LoginSign Up
← Back to all sparks
C

Cribl

ANALYTICS
Velocity5.0

Observability data pipeline for routing, shaping and reducing telemetry

cribl.io ↗

Cribl Stream's release notes read as a running list of things customers must go fix.

observability-pipelinebreaking-changesapi-semanticsdeprecationstelemetry
◆Current state
The captured entries are dominated by their Important Changes sections; the feature lists that follow are cut off in the feed, so what shipped is largely unreadable and what breaks is not. Across 4.16 to 4.19: sensitive values like passwords and client secrets stop appearing in plaintext in API responses and the UI, single-item GET requests return 404 rather than an empty 200, selected Pipeline, Route, profiler, and job-log endpoints return correct status codes, UDP sources bound to IPv6 accept IPv6 only, the Cribl as Code TypeScript and Go SDKs are discontinued, Smart mode for source persistent queues is deprecated, and an HTTP Bulk API byte-accounting change is flagged as affecting Cribl.Cloud billing. Two patch releases in the window fix critical regressions of their own.
◆Where it's heading
The pattern is a platform correcting its own contract: API semantics that were wrong are being made right even where that breaks callers, secrets are being pulled out of responses that should never have carried them, and legacy paths are being closed rather than maintained. Discontinuing the Cribl as Code SDKs points the same way — fewer supported surfaces, more weight on the API itself. For an operator this is a period of scheduled work rather than new capability, and the 4.19.1-to-4.19.2 turnaround shows the cost of moving at that pace.
◆Prediction
Expect the byte-accounting change flagged twice as upcoming to land and change what Cribl.Cloud customers are billed for, which is the item on these lists with commercial consequences. Whether the discontinued Cribl as Code SDKs get a named replacement is not visible in these entries.

◆Recent moves

  1. 13d ago

    Patch fixes broken OAuth secret resolution and dropped HTTP retries

    A patch fixing two regressions from 4.19.1: OAuth secret fields holding C.Secret or C.vars expressions sent the expression text rather than the resolved value, breaking authentication on Microsoft Sentinel and Webhook destinations, and HTTP destinations dropped timed-out batches instead of retrying. Serious for anyone hit by them, but repair of the prior release rather than new work.

    View source ↗
  2. 23d ago

    Cribl as Code TypeScript and Go SDKs discontinued

    The release discontinues the Cribl as Code TypeScript and Go SDKs, deprecates Smart mode for source persistent queues, and warns that an HTTP Bulk API byte-accounting change will affect Cribl.Cloud billing. The feature list is cut off in the captured body, so only the actionable changes are legible — and dropping the infrastructure-as-code SDKs is the one with the longest tail for anyone who built on them.

    View source ↗
  3. 1mo ago

    Breaking changes to UDP IPv6 binding and API status codes

    A minor release carrying three breaking changes: UDP sources bound to IPv6 accept IPv6 traffic only, selected Pipeline, Route, profiler, and job-log endpoints return correct HTTP status codes, and single-item GETs return 404 for unknown IDs on-prem. The status-code corrections are the API contract catching up to what clients should already have assumed.

    View source ↗
  4. 2mo ago

    GET-by-ID returns 404 for unknown resources in Cribl.Cloud

    Cribl.Cloud GET-by-ID operations start returning 404 for a missing resource instead of a 200 with an empty items array. Small on its face, but any caller checking count rather than status now behaves differently — and the same change reaches on-prem two releases later.

    View source ↗
  5. 3mo ago

    Patch fixes Syslog framing failures and persistent queue input IDs

    A patch for three critical issues in 4.18.0, including a Syslog load balancer timer that reset framing state during quiet gaps and produced parser failures on octet-counted TCP inputs, and a persistent-queue Smart mode bug affecting the input ID field. Repair work, and Smart mode is deprecated a release later.

    View source ↗
  6. 3mo ago

    Secrets removed from API responses and the UI

    System settings, auth settings, and database connection endpoints stop returning passwords and password-equivalent attributes like bind credentials and client secrets in plaintext, in the API and the UI. It breaks anything that was reading those values back, which is the point — a pipeline holding credentials for hundreds of sources should never have handed them out.

    View source ↗