. - `maxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `path` string — The location for the persistent queue files. To this field's value, the system will append: //inputs/ - `compress` 'none' | 'gzip' — Codec to use to compress the persisted data - `onBackpressure` 'block' | 'drop' — Whether to block or drop events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqControls` object — Management controls for the persistent queue. - `host` string, required — Address to bind on. Defaults to 0.0.0.0 (all addresses). - `port` number, required — Port to listen on - `authTokens` object[] — Shared secrets to be provided by any client (Authorization: ). If empty, unauthorized access is permitted. - `authType` 'manual' | 'secret' — Select Manual to enter an auth token directly, or select Secret to use a text secret to authenticate - `tokenSecret` string — Select or create a stored text secret - `token` string, required — Shared secret to be provided by any client (Authorization: ) - `enabled` boolean — If true, the token is active and can be used for authentication. - `description` string — Optional token description - `allowedIndexesAtToken` string[] — Enter the values you want to allow in the HEC event index field at the token level. Supports wildcards. To skip validation, leave blank. - `metadata` MetadataConfInputCollection[] — Fields to add to events referencing this token - `name` string, required — Name of the metadata field. - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.) - `tls` TlsSettingsServerSideType — TLS settings (server side) - `disabled` boolean — If true, TLS is disabled on this connection. - `requestCert` boolean — Require clients to present their certificates. Used to perform client authentication using SSL certs. - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's) - `commonNameRegex` string — Regex matching allowable common names in peer certificates' subject attribute - `certificateName` string — The name of the predefined certificate - `privKeyPath` string — Path on server containing the private key to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `certPath` string — Path on server containing certificates to use. PEM format. Can reference $ENV_VARS. - `caPath` string — Path on server containing CA certificates to use. PEM format. Can reference $ENV_VARS. - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `maxActiveReq` number — Maximum number of active requests allowed per Worker Process. Set to 0 for unlimited. Caution: Increasing the limit above the default value, or setting it to unlimited, may degrade performance and reduce throughput. - `maxRequestsPerSocket` integer — Maximum number of requests per socket before @{product} instructs the client to close the connection. Default is 0 (unlimited). - `enableProxyHeader` boolean — Extract the client IP and port from PROXY protocol v1/v2. When enabled, the X-Forwarded-For header is ignored. Disable to use the X-Forwarded-For header for client IP extraction. - `captureHeaders` boolean — Add request headers to events, in the __headers field - `activityLogSampleRate` number — How often request activity is logged at the `info` level. A value of 1 would log every request, 10 every 10th request, etc. - `requestTimeout` number — How long to wait for an incoming request to complete before aborting it. Use 0 to disable. - `socketTimeout` number — How long @{product} should wait before assuming that an inactive socket has timed out. To wait forever, set to 0. - `keepAliveTimeout` number — After the last response is sent, @{product} will wait this long for additional data before closing the socket connection. Minimum 1 second, maximum 600 seconds (10 minutes). - `ipAllowlistRegex` string — Messages from matched IP addresses will be processed, unless also matched by the denylist - `ipDenylistRegex` string — Messages from matched IP addresses will be ignored. This takes precedence over the allowlist. - `splunkHecAPI` string, required — Absolute path on which to listen for the Splunk HTTP Event Collector API requests. This input supports the /event, /raw and /s2s endpoints. - `metadata` MetadataConfInputCollection[] — Fields to add to every event. Overrides fields added at the token or request level. See [the Source documentation](https://docs.cribl.io/stream/sources-splunk-hec/#fields) for more info. - `name` string, required — Name of the metadata field. - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.) - `allowedIndexes` string[] — List values allowed in HEC event index field. Leave blank to skip validation. Supports wildcards. The values here can expand index validation at the token level. - `splunkHecAcks` boolean — Enable Splunk HEC acknowledgements - `breakerRulesets` string[] — A list of event-breaking rulesets that will be applied, in order, to the input data stream - `staleChannelFlushMs` number — How long (in milliseconds) the Event Breaker will wait for new data to be sent to a specific channel before flushing the data stream out, as is, to the Pipelines - `useFwdTimezone` boolean — Event Breakers will determine events' time zone from UF-provided metadata, when TZ can't be inferred from the raw event - `dropControlFields` boolean — Drop Splunk control fields such as `crcSalt` and `_savedPort`. If disabled, control fields are stored in the internal field `__ctrlFields`. - `extractMetrics` boolean — Extract and process Splunk-generated metrics as Cribl metrics - `accessControlAllowOrigin` string[] — Optionally, list HTTP origins to which @{product} should send CORS (cross-origin resource sharing) Access-Control-Allow-* headers. Supports wildcards. - `accessControlAllowHeaders` string[] — Optionally, list HTTP headers that @{product} will send to allowed origins as "Access-Control-Allow-Headers" in a CORS preflight response. Use "*" to allow all headers. - `emitTokenMetrics` boolean — Emit per-token (.http.perToken) and summary (.http.summary) request metrics - `description` string — Optional description for this configuration. - `__template_environment` string — Binds 'environment' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'environment' at runtime. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_host` string — Binds 'host' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'host' at runtime. - `__template_port` string — Binds 'port' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'port' at runtime. - `__template_splunkHecAPI` string — Binds 'splunkHecAPI' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'splunkHecAPI' at runtime. - `notifications` Notification[] — Notifications attached to the Source. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Source configuration with optional Notifications and runtime status. - `id` string — Unique ID for this input - `type` 'azure_blob', required — Connector type identifier. - `disabled` boolean — If true, the Source is disabled and will not collect data. - `pipeline` string — Pipeline to process data from this Source before sending it through the Routes - `sendToRoutes` boolean — Select whether to send data to Routes, or directly to Destinations. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `pqEnabled` boolean — Use a disk queue to minimize data loss when connected services block. See [Cribl Docs](https://docs.cribl.io/stream/persistent-queues) for PQ defaults (Cribl-managed Cloud Workers) and configuration options (on-prem and hybrid Workers). - `streamtags` string[] — Metadata tags used for categorization and filtering. - `criblSourceProvenance` InputCollectionOriginDataSourceDiscoveryWithDestinationArnConstraint — Read-only metadata that records how the Source was created. Preserved on update when omitted from the request body. Cannot be set on create. - `origin` 'data_source_discovery' — Feature that created the Source. - `destinationArn` string — ARN of the S3 bucket or Firehose delivery stream configured as the Source. - `sourceArn` string — ARN of the AWS resource that produces the logs. - `connections` ConnectionConfInputCollection[] — Direct connections to Destinations, and optionally via a Pipeline or a Pack - `pipeline` string — Pipeline or Pack to process data before sending to the Destination. - `output` string — Destination to send data to when not using Routes. - `pq` PqType - `mode` 'smart' | 'always' — With Smart mode (deprecated), PQ will write events to the filesystem only when it detects backpressure from the processing engine. Smart mode will have no new development starting July 2026, followed by End of Support and feature removal (auto-migrating to Always On) in January 2027. We recommend using Always On mode instead. With Always On mode, PQ will always write events directly to the queue before forwarding them to the processing engine. - `maxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `maxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use maxBufferSizeBytes instead. - `commitFrequency` number — The number of events to send downstream before committing that Stream has read them - `maxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing. Enter a numeral with units of KB, MB, etc. - `maxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `path` string — The location for the persistent queue files. To this field's value, the system will append: //inputs/ - `compress` 'none' | 'gzip' — Codec to use to compress the persisted data - `onBackpressure` 'block' | 'drop' — Whether to block or drop events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqControls` object — Management controls for the persistent queue. - `queueName` string, required — The storage account queue name blob notifications will be read from. Value must be a JavaScript expression (which can evaluate to a constant value), enclosed in quotes or backticks. Can be evaluated only at initialization time. Example referencing a Global Variable: `myQueue-${C.vars.myVar}` - `fileFilter` string — Regex matching file names to download and process. Defaults to: .* - `visibilityTimeout` number — The duration (in seconds) that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. - `numReceivers` number — How many receiver processes to run. The higher the number, the better the throughput - at the expense of CPU overhead. - `maxMessages` number — The maximum number of messages to return in a poll request. Azure storage queues never returns more messages than this value (however, fewer messages might be returned). Valid values: 1 to 32. - `servicePeriodSecs` number — The duration (in seconds) which pollers should be validated and restarted if exited - `skipOnError` boolean — Skip files that trigger a processing error. Disabled by default, which allows retries after processing errors. - `metadata` MetadataConfInputCollection[] — Fields to add to events from this input - `name` string, required — Name of the metadata field. - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.) - `breakerRulesets` string[] — A list of event-breaking rulesets that will be applied, in order, to the input data stream - `staleChannelFlushMs` number — How long (in milliseconds) the Event Breaker will wait for new data to be sent to a specific channel before flushing the data stream out, as is, to the Pipelines - `parquetChunkSizeMB` number — Maximum file size for each Parquet chunk - `parquetChunkDownloadTimeout` number — The maximum time allowed for downloading a Parquet chunk. Processing will stop if a chunk cannot be downloaded within the time specified. - `authType` 'manual' | 'secret' | 'clientSecret' | 'clientCert' | 'clientAssertion' | 'clientAssertion_rpc' — Authentication method - `description` string — Optional description for this configuration. - `connectionString` string — Enter your Azure Storage account connection string. If left blank, Stream will fall back to env.AZURE_STORAGE_CONNECTION_STRING. - `textSecret` string — Select or create a stored text secret - `storageAccountName` string — The name of your Azure storage account - `tenantId` string — The service principal's tenant ID - `clientId` string — The service principal's client ID - `azureCloud` string — The Azure cloud to use. Defaults to Azure Public Cloud. - `endpointSuffix` string — Endpoint suffix for the service URL. Takes precedence over the Azure Cloud setting. Defaults to core.windows.net. - `clientTextSecret` string — Select or create a stored text secret - `certificate` CertificateTypeAzureBlobAuthTypeClientCert - `certificateName` string, required — The certificate you registered as credentials for your app in the Azure portal - `__template_environment` string — Binds 'environment' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'environment' at runtime. