Configuring a Cribl Logstream Destination for Health Log Analytics
Import
·
Dec 02, 2021
·
article
NOTE: This procedure enables TLS with built-in/self-signed certificates. For production deployment you should follow your company’s standard PKI practices regarding certificate configuration. The instructions in this article are provided as-is, with no implied or explicit support or guarantees.
Prerequisites
- Navigate to Health Log Analytics->Data Inputs
- Click “New”
- Select “TCP”
- Populate the following fields:
- Name: a meaningful name for the data input
- Port: an available listening port on the selected MID server
- MID: the MID server to receive the log data
- Application service: the targeted application service (create one if needed)
- Advanced: check this box
- Use SSL/TLS: check this box
- Name: a meaningful name for the data input
- Click Submit
In the Cribl UI:
- Navigate to Destinations
- Select “TCP JSON”
- Populate the following fields:
- Output ID: a meaningful name for the destination
- Address: the IP address for the MID selected above
- Port: the port selected in the Data Input
- TLS Settings (Client Side)->Enabled: Yes
- Validate server certs: set to "No" if using self-signed certificates
- Output ID: a meaningful name for the destination
- Click Save
To send data to the new Destination, add a Route with the Output set to “tcpjson:” and associate it with an applicable Pipeline.
View original source
https://www.servicenow.com/community/itom-articles/configuring-a-cribl-logstream-destination-for-health-log/ta-p/2323585