logo

NJP

Configuring a Cribl Logstream Destination for Health Log Analytics

Import · Dec 02, 2021 · article

NOTE: This procedure enables TLS with built-in/self-signed certificates. For production deployment you should follow your company’s standard PKI practices regarding certificate configuration. The instructions in this article are provided as-is, with no implied or explicit support or guarantees.

Prerequisites

  1. Navigate to Health Log Analytics->Data Inputs
  2. Click “New”
  3. Select “TCP”
  4. Populate the following fields:
    1. Name: a meaningful name for the data input
    2. Port: an available listening port on the selected MID server
    3. MID: the MID server to receive the log data
    4. Application service: the targeted application service (create one if needed)
    5. Advanced: check this box
    6. Use SSL/TLS: check this box
  5. Click Submit

image

In the Cribl UI:

  1. Navigate to Destinations
  2. Select “TCP JSON”
  3. Populate the following fields:
    1. Output ID: a meaningful name for the destination
    2. Address: the IP address for the MID selected above
    3. Port: the port selected in the Data Input
    4. TLS Settings (Client Side)->Enabled: Yes
    5. Validate server certs: set to "No" if using self-signed certificates
  4. Click Save

image

image

To send data to the new Destination, add a Route with the Output set to “tcpjson:” and associate it with an applicable Pipeline.

View original source

https://www.servicenow.com/community/itom-articles/configuring-a-cribl-logstream-destination-for-health-log/ta-p/2323585