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_queueName` string — Binds 'queueName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'queueName' at runtime. - `__template_connectionString` string — Binds 'connectionString' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'connectionString' at runtime. - `__template_storageAccountName` string — Binds 'storageAccountName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'storageAccountName' at runtime. - `__template_tenantId` string — Binds 'tenantId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tenantId' at runtime. - `__template_clientId` string — Binds 'clientId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientId' at runtime. - `__template_azureCloud` string — Binds 'azureCloud' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'azureCloud' at runtime. - `notifications` Notification[] — Notifications attached to the Source. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Source configuration with optional Notifications and runtime status. - `id` string — Unique ID for this input - `type` 'elastic', required — Source type identifier. - `disabled` boolean — If true, the Source is disabled and will not collect data. - `pipeline` string — Pipeline to process data from this Source before sending it through the Routes - `sendToRoutes` boolean — Select whether to send data to Routes, or directly to Destinations. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `pqEnabled` boolean — Use a disk queue to minimize data loss when connected services block. See [Cribl Docs](https://docs.cribl.io/stream/persistent-queues) for PQ defaults (Cribl-managed Cloud Workers) and configuration options (on-prem and hybrid Workers). - `streamtags` string[] — Metadata tags used for categorization and filtering. - `criblSourceProvenance` InputCollectionOriginDataSourceDiscoveryWithDestinationArnConstraint — Read-only metadata that records how the Source was created. Preserved on update when omitted from the request body. Cannot be set on create. - `origin` 'data_source_discovery' — Feature that created the Source. - `destinationArn` string — ARN of the S3 bucket or Firehose delivery stream configured as the Source. - `sourceArn` string — ARN of the AWS resource that produces the logs. - `connections` ConnectionConfInputCollection[] — Direct connections to Destinations, and optionally via a Pipeline or a Pack - `pipeline` string — Pipeline or Pack to process data before sending to the Destination. - `output` string — Destination to send data to when not using Routes. - `pq` PqType - `mode` 'smart' | 'always' — With Smart mode (deprecated), PQ will write events to the filesystem only when it detects backpressure from the processing engine. Smart mode will have no new development starting July 2026, followed by End of Support and feature removal (auto-migrating to Always On) in January 2027. We recommend using Always On mode instead. With Always On mode, PQ will always write events directly to the queue before forwarding them to the processing engine. - `maxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `maxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use maxBufferSizeBytes instead. - `commitFrequency` number — The number of events to send downstream before committing that Stream has read them - `maxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing. Enter a numeral with units of KB, MB, etc. - `maxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `path` string — The location for the persistent queue files. To this field's value, the system will append: //inputs/ - `compress` 'none' | 'gzip' — Codec to use to compress the persisted data - `onBackpressure` 'block' | 'drop' — Whether to block or drop events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqControls` object — Management controls for the persistent queue. - `host` string, required — Address to bind on. Defaults to 0.0.0.0 (all addresses). - `port` number, required — Port to listen on - `tls` TlsSettingsServerSideType — TLS settings (server side) - `disabled` boolean — If true, TLS is disabled on this connection. - `requestCert` boolean — Require clients to present their certificates. Used to perform client authentication using SSL certs. - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's) - `commonNameRegex` string — Regex matching allowable common names in peer certificates' subject attribute - `certificateName` string — The name of the predefined certificate - `privKeyPath` string — Path on server containing the private key to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `certPath` string — Path on server containing certificates to use. PEM format. Can reference $ENV_VARS. - `caPath` string — Path on server containing CA certificates to use. PEM format. Can reference $ENV_VARS. - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `maxActiveReq` number — Maximum number of active requests allowed per Worker Process. Set to 0 for unlimited. Caution: Increasing the limit above the default value, or setting it to unlimited, may degrade performance and reduce throughput. - `maxRequestsPerSocket` integer — Maximum number of requests per socket before @{product} instructs the client to close the connection. Default is 0 (unlimited). - `enableProxyHeader` boolean — Extract the client IP and port from PROXY protocol v1/v2. When enabled, the X-Forwarded-For header is ignored. Disable to use the X-Forwarded-For header for client IP extraction. - `captureHeaders` boolean — Add request headers to events, in the __headers field - `activityLogSampleRate` number — How often request activity is logged at the `info` level. A value of 1 would log every request, 10 every 10th request, etc. - `requestTimeout` number — How long to wait for an incoming request to complete before aborting it. Use 0 to disable. - `socketTimeout` number — How long @{product} should wait before assuming that an inactive socket has timed out. To wait forever, set to 0. - `keepAliveTimeout` number — After the last response is sent, @{product} will wait this long for additional data before closing the socket connection. Minimum 1 second, maximum 600 seconds (10 minutes). - `enableHealthCheck` boolean — Expose the /cribl_health endpoint, which returns 200 OK when this Source is healthy - `ipAllowlistRegex` string — Messages from matched IP addresses will be processed, unless also matched by the denylist - `ipDenylistRegex` string — Messages from matched IP addresses will be ignored. This takes precedence over the allowlist. - `elasticAPI` string, required — Absolute path on which to listen for Elasticsearch API requests. Defaults to /. _bulk will be appended automatically. For example, /myPath becomes /myPath/_bulk. Requests can then be made to either /myPath/_bulk or /myPath//_bulk. Other entries are faked as success. - `authType` 'none' | 'basic' | 'credentialsSecret' | 'authTokens' — Authentication type - `apiVersion` '6.8.4' | '8.3.2' | 'custom' — The API version to use for communicating with the server - `extraHttpHeaders` ExtraHttpHeaderConfInputElastic[] — Headers to add to all events - `name` string — Field Name - `value` string, required — Field Value - `metadata` MetadataConfInputCollection[] — Fields to add to events from this input - `name` string, required — Name of the metadata field. - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.) - `proxyMode` object - `enabled` boolean, required — Enable proxying of non-bulk API requests to an external Elastic server. Enable this only if you understand the implications. See [Cribl Docs](https://docs.cribl.io/stream/sources-elastic/#proxy-mode) for more details. - `authType` 'none' | 'manual' | 'secret' — Enter credentials directly, or select a stored secret - `username` string — Username - `password` string — Password - `credentialsSecret` string — Select or create a secret that references your credentials - `url` string — URL of the Elastic server to proxy non-bulk requests to, such as http://elastic:9200 - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates) - `removeHeaders` string[] — List of headers to remove from the request to proxy - `timeoutSec` number — Amount of time, in seconds, to wait for a proxy request to complete before canceling it - `__template_url` string — Binds 'url' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'url' at runtime. - `description` string — Optional description for this configuration. - `username` string — Username - `password` string — Password - `credentialsSecret` string — Select or create a secret that references your credentials - `authTokens` string[] — Bearer tokens to include in the authorization header - `customAPIVersion` string — Custom version information to respond to requests - `__template_environment` string — Binds 'environment' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'environment' at runtime. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_host` string — Binds 'host' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'host' at runtime. - `__template_port` string — Binds 'port' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'port' at runtime. - `__template_elasticAPI` string — Binds 'elasticAPI' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'elasticAPI' at runtime. - `__template_authTokens` string — Binds 'authTokens' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'authTokens' at runtime. - `notifications` Notification[] — Notifications attached to the Source. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Source configuration with optional Notifications and runtime status. - `id` string — Unique ID for this input - `type` 'confluent_cloud', required — Connector type identifier. - `disabled` boolean — If true, the Source is disabled and will not collect data. - `pipeline` string — Pipeline to process data from this Source before sending it through the Routes - `sendToRoutes` boolean — Select whether to send data to Routes, or directly to Destinations. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `pqEnabled` boolean — Use a disk queue to minimize data loss when connected services block. See [Cribl Docs](https://docs.cribl.io/stream/persistent-queues) for PQ defaults (Cribl-managed Cloud Workers) and configuration options (on-prem and hybrid Workers). - `streamtags` string[] — Metadata tags used for categorization and filtering. - `criblSourceProvenance` InputCollectionOriginDataSourceDiscoveryWithDestinationArnConstraint — Read-only metadata that records how the Source was created. Preserved on update when omitted from the request body. Cannot be set on create. - `origin` 'data_source_discovery' — Feature that created the Source. - `destinationArn` string — ARN of the S3 bucket or Firehose delivery stream configured as the Source. - `sourceArn` string — ARN of the AWS resource that produces the logs. - `connections` ConnectionConfInputCollection[] — Direct connections to Destinations, and optionally via a Pipeline or a Pack - `pipeline` string — Pipeline or Pack to process data before sending to the Destination. - `output` string — Destination to send data to when not using Routes. - `pq` PqType - `mode` 'smart' | 'always' — With Smart mode (deprecated), PQ will write events to the filesystem only when it detects backpressure from the processing engine. Smart mode will have no new development starting July 2026, followed by End of Support and feature removal (auto-migrating to Always On) in January 2027. We recommend using Always On mode instead. With Always On mode, PQ will always write events directly to the queue before forwarding them to the processing engine. - `maxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `maxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use maxBufferSizeBytes instead. - `commitFrequency` number — The number of events to send downstream before committing that Stream has read them - `maxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing. Enter a numeral with units of KB, MB, etc. - `maxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `path` string — The location for the persistent queue files. To