I've been tasked with evaluating our logging pipeline to New Relic. We're currently using the New Relic Infrastructure agent (Fluent Bit under the hood) to forward logs directly.
I'm trying to justify a potential Cribl Stream implementation. The obvious benefit is filtering noise before it hits NR, which should lower our bill. But adding another hop introduces complexity.
Has anyone done a concrete comparison, especially on cost? I'm curious about:
- Real-world reduction in GB/day after Cribl's filtering.
- The operational overhead of managing Cribl versus managing the NR agent configs.
- Any gotchas with maintaining field mapping or log structure for NR's query language.
The agent is simple but dumb. Cribl is powerful but another piece to monitor. Where does the balance tip?