Sending Direct HTTP to Cribl Stream (Bulk API)

When to send HTTP straight to Stream

The Cribl Stream docs describe two push Sources for receiving data sent straight to Stream over HTTP or HTTPS, both with TLS support. The HTTP/S (Bulk API) Source page documents the first: it receives data from Cribl Bulk API, Splunk HEC, and Elastic Bulk API endpoints, which suits app loggers and scripts that already emit one of those wire formats. Both sources accept gzip-compressed inbound data when the Content-Encoding: gzip header is set.

The Raw HTTP/S Source listens on a specific port, captures every HTTP request to that port, and pushes each event to its configured Event Breakers; its docs name browser-based OTLP/HTTP telemetry as the scenario its CORS settings exist for. Use the HTTP/S source for the three named formats and Raw HTTP for paths you define. Both take auth tokens, persistent queue settings, TLS with mutual authentication, and IP allowlist and denylist regexes.

The HTTP/S (Bulk API) source

Per the HTTP/S (Bulk API) Source page, this push Source offers TLS support and no Event Breaker support. Stream ships an HTTP Source preconfigured to listen on port 10080 and several default endpoints; clone or modify it, then enable it. General Settings take an Input ID (default http, which cannot be changed via the UI; clones get -CLONE), a Description, an Address (for example localhost or 0.0.0.0), and a Port.

Authentication is by auth tokens: shared secrets clients send in the request header as Authorization: <token>. You can generate a token, but if the field is empty, unauthorized access will be permitted. Tokens can carry Fields, Name/Value pairs whose Value is a JavaScript expression, so you can tag events with metadata such as source or environment without using the token directly in Routes and Pipelines.

Optional Settings expose up to three API paths on one port. The Cribl HTTP event API base path defaults to /cribl and Stream appends /_bulk, so senders target /cribl/_bulk. The Elastic endpoint supports only the default /elastic today, also appended with /_bulk. The Splunk HEC endpoint defaults to /services/collector (/services/collector/event works too); an empty string disables any path, and HEC acknowledgements are off by default.

Events are one JSON record per event. The sample event format from the HTTP/S (Bulk API) Source page:

{"_time":1541280341, "_raw":"this is a sample event ", "host":"myHost", "source":"mySource", "fieldA":"valueA", "fieldB":"valueB"}
{"_time":1541280341, "host":"myOtherHost", "source":"myOtherSource", "_raw": "{\"message\":\"Something informative happened\", \"severity\":\"INFO\"}"}

Cribl highly recommends combining multiple events in newline-delimited groups and POSTing them together, though separate POSTs are allowed. The single-event example from the HTTP/S (Bulk API) Source page, against a source on port 10080 (token redacted):

curl -k "http://<myCriblHost>:10080/cribl/_bulk" \
-H "Authorization: <your-token>" \
-d '{"_raw":"this is a sample event ", "host":"myHost", "source":"mySource", "fieldA":"valueA", "fieldB":"valueB"}'

and the multiple-events version from the HTTP/S (Bulk API) Source page, two newline-delimited records in one request:

curl -k "http://<myCriblHost>:10080/cribl/_bulk" \
-H "Authorization: <your-token>" \
-d $'{"_raw":"this is a sample event ", "host":"myHost", "source":"mySource", "fieldA":"valueA", "fieldB":"valueB"}\n\
{"_raw":"this is another sample event ", "host":"myOtherHost", "source":"myOtherSource", "fieldA":"valueA", "fieldB":"valueB"}'

For Cribl.Cloud senders, the page shows the endpoint as https://default.main.<organizationId>.cribl.cloud:10080/cribl/_bulk; on Enterprise plans, replace default with the name of the Worker Group you want to send to.

TLS is off by default: select a predefined certificate or PEM certificate and private key paths (environment variables allowed) plus a passphrase. Mutual authentication can require client certificates, validated against a trusted client CA path and a Common name regex. Minimum and maximum TLS version thresholds reject out-of-range clients, and choosing TLSv1 or TLSv1.1 surfaces a deprecation warning.

Processing offers Fields, adding or modifying fields via JavaScript expressions like the Eval function, plus one pre-Processing Pipeline or Pack that runs before Routes. There is no Event Breaker stage, since the Source does not support Event Breakers.

Advanced Settings include a health check endpoint at http(s)://<host>:<port>/cribl_health, an Active request limit of 256 per Worker Process (on-prem only; 0 unlimited), Keep-alive timeout defaulting to 5 seconds, IP allowlist and denylist regexes, Show originating IP for X-Forwarded-For behind proxies, and Capture request headers, which adds request headers to events in __headers.

The raw HTTP/S alternative

The Raw HTTP/S Source page describes a push Source with TLS support and Event Breaker support; it exposes no named API endpoints, just the port it captures. General Settings take an Input ID (clones get -CLONE), a Description, an Address defaulting to 0.0.0.0, and a Port; for Cribl.Cloud, use the 20000-20010 range available to sources without a default port.