this field's value, the system will append: //inputs/ - `compress` 'none' | 'gzip' — Codec to use to compress the persisted data - `onBackpressure` 'block' | 'drop' — Whether to block or drop events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqControls` object — Management controls for the persistent queue. - `brokers` string[], required — List of Confluent Cloud bootstrap servers to use, such as yourAccount.confluent.cloud:9092 - `tls` TlsSettingsClientSideTypeCaPathCertPath — TLS settings (client side) - `disabled` boolean — Disabled - `rejectUnauthorized` boolean — Reject certificates that are not authorized by a CA in the CA certificate path, or by another trusted CA (such as the system's). Defaults to Enabled. Overrides the toggle from Advanced Settings, when also present. - `servername` string — Server name for the SNI (Server Name Indication) TLS extension. It must be a host name, and not an IP address. - `certificateName` string — The name of the predefined certificate - `caPath` string — Path on client in which to find CA certificates to verify the server's cert. PEM format. Can reference $ENV_VARS. - `privKeyPath` string — Path on client in which to find the private key to use. PEM format. Can reference $ENV_VARS. - `certPath` string — Path on client in which to find certificates to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `topics` string[], required — Topic to subscribe to. Warning: To optimize performance, Cribl suggests subscribing each Kafka Source to a single topic only. - `groupId` string — The consumer group to which this instance belongs. Defaults to 'Cribl'. - `fromBeginning` boolean — Leave enabled if you want the Source, upon first subscribing to a topic, to read starting with the earliest available message - `kafkaSchemaRegistry` KafkaSchemaRegistryAuthenticationType — Kafka Schema Registry Authentication - `disabled` boolean, required — Disabled - `schemaRegistryURL` string — URL for accessing the Confluent Schema Registry. Example: http://localhost:8081. To connect over TLS, use https instead of http. - `connectionTimeout` number — Maximum time to wait for a Schema Registry connection to complete successfully - `requestTimeout` number — Maximum time to wait for the Schema Registry to respond to a request - `maxRetries` number — Maximum number of times to try fetching schemas from the Schema Registry - `auth` AuthType — Credentials to use when authenticating with the schema registry - `disabled` boolean, required — Disabled - `oauthEnabled` boolean — Authenticate with the schema registry using OAuth instead of basic HTTP authentication - `tokenUrl` string — URL of the token endpoint to use for OAuth authentication - `clientId` string — Client ID to use for OAuth authentication - `oauthSecretType` string - `clientTextSecret` string — Select or create a stored text secret - `oauthParams` OauthParamConfInputKafka[] — Additional fields to send to the token endpoint, such as scope or audience - … - `identityPoolId` string — Confluent Cloud identity pool ID. Sent as the `Confluent-Identity-Pool-Id` header on requests to the schema registry. - `logicalCluster` string — Confluent Cloud Schema Registry logical cluster ID. Sent as the `target-sr-cluster` header on requests to the schema registry. - `credentialsSecret` string — Select or create a secret that references your credentials - `__template_tokenUrl` string — Binds 'tokenUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenUrl' at runtime. - `__template_clientId` string — Binds 'clientId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientId' at runtime. - `__template_identityPoolId` string — Binds 'identityPoolId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'identityPoolId' at runtime. - `__template_logicalCluster` string — Binds 'logicalCluster' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'logicalCluster' at runtime. - `tls` TlsSettingsClientSideTypeCaPathCertPath — TLS settings (client side) - `disabled` boolean — Disabled - `rejectUnauthorized` boolean — Reject certificates that are not authorized by a CA in the CA certificate path, or by another trusted CA (such as the system's). Defaults to Enabled. Overrides the toggle from Advanced Settings, when also present. - `servername` string — Server name for the SNI (Server Name Indication) TLS extension. It must be a host name, and not an IP address. - `certificateName` string — The name of the predefined certificate - `caPath` string — Path on client in which to find CA certificates to verify the server's cert. PEM format. Can reference $ENV_VARS. - `privKeyPath` string — Path on client in which to find the private key to use. PEM format. Can reference $ENV_VARS. - `certPath` string — Path on client in which to find certificates to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `__template_schemaRegistryURL` string — Binds 'schemaRegistryURL' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'schemaRegistryURL' at runtime. - `connectionTimeout` number — Maximum time to wait for a connection to complete successfully - `requestTimeout` number — Maximum time to wait for Kafka to respond to a request - `maxRetries` number — If messages are failing, you can set the maximum number of retries as high as 100 to prevent loss of data - `maxBackOff` number — The maximum wait time for a retry, in milliseconds. Default (and minimum) is 30,000 ms (30 seconds); maximum is 180,000 ms (180 seconds). - `initialBackoff` number — Initial value used to calculate the retry, in milliseconds. Maximum is 600,000 ms (10 minutes). - `backoffRate` number — Set the backoff multiplier (2-20) to control the retry frequency for failed messages. For faster retries, use a lower multiplier. For slower retries with more delay between attempts, use a higher multiplier. The multiplier is used in an exponential backoff formula; see the Kafka [documentation](https://kafka.js.org/docs/retry-detailed) for details. - `authenticationTimeout` number — Maximum time to wait for Kafka to respond to an authentication request - `reauthenticationThreshold` number — Specifies a time window during which @{product} can reauthenticate if needed. Creates the window measuring backward from the moment when credentials are set to expire. - `sasl` AuthenticationType — Authentication parameters to use when connecting to brokers. Using TLS is highly recommended. - `disabled` boolean, required — Disabled - `username` string — Username - `password` string — Password - `authType` 'manual' | 'secret' — Enter credentials directly, or select a stored secret - `credentialsSecret` string — Select or create a secret that references your credentials - `mechanism` 'plain' | 'scram-sha-256' | 'scram-sha-512' | 'kerberos' — SASL mechanism - `keytabLocation` string — Location of keytab file for authentication principal - `principal` string — Authentication principal, such as `kafka_user@example.com` - `brokerServiceClass` string — Kerberos service class for Kafka brokers, such as `kafka` - `oauthEnabled` boolean — Enable OAuth authentication - `tokenUrl` string — URL of the token endpoint to use for OAuth authentication - `clientId` string — Client ID to use for OAuth authentication - `oauthSecretType` string - `clientTextSecret` string — Select or create a stored text secret - `oauthParams` OauthParamConfInputKafka[] — Additional fields to send to the token endpoint, such as scope or audience - `name` string, required — Parameter Name - `value` string, required — Parameter Value - `saslExtensions` SaslExtensionConfInputKafka[] — Additional SASL extension fields, such as Confluent's logicalCluster or identityPoolId - `name` string, required — Field Name - `value` string, required — Field Value - `__template_mechanism` string — Binds 'mechanism' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'mechanism' at runtime. - `__template_keytabLocation` string — Binds 'keytabLocation' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'keytabLocation' at runtime. - `__template_principal` string — Binds 'principal' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'principal' at runtime. - `__template_brokerServiceClass` string — Binds 'brokerServiceClass' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'brokerServiceClass' at runtime. - `__template_tokenUrl` string — Binds 'tokenUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenUrl' at runtime. - `__template_clientId` string — Binds 'clientId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientId' at runtime. - `sessionTimeout` number — Timeout used to detect client failures when using Kafka's group-management facilities. If the client sends no heartbeats to the broker before the timeout expires, the broker will remove the client from the group and initiate a rebalance. Value must be between the broker's configured group.min.session.timeout.ms and group.max.session.timeout.ms. See [Kafka's documentation](https://kafka.apache.org/documentation/#consumerconfigs_session.timeout.ms) for details. - `rebalanceTimeout` number — Maximum allowed time for each worker to join the group after a rebalance begins. If the timeout is exceeded, the coordinator broker will remove the worker from the group. See [Kafka's documentation](https://kafka.apache.org/documentation/#connectconfigs_rebalance.timeout.ms) for details. - `heartbeatInterval` number — Expected time between heartbeats to the consumer coordinator when using Kafka's group-management facilities. Value must be lower than sessionTimeout and typically should not exceed 1/3 of the sessionTimeout value. See [Kafka's documentation](https://kafka.apache.org/documentation/#consumerconfigs_heartbeat.interval.ms) for details. - `autoCommitInterval` number — How often to commit offsets. If both this and Offset commit threshold are set, @{product} commits offsets when either condition is met. If both are empty, @{product} commits offsets after each batch. - `autoCommitThreshold` number — How many events are needed to trigger an offset commit. If both this and Offset commit interval are set, @{product} commits offsets when either condition is met. If both are empty, @{product} commits offsets after each batch. - `maxBytesPerPartition` number — Maximum amount of data that Kafka will return per partition, per fetch request. Must equal or exceed the maximum message size (maxBytesPerPartition) that Kafka is configured to allow. Otherwise, @{product} can get stuck trying to retrieve messages. Defaults to 1048576 (1 MB). - `maxBytes` number — Maximum number of bytes that Kafka will return per fetch request. Defaults to 10485760 (10 MB). - `maxSocketErrors` number — Maximum number of network errors before the consumer re-creates a socket - `metadata` MetadataConfInputCollection[] — Fields to add to events from this input - `name` string, required — Name of the metadata field. - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.) - `description` string — Optional description for this configuration. - `__template_environment` string — Binds 'environment' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'environment' at runtime. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_brokers` string — Binds 'brokers' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'brokers' at runtime. - `__template_topics` string — Binds 'topics' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'topics' at runtime. - `__template_groupId` string — Binds 'groupId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'groupId' at runtime. - `notifications` Notification[] — Notifications attached to the Source. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - union - unknown - unknown - object — Source configuration with optional Notifications and runtime status. - `id` string — Unique ID for this input - `type` 'loki', required — Source type identifier. - `disabled` boolean — If true, the Source is disabled and will not collect data. - `pipeline` string — Pipeline to process data from this Source before sending it through the Routes - `sendToRoutes` boolean — Select whether to send data to Routes, or directly to Destinations. