StatsD with Cribl Stream

What it is for

Cribl Stream supports sending data to a StatsD Destination; the page links to the statsd metrics project on GitHub. Listed: Type Streaming, TLS Support: No, PQ Support: Yes. With TLS Support at No, the page documents no TLS option in the settings, and it communicates over UDP, the default, or TCP. With PQ Support at Yes, most of the page covers the Persistent Queue Settings tab, four setting sections, and a troubleshooting guide.

Configuring the destination

The walkthrough, per the StatsD Destination page, starts at the top bar: select Products, then Cribl Stream, then a Worker Group under Worker Groups. Configure via QuickConnect (Routing, QuickConnect for Stream, or Collect for Edge), select Add Destination, choosing Select Existing or Add New, or via Routes (Data, Destinations, or More, Destinations on Edge), and select Add Destination.

In the New Destination modal, General Settings take an Output ID, a unique name identifying this StatsD definition (Cribl Stream adds -CLONE on clone); Description is optional. Destination protocol, used to communicate with the Destination, defaults to UDP; Host is the Destination hostname, and Port defaults to 8125.

Optional Settings include Throttling, which displays only when Destination protocol is TCP: it is the rate, in bytes per second, at which to throttle while writing to an output, takes KB, MB, and GB multiples, and defaults to 0, indicating no throttling. Backpressure behavior, also TCP-only, selects whether to block, drop, or queue events when all receivers exert backpressure (a broken or denied connection, or a rate limiter), and defaults to Block. Tags optionally filter and group Destinations on the Destinations page; they aren't added to processed events, with tag names separated by a tab or hard return.

Next, optionally adjust the Persistent Queue, Timeout, Processing, and Advanced settings, then select Save, then Commit & Deploy.

The Persistent Queue Settings tab displays when Backpressure behavior is set to Persistent Queue, buffering and preserving incoming events during downstream outages or backpressure. Some settings might not appear if the persistent queue storage mode at the Worker Group level is set to Network filesystem or AWS S3, where the behavior is managed at that level.

On Cribl-managed Cloud Workers with an Enterprise plan, the tab exposes only the Mode and Backpressure duration limit settings and the destructive Clear Persistent Queue button. A maximum queue size of 1 GB disk space is automatically allocated per PQ-enabled Destination, per Worker Process, on outbound uncompressed data without queue compression; it is not configurable, and a full queue blocks outbound data. To configure queue size, compression, queue-full fallback behavior, or other options, the page points to a hybrid group.

Mode selects when Cribl Stream engages the persistent queue for this Destination's backpressure events. The options, copied from the StatsD Destination page:

| Mode | Description |
| ---- | ----------- |
| **Error** | Queues and stores data on a disk when the Destination is unavailable or in an error state. |
| **Backpressure** | Queues and stores data to a disk when it detects backpressure from the Destination until the backpressure event resolves. |
| **Always On** | Cribl Stream immediately queues and stores all data on a disk for all events, even when there is no backpressure. |

A Worker or Edge Node that starts with an invalid Mode setting automatically switches to Error mode, for example on a version older than 4.9.0 or a nonexistent YAML value.

The remaining fields: File size limit, the maximum data volume per queue file before closing it, defaults to 10 MB and must be at least the Buffer size limit (bytes) on save. Queue size limit, the maximum disk space per Worker Process, defaults to 5 GB and accepts up to 1 TB unless a different Worker Process PQ size limit is configured. Queue file path defaults to $CRIBL_HOME/state/queues, with <worker-id>/<output-id> appended. Compression, the codec for compressing persisted data after closing a file, defaults to None, with Gzip available. When the queue exerts backpressure on a low or full disk, Queue-full behavior chooses Block (refusing new data until the receiver is ready) or Drop new data (discarding new events until the receiver is ready).

Buffer size limit (bytes) is the maximum memory to buffer events before flushing them to the persistent queue on disk, entered with a unit suffix, such as 64KB or 1MB (units case-insensitive); decimals are not accepted. The valid range is 64KB to 10MB, values outside it round to the nearest limit, and the default is 1MB. As of version 4.18.0 it replaced the deprecated Buffer size limit (events) setting, and for upgraded Worker Groups and Fleets the byte-based limit defaults to 1MB.

