Cribl HTTP/S Transport Browser Server Deno Bun

Ships logs to Cribl Stream via the HTTP/S Bulk API source (/cribl/_bulk endpoint). Features include:

• Automatic Cribl HTTP/S Bulk API JSON format
• Built on top of the robust HTTP transport
• Retry logic with exponential backoff
• Rate limiting support
• Batch sending with configurable size and timeout
• Error and debug callbacks
• Configurable event metadata (source, host)

Transport Source

Installation

npm

npm install loglayer @loglayer/transport-cribl-http serialize-error

pnpm

pnpm add loglayer @loglayer/transport-cribl-http serialize-error

yarn

yarn add loglayer @loglayer/transport-cribl-http serialize-error

Setup

You need a Cribl Stream instance with an HTTP/S source configured:

1. In Cribl Stream, add an HTTP/S source (Data > Sources > HTTP/S)
2. Configure the port (default: 10080)
3. Optionally configure auth tokens in the source's Auth Tokens tab

Use the HTTP source URL from your Cribl sources list as the url value.

Cribl Cloud Port Configuration

In Cribl Cloud, only specific ports are externally reachable:

• Port 443 (mapped to internal port 10443) — set your HTTP source port to 10443 to use this
• Ports 20000–20010 — available for additional sources

Other ports (e.g., 10080, 8084) are not externally accessible on Cribl Cloud. See the Cribl Cloud ports documentation for details.

Recommended setup: Set the HTTP source port to 10443, then use:

https://default.main.<organizationId>.cribl.cloud/cribl/_bulk

Node.js Unsafe Port Restriction

Node.js blocks fetch requests to certain ports (including 10080) for security reasons. If you encounter a TypeError: fetch failed with cause: Error: bad port, you are hitting this restriction.

To avoid this, use port 443 (via internal port 10443) or a port in the 20000–20010 range.

Basic Usage

import { LogLayer } from 'loglayer'
import { CriblTransport } from "@loglayer/transport-cribl-http"
import { serializeError } from "serialize-error";

const log = new LogLayer({
  errorSerializer: serializeError,
  transport: new CriblTransport({
    url: "https://your-cribl-instance:10080",
    token: "YOUR-AUTH-TOKEN",
    source: "my-app",
    host: "server-01",
    onError: (err) => {
      console.error('Failed to send logs to Cribl:', err);
    },
    onDebug: (entry) => {
      console.log('Log entry being sent to Cribl:', entry);
    },
    onDebugReqRes: ({ req, res }) => {
      console.log("=== HTTP Request ===");
      console.log("URL:", req.url);
      console.log("Method:", req.method);
      console.log("Headers:", JSON.stringify(req.headers, null, 2));
      console.log("Body:", typeof req.body === "string" ? req.body : `[Uint8Array: ${req.body.length} bytes]`);
      console.log("=== HTTP Response ===");
      console.log("Status:", res.status, res.statusText);
      console.log("Headers:", JSON.stringify(res.headers, null, 2));
      console.log("Body:", res.body);
      console.log("===================");
    },
  })
})

// Use the logger
log.info("This is a test message");
log.withMetadata({ userId: "123" }).error("User not found");

Cribl Cloud

For Cribl Cloud instances, set the HTTP source port to 10443 and use:

const log = new LogLayer({
  errorSerializer: serializeError,
  transport: new CriblTransport({
    url: "https://default.main.<organizationId>.cribl.cloud",
    token: "YOUR-AUTH-TOKEN",
  })
})

Configuration

Required Parameters

Name	Type	Description
url	string	The Cribl Stream instance URL (e.g., "https://your-cribl-instance")

Optional Parameters

Name	Type	Default	Description
token	string	-	Auth token configured in the Cribl HTTP source. If omitted and the source has no tokens configured, unauthorized access is permitted
source	string	-	Source value for events
host	string	-	Host value for events
messageField	string	"_raw"	The field name used for the log message in the event payload
timeField	string	"_time"	The field name used for the timestamp in the event payload
basePath	string	"/cribl"	The base path for the Cribl HTTP event API. The endpoint will be <basePath>/_bulk. Configurable in the Cribl source under "Cribl HTTP event API"
headers	Record<string, string>	-	Custom headers to merge with default headers
enabled	boolean	true	Whether the transport is enabled
level	"trace" | "debug" | "info" | "warn" | "error" | "fatal"	"trace"	Minimum log level to process. Logs below this level will be filtered out

HTTP Transport Optional Parameters

General Parameters

Name	Type	Default	Description
enabled	boolean	true	Whether the transport is enabled
level	"trace" | "debug" | "info" | "warn" | "error" | "fatal"	"trace"	Minimum log level to process. Logs below this level will be filtered out
method	string	"POST"	HTTP method to use for requests
headers	Record<string, string> | (() => Record<string, string>)	{}	Headers to include in the request. Can be an object or a function that returns headers
contentType	string	"application/json"	Content type for single log requests. User-specified headers take precedence
compression	boolean	false	Whether to use gzip compression
maxRetries	number	3	Number of retry attempts before giving up
retryDelay	number	1000	Base delay between retries in milliseconds
respectRateLimit	boolean	true	Whether to respect rate limiting by waiting when a 429 response is received
maxLogSize	number	1048576	Maximum size of a single log entry in bytes (1MB)
maxPayloadSize	number	5242880	Maximum size of the payload (uncompressed) in bytes (5MB)
enableNextJsEdgeCompat	boolean	false	Whether to enable Next.js Edge compatibility

Debug Parameters

Name	Type	Default	Description
onError	(err: Error) => void	-	Error handling callback
onDebug	(entry: Record<string, any>) => void	-	Debug callback for inspecting log entries before they are sent
onDebugReqRes	(reqRes: { req: { url: string; method: string; headers: Record<string, string>; body: string | Uint8Array }; res: { status: number; statusText: string; headers: Record<string, string>; body: string } }) => void	-	Debug callback for inspecting HTTP requests and responses. Provides complete request/response details including headers and body content

Batch Parameters

Name	Type	Default	Description
batchContentType	string	"application/json"	Content type for batch log requests. User-specified headers take precedence
enableBatchSend	boolean	true	Whether to enable batch sending
batchSize	number	100	Number of log entries to batch before sending
batchSendTimeout	number	5000	Timeout in milliseconds for sending batches regardless of size
batchSendDelimiter	string	"\n"	Delimiter to use between log entries in batch mode
batchMode	"delimiter" | "field" | "array"	"delimiter"	Batch mode for sending multiple log entries. "delimiter" joins entries with a delimiter, "field" wraps an array of entries in an object with a field name, "array" sends entries as a plain JSON array of objects
batchFieldName	string	-	Field name to wrap batch entries in when batchMode is "field"

For more details on these options, see the HTTP transport documentation.