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `pqEnabled` boolean — Use a disk queue to minimize data loss when connected services block. See [Cribl Docs](https://docs.cribl.io/stream/persistent-queues) for PQ defaults (Cribl-managed Cloud Workers) and configuration options (on-prem and hybrid Workers). - `streamtags` string[] — Metadata tags used for categorization and filtering. - `criblSourceProvenance` InputCollectionOriginDataSourceDiscoveryWithDestinationArnConstraint — Read-only metadata that records how the Source was created. Preserved on update when omitted from the request body. Cannot be set on create. - `origin` 'data_source_discovery' — Feature that created the Source. - `destinationArn` string — ARN of the S3 bucket or Firehose delivery stream configured as the Source. - `sourceArn` string — ARN of the AWS resource that produces the logs. - `connections` ConnectionConfInputCollection[] — Direct connections to Destinations, and optionally via a Pipeline or a Pack - `pipeline` string — Pipeline or Pack to process data before sending to the Destination. - `output` string — Destination to send data to when not using Routes. - `pq` PqType - `mode` 'smart' | 'always' — With Smart mode (deprecated), PQ will write events to the filesystem only when it detects backpressure from the processing engine. Smart mode will have no new development starting July 2026, followed by End of Support and feature removal (auto-migrating to Always On) in January 2027. We recommend using Always On mode instead. With Always On mode, PQ will always write events directly to the queue before forwarding them to the processing engine. - `maxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `maxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use maxBufferSizeBytes instead. - `commitFrequency` number — The number of events to send downstream before committing that Stream has read them - `maxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing. Enter a numeral with units of KB, MB, etc. - `maxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `path` string — The location for the persistent queue files. To this field's value, the system will append: //inputs/ - `compress` 'none' | 'gzip' — Codec to use to compress the persisted data - `onBackpressure` 'block' | 'drop' — Whether to block or drop events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqControls` object — Management controls for the persistent queue. - `host` string, required — Address to bind on. Defaults to 0.0.0.0 (all addresses). - `port` number, required — Port to listen on - `tls` TlsSettingsServerSideType — TLS settings (server side) - `disabled` boolean — If true, TLS is disabled on this connection. - `requestCert` boolean — Require clients to present their certificates. Used to perform client authentication using SSL certs. - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's) - `commonNameRegex` string — Regex matching allowable common names in peer certificates' subject attribute - `certificateName` string — The name of the predefined certificate - `privKeyPath` string — Path on server containing the private key to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `certPath` string — Path on server containing certificates to use. PEM format. Can reference $ENV_VARS. - `caPath` string — Path on server containing CA certificates to use. PEM format. Can reference $ENV_VARS. - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `maxActiveReq` number — Maximum number of active requests allowed per Worker Process. Set to 0 for unlimited. Caution: Increasing the limit above the default value, or setting it to unlimited, may degrade performance and reduce throughput. - `maxRequestsPerSocket` integer — Maximum number of requests per socket before @{product} instructs the client to close the connection. Default is 0 (unlimited). - `enableProxyHeader` boolean — Extract the client IP and port from PROXY protocol v1/v2. When enabled, the X-Forwarded-For header is ignored. Disable to use the X-Forwarded-For header for client IP extraction. - `captureHeaders` boolean — Add request headers to events, in the __headers field - `activityLogSampleRate` number — How often request activity is logged at the `info` level. A value of 1 would log every request, 10 every 10th request, etc. - `requestTimeout` number — How long to wait for an incoming request to complete before aborting it. Use 0 to disable. - `socketTimeout` number — How long @{product} should wait before assuming that an inactive socket has timed out. To wait forever, set to 0. - `keepAliveTimeout` number — After the last response is sent, @{product} will wait this long for additional data before closing the socket connection. Minimum 1 second, maximum 600 seconds (10 minutes). - `enableHealthCheck` boolean — Expose the /cribl_health endpoint, which returns 200 OK when this Source is healthy - `ipAllowlistRegex` string — Messages from matched IP addresses will be processed, unless also matched by the denylist - `ipDenylistRegex` string — Messages from matched IP addresses will be ignored. This takes precedence over the allowlist. - `lokiAPI` string, required — Absolute path on which to listen for Loki logs requests. Defaults to /loki/api/v1/push, which will (in this example) expand as: 'http://:/loki/api/v1/push'. - `authType` 'none' | 'basic' | 'credentialsSecret' | 'token' | 'textSecret' — Loki logs authentication type - `metadata` MetadataConfInputCollection[] — Fields to add to events from this input - `name` string, required — Name of the metadata field. - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.) - `description` string — Optional description for this configuration. - `username` string — Username - `password` string — Password - `token` string — Bearer token to include in the authorization header - `credentialsSecret` string — Select or create a secret that references your credentials - `textSecret` string — Select or create a stored text secret - `__template_environment` string — Binds 'environment' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'environment' at runtime. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_host` string — Binds 'host' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'host' at runtime. - `__template_port` string — Binds 'port' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'port' at runtime. - `__template_lokiAPI` string — Binds 'lokiAPI' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'lokiAPI' at runtime. - `notifications` Notification[] — Notifications attached to the Source. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Source configuration with optional Notifications and runtime status. - `id` string — Unique ID for this input - `type` 'prometheus_rw', required — Source type identifier. - `disabled` boolean — If true, the Source is disabled and will not collect data. - `pipeline` string — Pipeline to process data from this Source before sending it through the Routes - `sendToRoutes` boolean — Select whether to send data to Routes, or directly to Destinations. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `pqEnabled` boolean — Use a disk queue to minimize data loss when connected services block. See [Cribl Docs](https://docs.cribl.io/stream/persistent-queues) for PQ defaults (Cribl-managed Cloud Workers) and configuration options (on-prem and hybrid Workers). - `streamtags` string[] — Metadata tags used for categorization and filtering. - `criblSourceProvenance` InputCollectionOriginDataSourceDiscoveryWithDestinationArnConstraint — Read-only metadata that records how the Source was created. Preserved on update when omitted from the request body. Cannot be set on create. - `origin` 'data_source_discovery' — Feature that created the Source. - `destinationArn` string — ARN of the S3 bucket or Firehose delivery stream configured as the Source. - `sourceArn` string — ARN of the AWS resource that produces the logs. - `connections` ConnectionConfInputCollection[] — Direct connections to Destinations, and optionally via a Pipeline or a Pack - `pipeline` string — Pipeline or Pack to process data before sending to the Destination. - `output` string — Destination to send data to when not using Routes. - `pq` PqType - `mode` 'smart' | 'always' — With Smart mode (deprecated), PQ will write events to the filesystem only when it detects backpressure from the processing engine. Smart mode will have no new development starting July 2026, followed by End of Support and feature removal (auto-migrating to Always On) in January 2027. We recommend using Always On mode instead. With Always On mode, PQ will always write events directly to the queue before forwarding them to the processing engine. - `maxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `maxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use maxBufferSizeBytes instead. - `commitFrequency` number — The number of events to send downstream before committing that Stream has read them - `maxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing. Enter a numeral with units of KB, MB, etc. - `maxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `path` string — The location for the persistent queue files. To this field's value, the system will append: //inputs/ - `compress` 'none' | 'gzip' — Codec to use to compress the persisted data - `onBackpressure` 'block' | 'drop' — Whether to block or drop events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqControls` object — Management controls for the persistent queue. - `host` string, required — Address to bind on. Defaults to 0.0.0.0 (all addresses). - `port` number, required — Port to listen on - `tls` TlsSettingsServerSideType — TLS settings (server side) - `disabled` boolean — If true, TLS is disabled on this connection. - `requestCert` boolean — Require clients to present their certificates. Used to perform client authentication using SSL certs. - `rejectUnauthorized` boolean — Reject certificates not authorized by a CA in the CA certificate path or by another trusted CA (such as the system's) - `commonNameRegex` string — Regex matching allowable common names in peer certificates' subject attribute - `certificateName` string — The name of the predefined certificate - `privKeyPath` string — Path on server containing the private key to use. PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt private key - `certPath` string — Path on server containing certificates to use. PEM format. Can reference $ENV_VARS. - `caPath` string — Path on server containing CA certificates to use. PEM format. Can reference $ENV_VARS. - `minVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Minimum TLS version - `maxVersion` 'TLSv1' | 'TLSv1.1' | 'TLSv1.2' | 'TLSv1.3' — Maximum TLS version - `maxActiveReq` number — Maximum number of active requests allowed per Worker Process. Set to 0 for unlimited. Caution: Increasing the limit above the default value, or setting it to unlimited, may degrade performance and reduce throughput. - `maxRequestsPerSocket` integer — Maximum number of requests per socket before @{product} instructs the client to close the connection. Default is 0 (unlimited). - `enableProxyHeader` boolean — Extract the client IP and port from PROXY protocol v1/v2. When enabled, the X-Forwarded-For header is ignored. Disable to use the X-Forwarded-For header for client IP extraction. - `captureHeaders` boolean — Add request headers to events, in the __headers field - `activityLogSampleRate` number — How often request activity is logged at the `info` level. A value of 1 would log every request, 10 every 10th request, etc. - `requestTimeout` number — How long to wait for an incoming request to complete before aborting it. Use 0 to disable. - `socketTimeout` number — How long @{product} should wait before assuming that an inactive socket has timed out. To wait forever, set to 0. - `keepAliveTimeout` number — After the last response is sent, @{product} will wait this long for additional data before closing the socket connection. Minimum 1 second, maximum 600 seconds (10 minutes). - `enableHealthCheck` boolean — Expose the /cribl_health endpoint, which returns 200 OK when this Source is healthy - `ipAllowlistRegex` string — Messages from matched IP addresses will be processed, unless also matched by the denylist - `ipDenylistRegex` string — Messages from matched IP addresses will be ignored. This takes precedence over the allowlist. - `prometheusAPI` string, required — Absolute path on which to listen for Prometheus requests. Defaults to /write, which will expand as: http://:/write. - `authType` 'none' | 'basic' | 'credentialsSecret' | 'token' | 'textSecret' — Remote Write authentication type - `metadata` MetadataConfInputCollection[] — Fields to add to events from this input - `name` string, required — Name of the metadata field. - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.) - `description` string — Optional description for this configuration. - `username` string — Username - `password` string — Password - `token` string — Bearer token to include in the authorization header - `credentialsSecret` string — Select or create a secret that references your credentials - `textSecret` string — Select or create a stored text secret - `__template_environment` string — Binds 'environment' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'environment' at runtime. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_host` string — Binds 'host' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'host' at runtime. - `__template_port` string — Binds 'port' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'port' at runtime. - `__template_prometheusAPI` string — Binds 'prometheusAPI' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'prometheusAPI' at runtime. - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime. - `notifications` Notification[] — Notifications attached to the Source. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Source configuration with optional Notifications and runtime status. - `id` string — Unique ID for this input - `type` 'prometheus', required — Connector type identifier. - `disabled` boolean — If true, the Source is disabled and will not collect data. - `pipeline` string — Pipeline to process data from this Source before sending it through the Routes - `sendToRoutes` boolean — Select whether to send data to Routes, or directly to Destinations. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `pqEnabled` boolean — Use a disk queue to minimize data loss when connected services block. See [Cribl Docs](https://docs.cribl.io/stream/persistent-queues) for PQ defaults (Cribl-managed Cloud Workers) and configuration options (on-prem and hybrid Workers). - `streamtags` string[] — Metadata tags used for categorization and filtering. - `criblSourceProvenance` InputCollectionOriginDataSourceDiscoveryWithDestinationArnConstraint — Read-only metadata that records how the Source was created. Preserved on update when omitted from the request body. Cannot be set on create. - `origin` 'data_source_discovery' — Feature that created the Source. - `destinationArn` string — ARN of the S3 bucket or Firehose delivery stream configured as the Source. - `sourceArn` string — ARN of the AWS resource that produces the logs. - `connections` ConnectionConfInputCollection[] — Direct connections to Destinations, and optionally via a Pipeline or a Pack - `pipeline` string — Pipeline or Pack to process data before sending to the Destination. - `output` string — Destination to send data to when not using Routes. - `pq` PqType - `mode` 'smart' | 'always' — With Smart mode (deprecated), PQ will write events to the filesystem only when it detects backpressure from the processing engine. Smart mode will have no new development starting July 2026, followed by End of Support and feature removal (auto-migrating to Always On) in January 2027. We recommend using Always On mode instead. With Always On mode, PQ will always write events directly to the queue before forwarding them to the processing engine. - `maxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `maxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use maxBufferSizeBytes instead. - `commitFrequency` number — The number of events to send downstream before committing that Stream has read them - `maxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing. Enter a numeral with units of KB, MB, etc. - `maxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `path` string — The location for the persistent queue files. To this field's value, the system will append: //inputs/ - `compress` 'none' | 'gzip' — Codec to use to compress the persisted data - `onBackpressure` 'block' | 'drop' — Whether to block or drop events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqControls` object — Management controls for the persistent queue. - `dimensionList` string[] — Other dimensions to include in events - `fieldPerMetric` boolean — When enabled, each metric name is used as the event field key (example: go_threads: 9) instead of the default _metric/_value format. - `discoveryType` 'static' | 'dns' | 'ec2' | 'http_sd' — Target discovery mechanism. Use static to manually enter a list of targets. - `interval` number, required — How often, in minutes, to scrape targets for metrics. Maximum of 60 minutes. 60 must be evenly divisible by the value you enter. - `logLevel` 'error' | 'warn' | 'info' | 'debug', required — Collector runtime log level - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA, such as self-signed certificates - `timeout` number — Time, in seconds, before aborting HTTP connection attempts; use 0 for no timeout - `keepAliveTime` number — How often workers should check in with the scheduler to keep job subscription alive - `jobTimeout` string — Maximum time the job is allowed to run (e.g., 30, 45s or 15m). Units are seconds, if not specified. Enter 0 for unlimited time. - `maxMissedKeepAlives` number — The number of Keep Alive Time periods before an inactive worker will have its job subscription revoked. - `ttl` string — Time to keep the job's artifacts on disk after job completion. This also affects how long a job is listed in the Job Inspector. - `ignoreGroupJobsLimit` boolean — When enabled, this job's artifacts are not counted toward the Worker Group's finished job artifacts limit. Artifacts will be removed only after the Collector's configured time to live. - `metadata` MetadataConfInputCollection[] — Fields to add to events from this input - `name` string, required — Name of the metadata field. - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.) - `authType` 'manual' | 'secret' — Enter credentials directly, or select a stored secret - `description` string — Optional description for this configuration. - `targetList` string[] — List of Prometheus targets to pull metrics from. Values can be in URL or host[:port] format. For example: http://localhost:9090/metrics, localhost:9090, or localhost. In cases where just host[:port] is specified, the endpoint will resolve to 'http://host[:port]/metrics'. - `recordType` 'SRV' | 'A' | 'AAAA' — DNS record type to resolve - `scrapePort` number — The port number in the metrics URL for discovered targets - `nameList` string[] — List of DNS names to resolve - `scrapeProtocol` 'http' | 'https' — Protocol to use when collecting metrics - `scrapePath` string — Path to use when collecting metrics from discovered targets - `awsAuthenticationMethod` 'auto' | 'manual' | 'secret' — AWS authentication method. Choose Auto to use IAM roles. - `awsApiKey` string — Access key - `awsSecret` string — Select or create a stored secret that references your access key and secret key - `usePublicIp` boolean — Use public IP address for discovered targets. Disable to use the private IP address. - `searchFilter` SearchFilterConfInputPrometheus[] — Filter to apply when searching for EC2 instances - `Name` string, required — See https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html for information. Attributes can be manually entered if not present in the list. - `Values` string[], required — Values to match within this row's attribute. If empty, search will return only running EC2 instances. - `awsSecretKey` string — Secret key - `region` string — Region where the EC2 is located - `endpoint` string — EC2 service endpoint. If empty, defaults to the AWS Region-specific endpoint. Otherwise, it must point to EC2-compatible endpoint. - `reuseConnections` boolean — Reuse connections between requests, which can improve performance - `enableAssumeRole` boolean — Use Assume Role credentials to access EC2 - `assumeRoleArn` string — Amazon Resource Name (ARN) of the role to assume - `assumeRoleExternalId` string — External ID to use when assuming role - `durationSeconds` number — Duration of the assumed role's session, in seconds. Minimum is 900 (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12 hours). - `httpDiscoveryUrl` string — URL to fetch target groups from (must be http or https) - `httpDiscoveryHeaders` RefreshRequestParamConfHealthCheckAuthenticationOauthSecret[] — Extra headers to send with the discovery request - `name` string, required — Name - `value` string, required — Value - `httpDiscoveryRejectUnauthorized` boolean — Reject TLS certificates that cannot be verified for the discovery endpoint. Falls back to the source-level setting if not specified. - `maxResponseBodySize` string — Maximum size of the HTTP SD response body. Responses exceeding this limit will be rejected. Defaults to 20 MB. - `username` string — Username for Prometheus Basic authentication - `password` string — Password for Prometheus Basic authentication - `credentialsSecret` string — Select or create a secret that references your credentials - `__template_environment` string — Binds 'environment' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'environment' at runtime. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_dimensionList` string — Binds 'dimensionList' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'dimensionList' at runtime. - `__template_discoveryType` string — Binds 'discoveryType' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'discoveryType' at runtime. - `__template_logLevel` string — Binds 'logLevel' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'logLevel' at runtime. - `__template_targetList` string — Binds 'targetList' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'targetList' at runtime. - `__template_nameList` string — Binds 'nameList' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'nameList' at runtime. - `__template_awsApiKey` string — Binds 'awsApiKey' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'awsApiKey' at runtime. - `__template_awsSecretKey` string — Binds 'awsSecretKey' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'awsSecretKey' at runtime. - `__template_region` string — Binds 'region' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'region' at runtime. - `__template_endpoint` string — Binds 'endpoint' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'endpoint' at runtime. - `__template_assumeRoleArn` string — Binds 'assumeRoleArn' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'assumeRoleArn' at runtime. - `__template_assumeRoleExternalId` string — Binds 'assumeRoleExternalId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'assumeRoleExternalId' at runtime. - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime. - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime. - `notifications` Notification[] — Notifications attached to the Source. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Source configuration with optional Notifications and runtime status. - `id` string — Unique ID for this input - `type` 'edge_prometheus', required — Connector type identifier. - `disabled` boolean — If true, the Source is disabled and will not collect data. - `pipeline` string — Pipeline to process data from this Source before sending it through the Routes - `sendToRoutes` boolean — Select whether to send data to Routes, or directly to Destinations. