> For the complete documentation index, see [llms.txt](https://docs.scanner.dev/scanner/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/streams/cribl.md). # Cribl Stream Scanner can ingest data routed through Cribl Stream using Cribl's built-in [Amazon S3 destination](https://docs.cribl.io/stream/destinations-s3/). Cribl workers stage events to local disk, then compress and upload closed files to an S3 collect buffer bucket that Scanner is linked to. This is a natural fit if Cribl already sits in front of your log pipeline: you simply add one more destination. ## Step 1: Set up the collect buffer bucket Follow the [Streams overview](/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/streams.md) to create an S3 collect buffer bucket with a 7-day lifecycle policy and link it to Scanner. ## Step 2: Add an Amazon S3 destination in Cribl Stream In Cribl Stream, create a new **Amazon S3** destination pointed at the collect buffer bucket, and route the desired pipelines to it. The defaults are already what Scanner wants: * **Data format: JSON** (the default). This writes one event per line as newline-delimited JSON. * **Compression: gzip** (the default). * **Key prefix / partitioning expression**: the default time-based partitioning expression works well, producing date-partitioned keys like `2026/07/02/...`. Add a key prefix (e.g., `cribl/`) if the bucket receives data from multiple systems. * **File rotation**: defaults are max file size 32 MB, max open time 300 seconds, max idle time 30 seconds, so events typically land in S3 within a few minutes. Lower the max open time for lower latency. * **Authentication**: use **Auto** (the AWS SDK credential chain: instance profiles, IRSA, etc.) where possible, or configure AssumeRole for cross-account delivery. A couple of operational notes: * Output files are named with random suffixes (e.g., `CriblOut-XXXXXX.json.gz`). This is fine. Scanner discovers files via `s3:ObjectCreated` notifications, not file names. * Events sit in the worker's local staging directory until the file closes and uploads, so keep staging on reliable disk. See Cribl's [S3 Better Practices](https://docs.cribl.io/stream/usecase-s3-better-practices/) guide, especially if you use a high-cardinality partitioning expression. ## Step 3: Ingest via Scanner Collect Follow the [Create an Index Rule](/scanner/using-scanner-complete-feature-reference/data-ingestion/create-an-index-rule.md) guide to ingest the collect buffer bucket via Scanner Collect, using File Type `JsonLines` and Compression `Gzip`. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/streams/cribl.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.