What it does
Cribl Stream is an event-processing layer for collecting, shaping, filtering, and forwarding logs and other telemetry. It can sit between existing senders and downstream analytics tools, helping teams remove unneeded fields or events, redact sensitive data, normalize formats, and steer different data to different destinations. Cribl offers managed cloud and self-managed deployment paths, so Stream suits teams that need control of telemetry volume and routing rather than another place to query incidents.
Cribl Stream belongs between the systems that emit telemetry and the systems where teams analyze it. Its documented model is source, route, pipeline, functions, and destination: inputs arrive, routes select a processing path, and ordered functions change events before they leave for one or more receivers.
A useful first pipeline
The official tutorial starts with a managed Cribl.Cloud organization or a self-hosted Linux installation. It feeds sample events from a built-in data generator to a destination, then adds a pipeline. Data Preview lets a user capture representative events and check how a proposed transformation changes them before the route sends live data onward. The tutorial demonstrates masking a sensitive field, parsing raw text into fields, enriching or removing fields, and dropping events that are not needed.
For example, a team receiving verbose application logs could redact an identifier, parse the fields used by its incident queries, and drop routine debug events before forwarding the remaining data to a log platform. The example is illustrative; the documentation's sample source and destination are not a live deployment. Pipeline Diagnostics can show the effect of functions on the sample's fields and bytes, which helps make a filtering change measurable before it is applied to a real flow.
Choose the deployment and cost boundary
Stream can be run in Cribl.Cloud or installed on infrastructure the team manages. The pricing page lists a free tier with a daily data-volume ceiling and paid tiers with larger or unlimited capacity; Stream and Edge pricing is based on ingested data, and managed infrastructure can add cost. Check the current tier limits against expected volume before routing production telemetry.
Stream's monitoring pages help operators watch the pipeline and its resource use, but the product's main job is to prepare and deliver data. Teams still need a destination such as their existing log or metrics platform for deeper searches, dashboards, and incident diagnosis.
Strengths
- Routes events through ordered processing functions, so teams can redact, parse, enrich, filter, and reduce telemetry before it reaches downstream tools.
- Data Preview and Pipeline Diagnostics support checking sample transformations and their impact before applying them to a real route.
- Supports managed cloud, self-hosted, and hybrid deployment approaches, with integrations to multiple sources and destinations.
Watch out for
- Stream is a telemetry collection and processing layer, not a substitute for the destination analytics product used to investigate application behavior.
- Costs depend on data volume, and managed worker infrastructure may be an additional charge; teams need to account for ingestion before scaling a pipeline.
Best for
- Reducing or reshaping high-volume logs before sending them to monitoring and security tools.
- Redacting sensitive fields and standardizing event formats in a shared telemetry pipeline.
- Routing different telemetry streams to the systems best suited to analyze them.
Sources
- Cribl Stream - Simplify Data Collection, Control, & Routing | Cribl (Oct 26, 2026)
- Get Started with Cribl Stream | Cribl Docs (Oct 26, 2026)
- Cribl Pricing Plans | Cribl (Oct 26, 2026)