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `pqEnabled` boolean — Use a disk queue to minimize data loss when connected services block. See [Cribl Docs](https://docs.cribl.io/stream/persistent-queues) for PQ defaults (Cribl-managed Cloud Workers) and configuration options (on-prem and hybrid Workers). - `streamtags` string[] — Metadata tags used for categorization and filtering. - `criblSourceProvenance` InputCollectionOriginDataSourceDiscoveryWithDestinationArnConstraint — Read-only metadata that records how the Source was created. Preserved on update when omitted from the request body. Cannot be set on create. - `origin` 'data_source_discovery' — Feature that created the Source. - `destinationArn` string — ARN of the S3 bucket or Firehose delivery stream configured as the Source. - `sourceArn` string — ARN of the AWS resource that produces the logs. - `connections` ConnectionConfInputCollection[] — Direct connections to Destinations, and optionally via a Pipeline or a Pack - `pipeline` string — Pipeline or Pack to process data before sending to the Destination. - `output` string — Destination to send data to when not using Routes. - `pq` PqType - `mode` 'smart' | 'always' — With Smart mode (deprecated), PQ will write events to the filesystem only when it detects backpressure from the processing engine. Smart mode will have no new development starting July 2026, followed by End of Support and feature removal (auto-migrating to Always On) in January 2027. We recommend using Always On mode instead. With Always On mode, PQ will always write events directly to the queue before forwarding them to the processing engine. - `maxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `maxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use maxBufferSizeBytes instead. - `commitFrequency` number — The number of events to send downstream before committing that Stream has read them - `maxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing. Enter a numeral with units of KB, MB, etc. - `maxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `path` string — The location for the persistent queue files. To this field's value, the system will append: //inputs/ - `compress` 'none' | 'gzip' — Codec to use to compress the persisted data - `onBackpressure` 'block' | 'drop' — Whether to block or drop events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqControls` object — Management controls for the persistent queue. - `dimensionList` string[] — Other dimensions to include in events - `fieldPerMetric` boolean — When enabled, each metric name is used as the event field key (example: go_threads: 9) instead of the default _metric/_value format. - `discoveryType` 'static' | 'dns' | 'ec2' | 'k8s-node' | 'k8s-pods' | 'k8s-service-monitor' | 'http_sd', required — Target discovery mechanism. Use static to manually enter a list of targets. - `interval` number, required — How often in seconds to scrape targets for metrics. - `timeout` number — Timeout, in milliseconds, before aborting HTTP connection attempts; 1-60000 or 0 to disable - `persistence` DiskSpoolingType — Disk Spooling - `enable` boolean — Spool events on disk for Cribl Edge and Search. Default is disabled. - `timeWindow` string — Time period for grouping spooled events. Default is 10m. - `maxDataSize` string — Maximum disk space that can be consumed before older buckets are deleted. Examples: 420MB, 4GB. Default is 1GB. - `maxDataTime` string — Maximum amount of time to retain data before older buckets are deleted. Examples: 2h, 4d. Default is 24h. - `compress` 'none' | 'gzip' — Data compression format. Default is gzip. - `metadata` MetadataConfInputCollection[] — Fields to add to events from this input - `name` string, required — Name of the metadata field. - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.) - `authType` 'manual' | 'secret' | 'kubernetes' — Enter credentials directly, or select a stored secret - `description` string — Optional description for this configuration. - `targets` object[] — Targets - `protocol` 'http' | 'https' — Protocol to use when collecting metrics - `host` string, required — Name of host from which to pull metrics. - `port` number — The port number in the metrics URL for discovered targets. - `path` string — Path to use when collecting metrics from discovered targets - `recordType` 'SRV' | 'A' | 'AAAA' — DNS record type to resolve - `scrapePort` number — The port number in the metrics URL for discovered targets. - `nameList` string[] — List of DNS names to resolve - `scrapeProtocol` 'http' | 'https' — Protocol to use when collecting metrics - `scrapePath` string — Path to use when collecting metrics from discovered targets - `awsAuthenticationMethod` 'auto' | 'manual' | 'secret' — AWS authentication method. Choose Auto to use IAM roles. - `awsApiKey` string — Access key - `awsSecret` string — Select or create a stored secret that references your access key and secret key - `usePublicIp` boolean — Use public IP address for discovered targets. Disable to use the private IP address. - `searchFilter` SearchFilterConfInputPrometheus[] — Filter to apply when searching for EC2 instances - `Name` string, required — See https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html for information. Attributes can be manually entered if not present in the list. - `Values` string[], required — Values to match within this row's attribute. If empty, search will return only running EC2 instances. - `awsSecretKey` string — Secret key - `region` string — Region where the EC2 is located - `endpoint` string — EC2 service endpoint. If empty, defaults to the AWS Region-specific endpoint. Otherwise, it must point to EC2-compatible endpoint. - `reuseConnections` boolean — Reuse connections between requests, which can improve performance - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA, such as self-signed certificates - `enableAssumeRole` boolean — Use Assume Role credentials to access EC2 - `assumeRoleArn` string — Amazon Resource Name (ARN) of the role to assume - `assumeRoleExternalId` string — External ID to use when assuming role - `durationSeconds` number — Duration of the assumed role's session, in seconds. Minimum is 900 (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12 hours). - `serviceMonitorNamespace` string — Namespace to search for ServiceMonitor resources. Leave empty to search in all namespaces. Note: Kubernetes Service Monitor discovery requires Cribl Edge version 4.18 or greater. Nodes running an older version with this option configured will report an error due to configuration schema validation failure. - `scrapeProtocolExpr` string — Protocol to use when collecting metrics - `scrapePortExpr` string — The port number in the metrics URL for discovered targets. - `scrapePathExpr` string — Path to use when collecting metrics from discovered targets - `podFilter` object[] — Add rules to decide which pods to discover for metrics. Pods are searched if no rules are given or of all the rules' expressions evaluate to true. - `filter` string, required — JavaScript expression applied to pods objects. Return 'true' to include it. - `description` string — Optional description of this rule's purpose - `httpDiscoveryUrl` string — URL to fetch target groups from (must be http or https) - `httpDiscoveryHeaders` RefreshRequestParamConfHealthCheckAuthenticationOauthSecret[] — Extra headers to send with the discovery request - `name` string, required — Name - `value` string, required — Value - `httpDiscoveryRejectUnauthorized` boolean — Reject TLS certificates that cannot be verified for the discovery endpoint. Falls back to the source-level setting if not specified. - `maxResponseBodySize` string — Maximum size of the HTTP SD response body. Responses exceeding this limit will be rejected. Defaults to 20 MB. - `username` string — Username for Prometheus Basic authentication - `password` string — Password for Prometheus Basic authentication - `credentialsSecret` string — Select or create a secret that references your credentials - `__template_environment` string — Binds 'environment' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'environment' at runtime. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_dimensionList` string — Binds 'dimensionList' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'dimensionList' at runtime. - `__template_nameList` string — Binds 'nameList' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'nameList' at runtime. - `__template_awsApiKey` string — Binds 'awsApiKey' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'awsApiKey' at runtime. - `__template_awsSecretKey` string — Binds 'awsSecretKey' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'awsSecretKey' at runtime. - `__template_region` string — Binds 'region' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'region' at runtime. - `__template_endpoint` string — Binds 'endpoint' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'endpoint' at runtime. - `__template_assumeRoleArn` string — Binds 'assumeRoleArn' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'assumeRoleArn' at runtime. - `__template_assumeRoleExternalId` string — Binds 'assumeRoleExternalId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'assumeRoleExternalId' at runtime. - `notifications` Notification[] — Notifications attached to the Source. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Source configuration with optional Notifications and runtime status. - `id` string — Unique ID for this input - `type` 'office365_mgmt', required — Connector type identifier. - `disabled` boolean — If true, the Source is disabled and will not collect data. - `pipeline` string — Pipeline to process data from this Source before sending it through the Routes - `sendToRoutes` boolean — Select whether to send data to Routes, or directly to Destinations. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `pqEnabled` boolean — Use a disk queue to minimize data loss when connected services block. See [Cribl Docs](https://docs.cribl.io/stream/persistent-queues) for PQ defaults (Cribl-managed Cloud Workers) and configuration options (on-prem and hybrid Workers). - `streamtags` string[] — Metadata tags used for categorization and filtering. - `criblSourceProvenance` InputCollectionOriginDataSourceDiscoveryWithDestinationArnConstraint — Read-only metadata that records how the Source was created. Preserved on update when omitted from the request body. Cannot be set on create. - `origin` 'data_source_discovery' — Feature that created the Source. - `destinationArn` string — ARN of the S3 bucket or Firehose delivery stream configured as the Source. - `sourceArn` string — ARN of the AWS resource that produces the logs. - `connections` ConnectionConfInputCollection[] — Direct connections to Destinations, and optionally via a Pipeline or a Pack - `pipeline` string — Pipeline or Pack to process data before sending to the Destination. - `output` string — Destination to send data to when not using Routes. - `pq` PqType - `mode` 'smart' | 'always' — With Smart mode (deprecated), PQ will write events to the filesystem only when it detects backpressure from the processing engine. Smart mode will have no new development starting July 2026, followed by End of Support and feature removal (auto-migrating to Always On) in January 2027. We recommend using Always On mode instead. With Always On mode, PQ will always write events directly to the queue before forwarding them to the processing engine. - `maxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `maxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use maxBufferSizeBytes instead. - `commitFrequency` number — The number of events to send downstream before committing that Stream has read them - `maxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing. Enter a numeral with units of KB, MB, etc. - `maxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `path` string — The location for the persistent queue files. To this field's value, the system will append: //inputs/ - `compress` 'none' | 'gzip' — Codec to use to compress the persisted data - `onBackpressure` 'block' | 'drop' — Whether to block or drop events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqControls` object — Management controls for the persistent queue. - `planType` 'enterprise_gcc' | 'gcc' | 'gcc_high' | 'dod', required — Microsoft 365 subscription plan for your organization, typically Microsoft 365 Enterprise - `tenantId` string, required — Microsoft 365 Azure Tenant ID - `appId` string, required — Microsoft 365 Azure Application ID - `timeout` number — HTTP request inactivity timeout, use 0 to disable - `keepAliveTime` number — How often workers should check in with the scheduler to keep job subscription alive - `jobTimeout` string — Maximum time the job is allowed to run (e.g., 30, 45s or 15m). Units are seconds, if not specified. Enter 0 for unlimited time. - `maxMissedKeepAlives` number — The number of Keep Alive Time periods before an inactive worker will have its job subscription revoked. - `ttl` string — Time to keep the job's artifacts on disk after job completion. This also affects how long a job is listed in the Job Inspector. - `ignoreGroupJobsLimit` boolean — When enabled, this job's artifacts are not counted toward the Worker Group's finished job artifacts limit. Artifacts will be removed only after the Collector's configured