Authentication mirrors the HTTP/S source: shared secrets as Authorization: <token>, a Generate button, Fields as JavaScript expressions, and open access if the token is empty. Optional Settings are just Tags; TLS, persistent queue, and connection-tuning settings match the HTTP/S page.

Processing is the visible divergence. Event Breaker rulesets default to System Default Rule; Event Breaker buffer timeout sets how long, in milliseconds, the Event Breaker waits for new data on a channel before flushing (minimum 10 ms, default 10000 (10 sec), maximum 43200000 (12 hours)). Auto parse, off by default, detects each event's Datatype and extracts top-level fields from _raw before Source Fields and any pre-processing Pipeline or Pack.

Advanced Settings add Allowed URI paths and Allowed HTTP methods, both wildcard-capable and defaulting to *, plus a CORS group: allowed origins, allowed headers, allowed methods (default OPTIONS and POST), exposed headers, include credentials, and max age. Internal fields are __channel, __headers (automatically includes request headers), __inputId, and __srcIpPort.

The examples POST to a path you choose on port 10050 with a Content-Type header; the single-event example from the Raw HTTP/S Source page, token redacted:

curl -k "http://<myCriblHost>:10050/postPath" \
-H "Authorization: <your-token>" \
-H "Content-Type: application/json" \
-d '{"_raw":"this is a sample event", "host":"myHost", "source":"mySource", "fieldA":"valueA", "fieldB":"valueB"}'

and the multiple-events version sends two newline-delimited records the same way.

Net differences: Event Breaker support, Auto parse and buffer timeout, Allowed URI paths and methods, CORS, the Cribl.Cloud port range, and __channel.

What the docs flag

• Empty token opens the door. Both pages warn that not providing a token allows unauthorized access to the Source's data.
• Faked success on the Elastic path. Only /elastic is currently supported on the HTTP/S source; other entries are faked as success. Cribl generally recommends the dedicated Elasticsearch API source, and the dedicated Splunk HEC source over the built-in endpoint.
• 51,200 bytes per event on the HEC endpoint. The built-in Splunk HEC endpoint is an event, not raw, endpoint, and the system default Event Breaker enforces a limit of 51,200 bytes per event.
• Active request limit is on-prem only. Default 256 per Worker Process, 0 unlimited; raising it increases load on Stream and downstream Destinations and can cause dropped events or instability.
• Persistent queue limits. Buffer size limit (bytes) accepts 64KB to 10MB, defaults to 1MB, replacing the events-based setting as of Cribl Stream 4.18. Queue size limit defaults to 5 GB per Worker Process, up to 1 TB; file size limit defaults to 10 MB and must be at least the buffer limit. Smart mode is deprecated for hybrid and on-prem Source queues, migrating to Always On in January 2027; in Cribl Stream 4.1 and newer the default mode is Always On. Cribl-managed Cloud Workers (Enterprise plan) run PQ Always On at 1 GB per Source, per Worker Process, uncompressed, not configurable.
• __headers collisions. Webhook, Loki, Microsoft Sentinel, Dynatrace HTTP, and Cortex XSIAM read __headers for dynamic request headers; Kafka reads it for message headers. Forwarding captured events without removing the field can cause TLS validation failures or expose inbound authorization headers, so remove it with an Eval function in a Pipeline.
• Quiet token errors. "Dropping request because token invalid" is logged only at the debug level.
• CORS preflight bypasses authentication. On the Raw HTTP source, OPTIONS preflights return 204 and bypass authentication, method, and content-type checks, but IP rules apply first.

Frequently asked questions

What is the Cribl Stream HTTP/S Bulk API source?

The HTTP/S source in Cribl Stream receives data over HTTP or HTTPS from Cribl Bulk API, Splunk HEC, and Elastic Bulk API endpoints, and it ships preconfigured to listen on port 10080. It is a push-type source with TLS support that accepts gzip-compressed inbound data when the Content-Encoding: gzip header is set.

How do you send multiple events to the Cribl Stream Bulk API source in one request?

Combine multiple events into a newline-delimited group and POST them together, which Cribl highly recommends, although events can also be sent as separate POSTs. Each event is one JSON record, and senders targeting the Cribl endpoint POST to the /cribl/_bulk path.

How does the Cribl Stream Raw HTTP source differ from the HTTP/S Bulk API source?

The Raw HTTP source captures every HTTP request to its port and pushes each resulting event to its configured Event Breakers, while the HTTP/S source has no Event Breaker support and sends data through named API endpoints instead. The Raw HTTP source also adds Auto parse, Event Breaker buffer timeout, Allowed URI paths, Allowed HTTP methods, and CORS settings.

What happens if you leave the auth token empty on a Cribl Stream HTTP source?

If the auth token field is empty, unauthorized access will be permitted. Clients send the shared secret in the Authorization request header, and tokens can carry Fields that tag events with metadata.