Backpressure duration limit displays when Mode is Backpressure, controlling how long, in seconds, a Destination must experience backpressure before Cribl Stream queues data to disk; it defaults to 30 seconds, lowering it strengthens data loss prevention, and raising it prevents unnecessary queue activation with frequent, short network interruptions. Strict ordering is on by default, enabling FIFO forwarding, with the queue flushing every 10 seconds in this mode; off, it prioritizes new events and displays Drain rate limit (EPS), a throttling rate from the queue to receivers in events per second, where 0 disables throttling.

Clear Persistent Queue, for Cloud Enterprise only, appears only after you define the Output ID; selecting it shows a confirmation modal, and clearing permanently deletes the queued files for this Destination without delivering them.

The Timeout Settings section displays only when Destination protocol is set to TCP. Connection timeout, in milliseconds, is the wait for the connection to establish before retrying, defaulting to 10000; Write timeout is the wait for a write to complete before assuming the connection is dead, defaulting to 60000.

Processing Settings list two items under Post-Processing: Pipeline, the Pipeline or Pack that processes data before sending it out using this output, and System fields, added automatically to events that use this output; the default includes cribl_pipe, and wildcards are supported. The available fields include cribl_host, cribl_input, cribl_output, cribl_pipe, cribl_route, cribl_wp, cribl_group, and cribl_mode.

Advanced Settings: Record size limit (bytes) is used when the protocol is UDP; it is the maximum size of packets sent to the Destination, the MTU, and defaults to 512. Flush period (sec) is used when the protocol is TCP; it is how often buffers flush, sending records to the Destination, defaulting to 1. DNS resolution period (sec) sets the interval, in seconds, to re-resolve hostnames, defaulting to 0 seconds, so lookups occur for every outgoing batch. Environment, for GitOps use, optionally names a single Git branch to enable this configuration on, empty meaning enabled everywhere.

Using it

Usage guidance is the page's Troubleshooting section, which covers the configuration-modal tabs. On the Live Data tab, click Start Capture to view real-time events through the Destination. The Logs tab holds the delivery logs, including any errors or warnings, for review and search. The Test tab confirms the Destination is set up and reachable; click Run Test to verify sample events are sent correctly. The Monitoring page provides data volume and rate, with graphs of events and bytes in and out over time.

What the docs flag

• TLS Support is No; the page documents no TLS option in the settings.
• Throttling, Backpressure behavior, and the entire Timeout Settings section display only when Destination protocol is TCP.
• Some persistent queue settings might not appear when the Worker Group level storage mode is Network filesystem or AWS S3, where the behavior is managed at that level.
• On Cribl-managed Cloud Workers with an Enterprise plan, the tab exposes only Mode, Backpressure duration limit, and Clear Persistent Queue; the 1 GB queue limit is not configurable, and a full queue blocks outbound data.
• A node starting with an invalid Mode automatically switches to Error mode, for example on a version older than 4.9.0 or a nonexistent YAML value.
• Buffer size limit (events) is deprecated as of version 4.18.0 in favor of the byte-based limit.
• Clear Persistent Queue permanently deletes queued data without delivering it, so the page warns to use the button with caution.

Frequently asked questions

Which protocol does the StatsD Destination in Cribl Stream use by default, and what does the port default to?

The Destination protocol defaults to UDP, and the Port defaults to 8125, with Host holding the Destination's hostname. The docs list the Destination as Type Streaming, with TLS Support: No and PQ Support: Yes.

When do the Throttling and Backpressure behavior options appear in the StatsD Destination settings?

Both display only when General Settings, Destination protocol is set to TCP. Throttling's default of 0 means no throttling, and Backpressure behavior defaults to Block among its block, drop, or queue choices.

What queue size does the StatsD Destination receive on Cribl-managed Cloud Workers?

A maximum queue size of 1 GB disk space is automatically allocated per PQ-enabled Destination, per Worker Process. No compression is applied to the queue, the limit is not configurable, and a full queue blocks outbound data. The page points to a hybrid group to configure the queue size and other options.

Which StatsD Destination settings depend on the protocol you select?

Record size limit (bytes) is used when the protocol is UDP and defaults to 512, while Flush period (sec) is used when the protocol is TCP and defaults to 1. The Timeout Settings section also displays only when the protocol is set to TCP.