time to live. - `metadata` MetadataConfInputCollection[] — Fields to add to events from this input - `name` string, required — Name of the metadata field. - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.) - `publisherIdentifier` string — Optional Publisher Identifier to use in API requests, defaults to tenant id if not defined. For more information see [here](https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference#start-a-subscription) - `contentConfig` object[] — Enable Microsoft 365 Management Activity API content types and polling intervals. Polling intervals are used to set up search date range and cron schedule, e.g.: */${interval} * * * *. Because of this, intervals entered must be evenly divisible by 60 to give a predictable schedule. - `contentType` string — Microsoft 365 Management Activity API Content Type - `description` string — If interval type is minutes the value entered must evenly divisible by 60 or save will fail - `interval` number — Interval - `logLevel` 'error' | 'warn' | 'info' | 'debug' — Collector runtime Log Level - `enabled` boolean — Enabled - `ingestionLag` number — Use this setting to account for ingestion lag. This is necessary because there can be a lag of 60 - 90 minutes (or longer) before Microsoft 365 events are available for retrieval. - `retryRules` RetryRulesTypeCodesEnableHeader - `type` 'none' | 'backoff' | 'static', required — The algorithm to use when performing HTTP retries - `interval` number — Time interval between failed request and first retry (kickoff). Maximum allowed value is 20,000 ms (1/3 minute). - `limit` number — The maximum number of times to retry a failed HTTP request - `multiplier` number — Base for exponential backoff, e.g., base 2 means that retries will occur after 2, then 4, then 8 seconds, and so on - `codes` number[] — List of http codes that trigger a retry. Leave empty to use the default list of 429, 500, and 503. - `enableHeader` boolean — Honor any Retry-After header that specifies a delay (in seconds) or a timestamp after which to retry the request. The delay is limited to 20 seconds, even if the Retry-After header specifies a longer delay. When disabled, all Retry-After headers are ignored. - `retryConnectTimeout` boolean — Make a single retry attempt when a connection timeout (ETIMEDOUT) error occurs - `retryConnectReset` boolean — Retry request when a connection reset (ECONNRESET) error occurs - `authType` 'manual' | 'secret' — Enter client secret directly, or select a stored secret - `description` string — Optional description for this configuration. - `clientSecret` string — Microsoft 365 Azure client secret - `textSecret` string — Select or create a stored text secret - `__template_environment` string — Binds 'environment' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'environment' at runtime. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_planType` string — Binds 'planType' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'planType' at runtime. - `__template_tenantId` string — Binds 'tenantId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tenantId' at runtime. - `__template_appId` string — Binds 'appId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'appId' at runtime. - `__template_publisherIdentifier` string — Binds 'publisherIdentifier' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'publisherIdentifier' at runtime. - `__template_clientSecret` string — Binds 'clientSecret' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientSecret' at runtime. - `notifications` Notification[] — Notifications attached to the Source. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Source configuration with optional Notifications and runtime status. - `id` string — Unique ID for this input - `type` 'office365_service', required — Connector type identifier. - `disabled` boolean — If true, the Source is disabled and will not collect data. - `pipeline` string — Pipeline to process data from this Source before sending it through the Routes - `sendToRoutes` boolean — Select whether to send data to Routes, or directly to Destinations. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `pqEnabled` boolean — Use a disk queue to minimize data loss when connected services block. See [Cribl Docs](https://docs.cribl.io/stream/persistent-queues) for PQ defaults (Cribl-managed Cloud Workers) and configuration options (on-prem and hybrid Workers). - `streamtags` string[] — Metadata tags used for categorization and filtering. - `criblSourceProvenance` InputCollectionOriginDataSourceDiscoveryWithDestinationArnConstraint — Read-only metadata that records how the Source was created. Preserved on update when omitted from the request body. Cannot be set on create. - `origin` 'data_source_discovery' — Feature that created the Source. - `destinationArn` string — ARN of the S3 bucket or Firehose delivery stream configured as the Source. - `sourceArn` string — ARN of the AWS resource that produces the logs. - `connections` ConnectionConfInputCollection[] — Direct connections to Destinations, and optionally via a Pipeline or a Pack - `pipeline` string — Pipeline or Pack to process data before sending to the Destination. - `output` string — Destination to send data to when not using Routes. - `pq` PqType - `mode` 'smart' | 'always' — With Smart mode (deprecated), PQ will write events to the filesystem only when it detects backpressure from the processing engine. Smart mode will have no new development starting July 2026, followed by End of Support and feature removal (auto-migrating to Always On) in January 2027. We recommend using Always On mode instead. With Always On mode, PQ will always write events directly to the queue before forwarding them to the processing engine. - `maxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `maxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use maxBufferSizeBytes instead. - `commitFrequency` number — The number of events to send downstream before committing that Stream has read them - `maxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing. Enter a numeral with units of KB, MB, etc. - `maxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `path` string — The location for the persistent queue files. To this field's value, the system will append: //inputs/ - `compress` 'none' | 'gzip' — Codec to use to compress the persisted data - `onBackpressure` 'block' | 'drop' — Whether to block or drop events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqControls` object — Management controls for the persistent queue. - `planType` 'enterprise_gcc' | 'gcc' | 'gcc_high' | 'dod' — Microsoft 365 subscription plan for your organization, typically Microsoft 365 Enterprise - `tenantId` string, required — Microsoft 365 Azure Tenant ID - `appId` string, required — Microsoft 365 Azure Application ID - `timeout` number — HTTP request inactivity timeout, use 0 to disable - `keepAliveTime` number — How often workers should check in with the scheduler to keep job subscription alive - `jobTimeout` string — Maximum time the job is allowed to run (e.g., 30, 45s or 15m). Units are seconds, if not specified. Enter 0 for unlimited time. - `maxMissedKeepAlives` number — The number of Keep Alive Time periods before an inactive worker will have its job subscription revoked. - `ttl` string — Time to keep the job's artifacts on disk after job completion. This also affects how long a job is listed in the Job Inspector. - `ignoreGroupJobsLimit` boolean — When enabled, this job's artifacts are not counted toward the Worker Group's finished job artifacts limit. Artifacts will be removed only after the Collector's configured time to live. - `metadata` MetadataConfInputCollection[] — Fields to add to events from this input - `name` string, required — Name of the metadata field. - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.) - `contentConfig` object[] — Enable Microsoft 365 Service Communication API content types and polling intervals. Polling intervals are used to set up search date range and cron schedule, e.g.: */${interval} * * * *. Because of this, intervals entered for current and historical status must be evenly divisible by 60 to give a predictable schedule. - `contentType` string — Microsoft 365 Services API Content Type - `description` string — If interval type is minutes the value entered must evenly divisible by 60 or save will fail - `interval` number — Interval - `logLevel` 'error' | 'warn' | 'info' | 'debug' — Collector runtime Log Level - `enabled` boolean — Enabled - `retryRules` RetryRulesTypeCodesEnableHeader - `type` 'none' | 'backoff' | 'static', required — The algorithm to use when performing HTTP retries - `interval` number — Time interval between failed request and first retry (kickoff). Maximum allowed value is 20,000 ms (1/3 minute). - `limit` number — The maximum number of times to retry a failed HTTP request - `multiplier` number — Base for exponential backoff, e.g., base 2 means that retries will occur after 2, then 4, then 8 seconds, and so on - `codes` number[] — List of http codes that trigger a retry. Leave empty to use the default list of 429, 500, and 503. - `enableHeader` boolean — Honor any Retry-After header that specifies a delay (in seconds) or a timestamp after which to retry the request. The delay is limited to 20 seconds, even if the Retry-After header specifies a longer delay. When disabled, all Retry-After headers are ignored. - `retryConnectTimeout` boolean — Make a single retry attempt when a connection timeout (ETIMEDOUT) error occurs - `retryConnectReset` boolean — Retry request when a connection reset (ECONNRESET) error occurs - `authType` 'manual' | 'secret' — Enter client secret directly, or select a stored secret - `description` string — Optional description for this configuration. - `clientSecret` string — Microsoft 365 Azure client secret - `textSecret` string — Select or create a stored text secret - `__template_environment` string — Binds 'environment' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'environment' at runtime. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_planType` string — Binds 'planType' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'planType' at runtime. - `__template_tenantId` string — Binds 'tenantId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tenantId' at runtime. - `__template_appId` string — Binds 'appId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'appId' at runtime. - `__template_clientSecret` string — Binds 'clientSecret' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientSecret' at runtime. - `notifications` Notification[] — Notifications attached to the Source. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Source configuration with optional Notifications and runtime status. - `id` string — Unique ID for this input - `type` 'office365_msg_trace', required — Connector type identifier. - `disabled` boolean — If true, the Source is disabled and will not collect data. - `pipeline` string — Pipeline to process data from this Source before sending it through the Routes - `sendToRoutes` boolean — Select whether to send data to Routes, or directly to Destinations. