OpenObserve Docs
IntegrationData pipeline

Integration with Cribl

Updated View MarkdownOpen in ChatGPTOpen in Claude

Cribl Stream is a data engine designed to manage the flow of observability and security data. It allows you to route, filter, enrich, and transform data before forwarding it to your observability backend.

Overview

OpenObserve is a high-performance, open-source observability platform built for real-time log and trace analytics. By integrating Cribl with OpenObserve, you can optimize data ingestion while reducing costs and improving monitoring.

Steps to Integrate

Prerequisites
  • Running Cribl Stream instance with access to the UI
  • OpenObserve account (Cloud or Self-Hosted)
Step 1: Configure an Internal Source in Cribl

First configure an internal Cribl source to generate sample logs.

  1. Open Cribl Stream UI → navigate to Worker Group → Routing → QuickConnect.
    Cribl UI

  2. Select Sources from the left menu → Add Source.
    Add Source

  3. Choose System → Internal as the source type, and select Cribl Internal.
    Internal Source

  4. Provide a name (e.g., cribl) → Save & Start.
    Configured Source

At this point, Cribl will generate test logs.

Step 2: Configure a Webhook Destination in Cribl

  1. In the Cribl UI, go to Destinations → Add Destination.Select Webhook.
    Webhook Destination

  2. Configure the webhook:

    • Name: OpenObserve_Webhook
    • Webhook URL: 
      http://<OPENOBSERVE_HOST>/api/<org_id>/cribl/_json
    • HTTP Method: POST Webhook Config
    • Authentication:
      • Type: Basic
      • Username: your OpenObserve user email
      • Password: your ingestion token (both are in Data > Data sources > Other > Cribl, Base64-encoded as the Access Key)

    Auth Config

  3. Save and activate the destination.

Step 3: Route Source Data to OpenObserve
  1. In Cribl, create a Route.
  2. Connect the Internal Source (cribl) → Webhook Destination (OpenObserve_Webhook).
  3. Use Passthru for a simple route, then save.
    Route

You can test the setup by sending sample logs. A success message indicates that OpenObserve received the data.
Route Active

Step 4: Monitor Data in OpenObserve

  • Query Logs

    • Go to Logs and select the cribl stream. You should see logs ingested from Cribl.
      Cribl logs in the Logs page

  • Query Traces

    • If you also send traces from Cribl to an OTLP endpoint, go to Traces and select the cribl stream. The webhook above sends logs only.
      Traces list for the Cribl traces stream
      Trace details for a trace sent through Cribl

Troubleshooting

No data appearing in OpenObserve
  • Verify the Route in Cribl is active and connected to the Webhook destination.
  • Double-check the Webhook URL format: 
    http://<OPENOBSERVE_HOST>/api/<org_id>/cribl/_json
  • Ensure the correct stream name (cribl) is set in the URL.
Authentication failures (401 Unauthorized)
  • Confirm the username (email) and password (ingestion token) are correct.
  • Check if the user has ingest permissions in OpenObserve.
Connection errors / timeouts
  • Make sure the OpenObserve host is reachable from Cribl.
  • If using OpenObserve Cloud, ensure your firewall/VPC rules allow outbound connections.
Logs are ingested but not parsed correctly
  • Confirm you’re using the _json endpoint in the Webhook URL.
  • Check if the incoming data structure matches what OpenObserve expects (JSON payload).
Was this page helpful?

Integration with Apache Airflow

Collect and monitor Apache Airflow logs and metrics with OpenTelemetry Collector and visualize them in OpenObserve.

Integrating MuleSoft AMC Logs with OpenObserve

Fetch logs from the MuleSoft Anypoint Monitoring Console and stream them into OpenObserve. Covers authentication, the AMC API, and automating the workflow.

On this page

Integration with CriblOverviewSteps to IntegrateTroubleshooting