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `pqEnabled` boolean — Use a disk queue to minimize data loss when connected services block. See [Cribl Docs](https://docs.cribl.io/stream/persistent-queues) for PQ defaults (Cribl-managed Cloud Workers) and configuration options (on-prem and hybrid Workers). - `streamtags` string[] — Metadata tags used for categorization and filtering. - `criblSourceProvenance` InputCollectionOriginDataSourceDiscoveryWithDestinationArnConstraint — Read-only metadata that records how the Source was created. Preserved on update when omitted from the request body. Cannot be set on create. - `origin` 'data_source_discovery' — Feature that created the Source. - `destinationArn` string — ARN of the S3 bucket or Firehose delivery stream configured as the Source. - `sourceArn` string — ARN of the AWS resource that produces the logs. - `connections` ConnectionConfInputCollection[] — Direct connections to Destinations, and optionally via a Pipeline or a Pack - `pipeline` string — Pipeline or Pack to process data before sending to the Destination. - `output` string — Destination to send data to when not using Routes. - `pq` PqType - `mode` 'smart' | 'always' — With Smart mode (deprecated), PQ will write events to the filesystem only when it detects backpressure from the processing engine. Smart mode will have no new development starting July 2026, followed by End of Support and feature removal (auto-migrating to Always On) in January 2027. We recommend using Always On mode instead. With Always On mode, PQ will always write events directly to the queue before forwarding them to the processing engine. - `maxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `maxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use maxBufferSizeBytes instead. - `commitFrequency` number — The number of events to send downstream before committing that Stream has read them - `maxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing. Enter a numeral with units of KB, MB, etc. - `maxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `path` string — The location for the persistent queue files. To this field's value, the system will append: //inputs/ - `compress` 'none' | 'gzip' — Codec to use to compress the persisted data - `onBackpressure` 'block' | 'drop' — Whether to block or drop events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqControls` object — Management controls for the persistent queue. - `url` string, required — URL to use when retrieving report data. - `interval` integer, required — How often (in minutes) to run the report. Must divide evenly into 60 minutes to create a predictable schedule, or Save will fail. - `startDate` string — Backward offset for the search range's head. (E.g.: -3h@h) Message Trace data is delayed; this parameter (with Date range end) compensates for delay and gaps. - `endDate` string — Backward offset for the search range's tail. (E.g.: -2h@h) Message Trace data is delayed; this parameter (with Date range start) compensates for delay and gaps. - `timeout` number — HTTP request inactivity timeout. Maximum is 2400 (40 minutes); enter 0 to wait indefinitely. - `disableTimeFilter` boolean — Disables time filtering of events when a date range is specified. - `authType` 'manual' | 'secret' | 'oauth' | 'oauthSecret' | 'oauthCert' — Select authentication method. - `keepAliveTime` number — How often workers should check in with the scheduler to keep job subscription alive - `jobTimeout` string — Maximum time the job is allowed to run. Time unit defaults to seconds if not specified (examples: 30, 45s, 15m). Enter 0 for unlimited time. - `maxMissedKeepAlives` number — The number of Keep Alive Time periods before an inactive worker will have its job subscription revoked. - `ttl` string — Time to keep the job's artifacts on disk after job completion. This also affects how long a job is listed in the Job Inspector. - `ignoreGroupJobsLimit` boolean — When enabled, this job's artifacts are not counted toward the Worker Group's finished job artifacts limit. Artifacts will be removed only after the Collector's configured time to live. - `metadata` MetadataConfInputCollection[] — Fields to add to events from this input - `name` string, required — Name of the metadata field. - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.) - `rescheduleDroppedTasks` boolean — Reschedule tasks that failed with non-fatal errors - `maxTaskReschedule` number — Maximum number of times a task can be rescheduled - `logLevel` 'error' | 'warn' | 'info' | 'debug' | 'silly' — Log Level (verbosity) for collection runtime behavior. - `retryRules` RetryRulesTypeCodesEnableHeader - `type` 'none' | 'backoff' | 'static', required — The algorithm to use when performing HTTP retries - `interval` number — Time interval between failed request and first retry (kickoff). Maximum allowed value is 20,000 ms (1/3 minute). - `limit` number — The maximum number of times to retry a failed HTTP request - `multiplier` number — Base for exponential backoff, e.g., base 2 means that retries will occur after 2, then 4, then 8 seconds, and so on - `codes` number[] — List of http codes that trigger a retry. Leave empty to use the default list of 429, 500, and 503. - `enableHeader` boolean — Honor any Retry-After header that specifies a delay (in seconds) or a timestamp after which to retry the request. The delay is limited to 20 seconds, even if the Retry-After header specifies a longer delay. When disabled, all Retry-After headers are ignored. - `retryConnectTimeout` boolean — Make a single retry attempt when a connection timeout (ETIMEDOUT) error occurs - `retryConnectReset` boolean — Retry request when a connection reset (ECONNRESET) error occurs - `description` string — Optional description for this configuration. - `username` string — Username to run Message Trace API call. - `password` string — Password to run Message Trace API call. - `credentialsSecret` string — Select or create a secret that references your credentials. - `clientSecret` string — client_secret to pass in the OAuth request parameter. - `tenantId` string — Directory ID (tenant identifier) in Azure Active Directory. - `clientId` string — client_id to pass in the OAuth request parameter. - `resource` string — Resource to pass in the OAuth request parameter. - `planType` 'enterprise_gcc' | 'gcc' | 'gcc_high' | 'dod' — Microsoft 365 subscription plan for your organization, typically Microsoft 365 Enterprise - `textSecret` string — Select or create a secret that references your client_secret to pass in the OAuth request parameter. - `certOptions` CertOptionsType - `certificateName` string — The name of the predefined certificate. - `privKeyPath` string, required — Path to the private key to use. Key should be in PEM format. Can reference $ENV_VARS. - `passphrase` string — Passphrase to use to decrypt the private key. - `certPath` string, required — Path to the certificate to use. Certificate should be in PEM format. Can reference $ENV_VARS. - `__template_environment` string — Binds 'environment' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'environment' at runtime. - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime. - `__template_url` string — Binds 'url' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'url' at runtime. - `__template_tenantId` string — Binds 'tenantId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tenantId' at runtime. - `__template_clientId` string — Binds 'clientId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientId' at runtime. - `__template_resource` string — Binds 'resource' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'resource' at runtime. - `__template_planType` string — Binds 'planType' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'planType' at runtime. - `notifications` Notification[] — Notifications attached to the Source. - union - object - … - object - … - object - … - `status` StatusType — Runtime status: health, metrics, and optional persistent-queue info. Fields may be absent when data is unavailable. - `error` StatusError - `details` object — Additional error details. - `message` string, required — Human-readable message that describes the error. - `health` 'Green' | 'Red' | 'Unknown' | 'Yellow' — Overall health status of the Source or Destination. - `metrics` object — Metrics data for the Source or Destination. - `pq` WorkerPQStatus - `error` StatusError - … - `health` number, required - `metrics` object, required - `timestamp` number, required - `timestamp` integer — Timestamp (in Unix time) when the status was last updated. - `useStatusFromLB` boolean — Set to prefer status from the LB process, not from the worker process. - object — Source configuration with optional Notifications and runtime status. - `id` string — Unique ID for this input - `type` 'microsoft_graph', required — Connector type identifier. - `disabled` boolean — If true, the Source is disabled and will not collect data. - `pipeline` string — Pipeline to process data from this Source before sending it through the Routes - `sendToRoutes` boolean — Select whether to send data to Routes, or directly to Destinations. - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `pqEnabled` boolean — Use a disk queue to minimize data loss when connected services block. See [Cribl Docs](https://docs.cribl.io/stream/persistent-queues) for PQ defaults (Cribl-managed Cloud Workers) and configuration options (on-prem and hybrid Workers). - `streamtags` string[] — Metadata tags used for categorization and filtering. - `criblSourceProvenance` InputCollectionOriginDataSourceDiscoveryWithDestinationArnConstraint — Read-only metadata that records how the Source was created. Preserved on update when omitted from the request body. Cannot be set on create. - `origin` 'data_source_discovery' — Feature that created the Source. - `destinationArn` string — ARN of the S3 bucket or Firehose delivery stream configured as the Source. - `sourceArn` string — ARN of the AWS resource that produces the logs. - `connections` ConnectionConfInputCollection[] — Direct connections to Destinations, and optionally via a Pipeline or a Pack - `pipeline` string — Pipeline or Pack to process data before sending to the Destination. - `output` string — Destination to send data to when not using Routes. - `pq` PqType - `mode` 'smart' | 'always' — With Smart mode (deprecated), PQ will write events to the filesystem only when it detects backpressure from the processing engine. Smart mode will have no new development starting July 2026, followed by End of Support and feature removal (auto-migrating to Always On) in January 2027. We recommend using Always On mode instead. With Always On mode, PQ will always write events directly to the queue before forwarding them to the processing engine. - `maxBufferSizeBytes` string — The maximum size to hold in memory before writing events to disk. Enter a numeral with units of KB, MB, etc. The minimum value is 64KB and the maximum value is 10MB. - `maxBufferSize` number — Maximum number of events to hold in memory before writing the events to disk. Deprecated and only supported in workers < v4.17.0. Use maxBufferSizeBytes instead. - `commitFrequency` number — The number of events to send downstream before committing that Stream has read them - `maxFileSize` string — The maximum size to store in each queue file before closing and optionally compressing. Enter a numeral with units of KB, MB, etc. - `maxSize` string — The maximum disk space that the queue can consume (as an average per Worker Process) before queueing stops. Enter a numeral with units of KB, MB, etc. - `path` string — The location for the persistent queue files. To this field's value, the system will append: //inputs/ - `compress` 'none' | 'gzip' — Codec to use to compress the persisted data - `onBackpressure` 'block' | 'drop' — Whether to block or drop events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged. - `pqControls` object — Management controls for the persistent queue. - `url` string, required — Microsoft Graph API endpoint URL. (ex. https://graph.microsoft.com/v1.0/admin/exchange/tracing/messageTraces) - `interval` integer, required — How often (in minutes) to run the report. Must divide evenly into 60 minutes to create a predictable schedule, or Save will fail. - `startDate` string — Backward offset for the search range's head. (E.g.: -3h@h) Microsoft Graph data is delayed; this parameter (with Date range end) compensates for delay and gaps. - `endDate` string — Backward offset for the search range's tail. (E.g.: -2h@h) Microsoft Graph data is delayed; this parameter (with Date range start) compensates for delay and gaps. - `timeout` number — HTTP request inactivity timeout. Maximum is 2400 (40 minutes); enter 0 to wait indefinitely. - `disableTimeFilter` boolean — Disables time filtering of events when a date range is specified. - `maxPages` integer — Maximum number of pages to retrieve per collection task. Set to 0 to retrieve all pages. - `authType` 'oauth' | 'oauthSecret' | 'oauthCert' — Select authentication method. - `keepAliveTime` number — How often workers should check in with the scheduler to keep job subscription alive - … truncated; see the full OpenAPI document linked below ## Other responses - `401` — Authentication failed (missing or invalid credentials or Bearer token). - `500` — Unexpected server error. --- [API](https://skmtc.net/criblio/apis/cribl-api-reference.md) · [All operations](https://skmtc.net/criblio/apis/cribl-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/criblio/cribl-api-reference/versions/e9bef570d106/schema)